mlsanityData to 14 Oct 2026

Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing

arXiv 2605.10582 ↗First posted 11 May 2026cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

This paper proposes a guaranteed defense method for large language models (LLMs) to safeguard against jailbreaking attacks. Drawing inspiration from the denoised-smoothing approach in the adversarial defense domain, we propose a novel smoothing-based defense method, termed Disrupt-and-Rectify Smoothing (DR-Smoothing). Specifically, we integrate a two-stage prompt processing scheme-first disrupting the input prompt, then rectifying it-into the conventional smoothing defense framework. This disrupt-and-rectify approach improves upon previous disrupt-only approaches by restoring out-of-distribution disrupted prompts to an in-distribution form, thereby reducing the risk of unpredictable LLM behavior. In addition, this two-stage scheme offers a distinct advantage in striking a balance between harmlessness and helpfulness in jailbreaking defense. Notably, we present a theoretical analysis for generic smoothing framework, offering a tight bound for the defense success probability and the requirements on the disruption strength. Our approach can defend against both token-level and prompt-level jailbreaking attacks, under both established and adaptive attacking scenarios. Extensive experiments demonstrate that our approach surpasses current state-of-the-art defense methods in terms of both harmlessness and helpfulness.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 23 of its 29 references that are in the map. First posted on arXiv 11 May 2026.

Builds on

23 of 29 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  2. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing28 May
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  4. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 19

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2025Qwen3 Technical Reportcited by 8,820
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  7. 2019Fine-Tuning Language Models from Human Preferencescited by 2,150
  8. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  10. 2023Instruction-Following Evaluation for Large Language Modelscited by 1,228
  11. 2020Beyond Accuracy: Behavioral Testing of NLP models with CheckListcited by 1,006
  12. 2023Large Language Modelscited by 780
7 more
  1. 2023Are aligned neural networks adversarially aligned?cited by 315
  2. 2023Pretraining Language Models with Human Preferencescited by 247
  3. 2019BPE-Dropout: Simple and Effective Subword Regularizationcited by 195
  4. 2023On the Reliability of Watermarks for Large Language Modelscited by 189
  5. 2019Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attackcited by 176
  6. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  7. 2023Are Large Language Models Really Robust to Word-Level Perturbations?cited by 32

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks
  2. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  3. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
  4. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuning
  5. 2024Rapid Response: Mitigating LLM Jailbreaks with a Few Examples
  6. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks
  7. 2024Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation
  8. 2026Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models