mlsanityData to 7 Oct 2026

Defending LLMs against Jailbreaking Attacks via Backtranslation

arXiv 2402.16459 ↗First posted 26 Feb 2024cs.CL cs.AIcited by 65

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Although many large language models (LLMs) have been trained to refuse harmful requests, they are still vulnerable to jailbreaking attacks which rewrite the original prompt to conceal its harmful intent. In this paper, we propose a new method for defending LLMs against jailbreaking attacks by ``backtranslation''. Specifically, given an initial response generated by the target LLM from an input prompt, our backtranslation prompts a language model to infer an input prompt that can lead to the response. The inferred prompt is called the backtranslated prompt which tends to reveal the actual intent of the original prompt, since it is generated based on the LLM's response and not directly manipulated by the attacker. We then run the target LLM again on the backtranslated prompt, and we refuse the original prompt if the model refuses the backtranslated prompt. We explain that the proposed defense provides several benefits on its effectiveness and efficiency. We empirically demonstrate that our defense significantly outperforms the baselines, in the cases that are hard for the baselines, and our defense also has little impact on the generation quality for benign input prompts. Our implementation is based on our library for LLM jailbreaking defense algorithms at urlhttps://github.com/YihanWang617/llm-jailbreaking-defense, and the code for reproducing our experiments is available at urlhttps://github.com/YihanWang617/LLM-Jailbreaking-Defense-Backtranslation.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 24 of its 30 references that are in the map. First posted on arXiv 26 Feb 2024.

Builds on

24 of 30 references.

Closest ancestors · 15

Same direction, newest first

  1. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  2. 2024When "Competency" in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers16 Feb
  3. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
  4. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  5. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  7. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  8. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  9. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  10. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  11. 2023Detecting Language Model Attacks with Perplexity27 Aug
  12. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
3 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  2. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul
  3. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study23 May

Other references · 9

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  4. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  6. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  7. 2022Large Language Models Are Human-Level Prompt Engineerscited by 1,020
  8. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  9. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 111

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 17; 2025: 34; 2026: 14.

65 papers.

Sort:

By area:

  1. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  2. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 135
  3. 2024Know Your Limits: A Survey of Abstention in Large Language Modelscited by 116
  4. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defensescited by 68
  5. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  6. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attackscited by 49
  7. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
  8. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  9. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Modelscited by 33
  10. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMscited by 23
  11. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
  12. 2025EmoAgent: Assessing and Safeguarding Human-AI Interaction for Mental Health Safetycited by 21
38 more
  1. 2024VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wildcited by 17
  2. 2025Learning Safety Constraints for Large Language Modelscited by 13
  3. 2024Quantized Delta Weight Is Safety Keepercited by 12
  4. 2025Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviorscited by 12
  5. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  6. 2024Improved Large Language Model Jailbreak Detection via Pretrained Embeddingscited by 10
  7. 2024SATA: A Paradigm for LLM Jailbreak via Simple Assistive Task Linkagecited by 10
  8. 2025Single-pass Detection of Jailbreaking Input in Large Language Modelscited by 10
  9. 2025Defense against Prompt Injection Attacks via Mixture of Encodingscited by 10
  10. 2025DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modificationcited by 10
  11. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  12. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  13. 2024Merging Improves Self-Critique Against Jailbreak Attackscited by 8
  14. 2025Evolving Security in LLMs: A Study of Jailbreak Attacks and Defensescited by 8
  15. 2025LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasurescited by 8
  16. 2025Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMscited by 8
  17. 2025Masks and Mimicry: Strategic Obfuscation and Impersonation Attacks on Authorship Verificationcited by 7
  18. 2025IndoSafety: Culturally Grounded Safety for LLMs in Indonesian Languagescited by 7
  19. 2026The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanismcited by 7
  20. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Modelscited by 6
  21. 2025Concept-Level Explainability for Auditing & Steering LLM Responsescited by 6
  22. 2025LoRA is All You Need for Safety Alignment of Reasoning LLMscited by 6
  23. 2026HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defensecited by 6
  24. 2024Can LLMs be Fooled? Investigating Vulnerabilities in LLMscited by 5
  25. 2025Bleeding Pathways: Vanishing Discriminability in LLM Hidden States Fuels Jailbreak Attackscited by 5
  26. 2025Active Attacks: Red-teaming LLMs via Adaptive Environmentscited by 5
  27. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attackscited by 4
  28. 2025Chain-of-Thought Driven Adversarial Scenario Extrapolation for Robust Language Modelscited by 4
  29. 2025JavelinGuard: Low-Cost Transformer Architectures for LLM Securitycited by 4
  30. 2025Safety Instincts: LLMs Learn to Trust Their Internal Compass for Self-Defensecited by 4
  31. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  32. 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probingcited by 4
  33. 2026Sparse Autoencoders are Capable LLM Jailbreak Mitigatorscited by 4
  34. 2025MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuningcited by 3
  35. 2025Do Internal Layers of LLMs Reveal Patterns for Jailbreak Detection?cited by 3
  36. 2025DSCD: Large Language Model Detoxification with Self-Constrained Decodingcited by 3
  37. 2026Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Modelscited by 3
  38. 2026Large Language Models Generate Harmful Responses Using a Distinct Mechanism, Shared Across Harm Typescited by 3

50 most cited of 65 All 65 (JSON)