mlsanityData to 14 Oct 2026

X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability

arXiv 2502.09990 ↗First posted 14 Feb 2025cs.CR cs.AI cs.CLcited by 20

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Despite the rapid development of safety alignment techniques for LLMs, defending against multi-turn jailbreaks is still a challenging task. In this paper, we conduct a comprehensive comparison, revealing that some existing defense methods can improve the robustness of LLMs against multi-turn jailbreaks but compromise usability, i.e., reducing general capabilities or causing the over-refusal problem. From the perspective of mechanism interpretability of LLMs, we discover that these methods fail to establish a boundary that exactly distinguishes safe and harmful feature representations. Therefore, boundary-safe representations close to harmful representations are inevitably disrupted, leading to a decline in usability. To address this issue, we propose X-Boundary to push harmful representations away from boundary-safe representations and obtain an exact distinction boundary. In this way, harmful representations can be precisely erased without disrupting safe ones. Experimental results show that X-Boundary achieves state-of-the-art defense performance against multi-turn jailbreaks, while reducing the over-refusal rate by about 20% and maintaining nearly complete general capability. Furthermore, we theoretically prove and empirically verify that X-Boundary can accelerate the convergence process during training. Please see our code at: https://github.com/AI45Lab/X-Boundary.

Key facts. Cited by 20 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 56 of its 81 references that are in the map. First posted on arXiv 14 Feb 2025.

Builds on

56 of 81 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models1 Sep
  2. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models31 May
  3. 2024WordGame: Efficient & Effective LLM Jailbreak via Simultaneous Obfuscation in Query and Response22 May
  4. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  5. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  6. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep

Other references · 50

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  6. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  7. 2024Qwen2.5 Technical Reportcited by 4,942
  8. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  10. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  11. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
38 more
  1. 2024DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Modelcited by 1,135
  2. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  3. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 839
  4. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  5. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  6. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  8. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  9. 2024Understanding the planning of LLM agents: A surveycited by 421
  10. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  11. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
  12. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  13. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  14. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  15. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  16. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritizationcited by 170
  17. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 151
  18. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 145
  19. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 77
  20. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
  21. 2024Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Trainingcited by 69
  22. 2023The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensivenesscited by 67
  23. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialoguecited by 66
  24. 2024VLSBench: Unveiling Visual Leakage in Multimodal Safetycited by 63
  25. 2024MineDreamer: Learning to Follow Instructions via Chain-of-Imagination for Simulated-World Controlcited by 53
  26. 2024Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledgecited by 51
  27. 2024CoSafe: Evaluating Large Language Model Safety in Multi-Turn Dialogue Coreferencecited by 51
  28. 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
  29. 2024Identifying Semantic Induction Heads to Understand In-Context Learningcited by 47
  30. 2024Navigating the OverKill in Large Language Modelscited by 44
  31. 2024MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialoguecited by 33
  32. 2024Protecting Your LLMs with Information Bottleneckcited by 29
  33. 2021Measuring Generalization with Optimal Transportcited by 25
  34. 2024The Better Angels of Machine Personality: How Personality Relates to LLM Safetycited by 21
  35. 2024RH20T-P: A Primitive-Level Robotic Dataset Towards Composable Generalization Agentscited by 20
  36. 2024SoFA: Shielded On-the-fly Alignment via Priority Rule Followingcited by 18
  37. 2024Towards Tracing Trustworthiness Dynamics: Revisiting Pre-training Period of Large Language Modelscited by 18
  38. 2020k-Variance: A Clustered Notion of Variancecited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 15; 2026: 5.

20 papers.

Sort:

By area:

  1. 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligencecited by 170
  2. 2025A Survey of Efficient Reasoning for Large Reasoning Models: Language, Multimodality, and Beyondcited by 132
  3. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  4. 2025IS-Bench: Evaluating Interactive Safety of VLM-Driven Embodied Agents in Daily Household Taskscited by 41
  5. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 34
  6. 2025The LLM Already Knows: Estimating LLM-Perceived Question Difficulty via Hidden Representationscited by 29
  7. 2025Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignmentcited by 24
  8. 2025SafeDialBench: A Fine-Grained Safety Evaluation Benchmark for Large Language Models in Multi-Turn Dialogues with Diverse Jailbreak Attackscited by 23
  9. 2025Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attackscited by 20
  10. 2025A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreakscited by 10
  11. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safetycited by 8
  12. 2025NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreakscited by 7
8 more
  1. 2026SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignmentcited by 4
  2. 2026CoopGuard: Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Round Attackscited by 2
  3. 2025Understanding and Mitigating Over-refusal for Large Language Models via Representation Interventioncited by 1
  4. 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directionscited by 1
  5. 2025Concept Concentration for Faithful Representation Interventioncited by 0
  6. 2025Towards provable probabilistic safety for scalable embodied AI systemscited by 0
  7. 2025Decoupling Safety into Orthogonal Subspace: Cost-Efficient and Performance-Preserving Alignment for Large Language Modelscited by 0
  8. 2026Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models
  2. 2025Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction
  3. 2026HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
  4. 2025Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race?
  5. 2024The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense
  6. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment
  7. 2025Efficient Safety Retrofitting Against Jailbreaking for LLMs
  8. 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden States