# Rapid Response: Mitigating LLM Jailbreaks with a Few Examples

arXiv: https://arxiv.org/abs/2411.07494 · HTML: https://mlsanity.com/paper/2411.07494/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Placed in Jailbreaking, one of 12 directions in LLM safety and security.
- First posted on arXiv 12 Nov 2024.

## Placed in

- LLM safety and security / [Jailbreaking](https://mlsanity.com/safety/jailbreaking/)

## Built on by (most cited first, 16 of 16)

- [EmoAgent: Assessing and Safeguarding Human-AI Interaction for Mental Health Safety](https://mlsanity.com/paper/2504.09689/) (2025)
- [SoK: Evaluating Jailbreak Guardrails for Large Language Models](https://mlsanity.com/paper/2506.10597/) (2025)
- [AegisLLM: Scaling Agentic Systems for Self-Reflective Defense in LLM Security](https://mlsanity.com/paper/2504.20965/) (2025)
- [Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval](https://mlsanity.com/paper/2505.15753/) (2025)
- [Disentangled Safety Adapters Enable Efficient Guardrails and Flexible Inference-Time Alignment](https://mlsanity.com/paper/2506.00166/) (2025)
- [Takedown: How It's Done in Modern Coding Agent Exploits](https://mlsanity.com/paper/2509.24240/) (2025)
- [JailbreaksOverTime: Detecting Jailbreak Attacks Under Distribution Shift](https://mlsanity.com/paper/2504.19440/) (2025)
- [Toward Principled LLM Safety Testing: Solving the Jailbreak Oracle Problem](https://mlsanity.com/paper/2506.17299/) (2025)
- [Mitigating Jailbreaks with Intent-Aware LLMs](https://mlsanity.com/paper/2508.12072/) (2025)
- [A Framework for Rapidly Developing and Deploying Protection Against Large Language Model Attacks](https://mlsanity.com/paper/2509.20639/) (2025)
- [A Red Teaming Roadmap Towards System-Level Safety](https://mlsanity.com/paper/2506.05376/) (2025)
- [On-Policy Consistency Training Improves LLM Safety with Minimal Capability Degradation](https://mlsanity.com/paper/2605.21834/) (2026)
- [LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems](https://mlsanity.com/paper/2509.10682/) (2025)
- [Security Assessment and Mitigation Strategies for Large Language Models: A Comprehensive Defensive Framework](https://mlsanity.com/paper/2603.17123/) (2026)
- [Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Training](https://mlsanity.com/paper/2605.28467/) (2026)
- [Rapid Poison: Practical Poisoning Attacks Against the Rapid Response Framework](https://mlsanity.com/paper/2606.16242/) (2026)

## Abstract (arXiv)

As large language models (LLMs) grow more powerful, ensuring their safety against misuse becomes crucial. While researchers have focused on developing robust defenses, no method has yet achieved complete invulnerability to attacks. We propose an alternative approach: instead of seeking perfect adversarial robustness, we develop rapid response techniques to look to block whole classes of jailbreaks after observing only a handful of attacks. To study this setting, we develop RapidResponseBench, a benchmark that measures a defense's robustness against various jailbreak strategies after adapting to a few observed examples. We evaluate five rapid response methods, all of which use jailbreak proliferation, where we automatically generate additional jailbreaks similar to the examples observed. Our strongest method, which fine-tunes an input classifier to block proliferated jailbreaks, reduces attack success rate by a factor greater than 240 on an in-distribution set of jailbreaks and a factor greater than 15 on an out-of-distribution set, having observed just one example of each jailbreaking strategy. Moreover, further studies suggest that the quality of proliferation model and number of proliferated examples play an key role in the effectiveness of this defense. Overall, our results highlight the potential of responding rapidly to novel jailbreaks to limit LLM misuse.