mlsanityData to 7 Oct 2026

JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation

arXiv 2502.07557 ↗First posted 11 Feb 2025cs.CRcited by 46

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Despite the implementation of safety alignment strategies, large language models (LLMs) remain vulnerable to jailbreak attacks, which undermine these safety guardrails and pose significant security threats. Some defenses have been proposed to detect or mitigate jailbreaks, but they are unable to withstand the test of time due to an insufficient understanding of jailbreak mechanisms. In this work, we investigate the mechanisms behind jailbreaks based on the Linear Representation Hypothesis (LRH), which states that neural networks encode high-level concepts as subspaces in their hidden representations. We define the toxic semantics in harmful and jailbreak prompts as toxic concepts and describe the semantics in jailbreak prompts that manipulate LLMs to comply with unsafe requests as jailbreak concepts. Through concept extraction and analysis, we reveal that LLMs can recognize the toxic concepts in both harmful and jailbreak prompts. However, unlike harmful prompts, jailbreak prompts activate the jailbreak concepts and alter the LLM output from rejection to compliance. Building on our analysis, we propose a comprehensive jailbreak defense framework, JBShield, consisting of two key components: jailbreak detection JBShield-D and mitigation JBShield-M. JBShield-D identifies jailbreak prompts by determining whether the input activates both toxic and jailbreak concepts. When a jailbreak prompt is detected, JBShield-M adjusts the hidden representations of the target LLM by enhancing the toxic concept and weakening the jailbreak concept, ensuring LLMs produce safe content. Extensive experiments demonstrate the superior performance of JBShield, achieving an average detection accuracy of 0.95 and reducing the average attack success rate of various jailbreak attacks to 2% from 61% across distinct LLMs.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. First posted on arXiv 11 Feb 2025.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 17; 2026: 29.

46 papers.

Sort:

By area:

  1. 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defendercited by 37
  2. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Modelscited by 17
  3. 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMscited by 7
  4. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 6
  5. 2025Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domaincited by 5
  6. 2026No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skillscited by 5
  7. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  8. 2025QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systemscited by 4
  9. 2026GAVEL: Towards Rule-Based Safety Through Activation Monitoringcited by 4
  10. 2025Online Learning Defense against Iterative Jailbreak Attacks via Prompt Optimizationcited by 3
  11. 2026ALERT: Zero-shot LLM Jailbreak Detection via Internal Discrepancy Amplificationcited by 3
  12. 2026AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agentcited by 3
34 more
  1. 2025Dual-Space Smoothness for Robust and Balanced LLM Unlearningcited by 2
  2. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 2
  3. 2026Test-Time Safety Alignmentcited by 2
  4. 2026SoK: Robustness in Large Language Models against Jailbreak Attackscited by 2
  5. 2025SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Modelscited by 1
  6. 2025HFuzzer: Testing Large Language Models for Package Hallucinations via Phrase-based Fuzzingcited by 1
  7. 2025Bits Leaked per Query: Information-Theoretic Bounds on Adversarial Attacks against LLMscited by 1
  8. 2025AlignTree: Efficient Defense Against LLM Jailbreak Attackscited by 1
  9. 2026ShallowJail: Steering Jailbreaks against Large Language Modelscited by 1
  10. 2026Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Headscited by 1
  11. 2026GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Modelscited by 1
  12. 2026CoopGuard: Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Round Attackscited by 1
  13. 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
  14. 2025Optimus: A Robust Defense Framework for Mitigating Toxicity while Fine-Tuning Conversational AIcited by 0
  15. 2025SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Modelscited by 0
  16. 2025Sentra-Guard: A Real-Time Multilingual Defense Against Adversarial LLM Promptscited by 0
  17. 2025ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Modelscited by 0
  18. 2025Super Suffixes: Bypassing Text Generation Alignment and Guard Models Simultaneouslycited by 0
  19. 2026LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignmentcited by 0
  20. 2026Detecting Jailbreak Attempts in Clinical Training LLMs Through Automated Linguistic Feature Extractioncited by 0
  21. 2026Recursive language models for jailbreak detection: a procedural defense for tool-augmented agentscited by 0
  22. 2026Hiding in Plain Text: Detecting Concealed Jailbreaks via Activation Disentanglementcited by 0
  23. 2026Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detectioncited by 0
  24. 2026Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Modelscited by 0
  25. 2026Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulationcited by 0
  26. 2026Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activationscited by 0
  27. 2026Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreakcited by 0
  28. 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defensecited by 0
  29. 2026Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safetycited by 0
  30. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  31. 2026Local Sparsity Enables Unsupervised LLM Safety Detectioncited by 0
  32. 2026HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inferencecited by 0
  33. 2026A Survey on the Linear Representation Hypothesiscited by 0
  34. 2026Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failurescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models
  2. 2026JPU: Bridging Jailbreak Defense and Unlearning via On-Policy Path Rectification
  3. 2026From Concept-Aligned Tokens to Vulnerable Features: Mechanistic Localization of Jailbreaks
  4. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  5. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models
  6. 2026SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
  7. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  8. 2026AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks