mlsanityData to 7 Oct 2026

TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

arXiv 2604.07727 ↗First posted 9 Apr 2026cs.CR cs.AIcited by 2

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Existing jailbreak defense paradigms primarily rely on static detection of prompts, outputs, or internal states, often neglecting the dynamic evolution of risk during decoding. This oversight leaves risk signals embedded in decoding trajectories underutilized, constituting a critical blind spot in current defense systems. In this work, we empirically demonstrate that hidden states in critical layers during the decoding phase carry stronger and more stable risk signals than input jailbreak prompts. Specifically, the hidden representations of tokens generated during jailbreak attempts progressively approach high-risk regions in the latent space. Based on this observation, we propose TrajGuard, a training-free, decoding-time defense framework. TrajGuard aggregates hidden-state trajectories via a sliding window to quantify risk in real time, triggering a lightweight semantic adjudication only when risk within a local window persistently exceeds a threshold. This mechanism enables the immediate interruption or constraint of subsequent decoding. Extensive experiments across 12 jailbreak attacks and various open-source LLMs show that TrajGuard achieves an average defense rate of 95%. Furthermore, it reduces detection latency to 5.2 ms/token while maintaining a false positive rate below 1.5%. These results confirm that hidden-state trajectories during decoding can effectively support real-time jailbreak detection, highlighting a promising direction for defenses without model modification.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 25 of its 40 references that are in the map. First posted on arXiv 9 Apr 2026.

Builds on

25 of 40 references.

Closest ancestors · 14

Same direction, newest first

  1. 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender13 Apr
  2. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment27 Nov
  3. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  4. 2024Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge8 Apr
  5. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  6. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
  7. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
  8. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  10. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  11. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  12. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
2 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  2. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 11

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  4. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  5. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  6. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  7. 2023On the Robustness of Code Generation Techniques: An Empirical Study on GitHub Copilotcited by 64
  8. 2025AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraintcited by 45
  9. 2024An Empirical Study on Capability of Large Language Models in Understanding Code Semanticscited by 7
  10. 2025CARE: Decoding Time Safety Alignment via Rollback and Introspection Interventioncited by 5
  11. 2025DSCD: Large Language Model Detoxification with Self-Constrained Decodingcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Before the Last Token: Diagnosing Final-Token Safety Probe Failurescited by 3
  2. 2026Useful Features, Backward Scores: OOD in Language-Model Trajectoriescited by 0