mlsanityData to 7 Oct 2026

Smoothed Embeddings for Robust Language Models

arXiv 2501.16497 ↗First posted 27 Jan 2025cs.LG cs.AI cs.CLcited by 8

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Improving the safety and reliability of large language models (LLMs) is a crucial aspect of realizing trustworthy AI systems. Although alignment methods aim to suppress harmful content generation, LLMs are often still vulnerable to jailbreaking attacks that employ adversarial inputs that subvert alignment and induce harmful outputs. We propose the Randomized Embedding Smoothing and Token Aggregation (RESTA) defense, which adds random noise to the embedding vectors and performs aggregation during the generation of each output token, with the aim of better preserving semantic information. Our experiments demonstrate that our approach achieves superior robustness versus utility tradeoffs compared to the baseline defenses.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 29 of its 32 references that are in the map. First posted on arXiv 27 Jan 2025.

Builds on

29 of 32 references.

Closest ancestors · 12

Same direction, newest first

  1. 2024PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetition13 May
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  3. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  4. 2024RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content19 Mar
  5. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  6. 2024Fast Adversarial Attacks on Language Models In One GPU Minute23 Feb
  7. 2024Query-Based Adversarial Prompt Generation19 Feb
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  9. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  10. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  11. 2023Detecting Language Model Attacks with Perplexity27 Aug
  12. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 17

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  10. 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 865
  11. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  12. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
5 more
  1. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  2. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  3. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  4. 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23
  5. 2023Randomized Smoothing with Masked Inference for Adversarially Robust Text Classificationscited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 6.

8 papers.

  1. 2025Chain-of-Thought Driven Adversarial Scenario Extrapolation for Robust Language Modelscited by 4
  2. 2026φ-DPO: Fairness Direct Preference Optimization Approach to Continual Learning in Large Multimodal Modelscited by 2
  3. 2026Test-Time Safety Alignmentcited by 2
  4. 2026Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Headscited by 1
  5. 2025Embedding Poisoning: Bypassing Safety Alignment via Embedding Semantic Shiftcited by 0
  6. 2026Directional Embedding Smoothing for Robust Vision Language Modelscited by 0
  7. 2026Towards Understanding the Robustness of Sparse Autoencoderscited by 0
  8. 2026Re-Triggering Safeguards within LLMs for Jailbreak Detectioncited by 0