SafeBehavior: Simulating Human-Like Multistage Reasoning to Mitigate Jailbreak Attacks in Large Language Models
On the map: LLM reasoning → Reasoning for agents, planning and code
also in 1 more
Abstract (arXiv)
Large Language Models (LLMs) have achieved impressive performance across diverse natural language processing tasks, but their growing power also amplifies potential risks such as jailbreak attacks that circumvent built-in safety mechanisms. Existing defenses including input paraphrasing, multi step evaluation, and safety expert models often suffer from high computational costs, limited generalization, or rigid workflows that fail to detect subtle malicious intent embedded in complex contexts. Inspired by cognitive science findings on human decision making, we propose SafeBehavior, a novel hierarchical jailbreak defense mechanism that simulates the adaptive multistage reasoning process of humans. SafeBehavior decomposes safety evaluation into three stages: intention inference to detect obvious input risks, self introspection to assess generated responses and assign confidence based judgments, and self revision to adaptively rewrite uncertain outputs while preserving user intent and enforcing safety constraints. We extensively evaluate SafeBehavior against five representative jailbreak attack types including optimization based, contextual manipulation, and prompt based attacks and compare it with seven state of the art defense baselines. Experimental results show that SafeBehavior significantly improves robustness and adaptability across diverse threat scenarios, offering an efficient and human inspired approach to safeguarding LLMs against jailbreak attempts.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 36 of its 73 references that are in the map. First posted on arXiv 30 Sep 2025.
Builds on
36 of 73 references.
References · 36
- 2023GPT-4 Technical Reportcited by 18,396
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2025Qwen2.5-VL Technical Reportcited by 5,587
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Qwen Technical Reportcited by 3,344
- 2023Mistral 7Bcited by 3,164
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
- 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
- 2023Detecting Language Model Attacks with Perplexitycited by 431
- 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
- 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
24 more
- 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
- 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
- 2023Removing RLHF Protections in GPT-4 via Fine-Tuningcited by 171
- 2024A Survey on Recent Advances in LLM-Based Multi-turn Dialogue Systemscited by 170
- 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 145
- 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 129
- 2023Evil Geniuses: Delving into the Safety of LLM-based Agentscited by 106
- 2024A Comprehensive Survey on Process-Oriented Automatic Text Summarization with Exploration of LLM-Based Methodscited by 102
- 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Modelscited by 76
- 2024Intention Analysis Makes LLMs A Good Jailbreak Defendercited by 74
- 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 74
- 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defensescited by 70
- 2024EasyJailbreak: A Unified Framework for Jailbreaking Large Language Modelscited by 60
- 2023Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Informationcited by 33
- 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 33
- 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddingscited by 32
- 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMscited by 21
- 2024Is the System Message Really Important to Jailbreaks in Large Language Models?cited by 20
- 2024Configurable Safety Tuning of Language Models with Synthetic Preference Datacited by 14
- 2025When Grammar Guides the Attack: Uncovering Control-Plane Vulnerabilities in LLMs with Structured Outputcited by 4
- 2025Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learningcited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking
- 2024Reasoning as a Weapon: Adaptive Dual-Path Jailbreak Attack on Large Language Models
- 2025Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs
- 2025Breaking Minds, Breaking Systems: Jailbreaking Large Language Models via Human-like Psychological Manipulation
- 2025SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Models
- 2025Reasoned Safety Alignment: Ensuring Jailbreak Defense via Answer-Then-Check
- 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning
- 2026AISA: Awakening Intrinsic Safety Awareness in Large Language Models against Jailbreak Attacks