mlsanityData to 13 Oct 2026

SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure

arXiv 2609.06540 ↗First posted 6 Sep 2026cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language models (LLMs) are increasingly deployed in safety-critical applications, yet jailbreak attacks can conceal harmful intent through role-playing, fictional scenarios, or seemingly benign motivations. Existing inference-time defenses may miss disguised attacks or excessively refuse legitimate requests. We propose SRD-GUARD, a parameter-free, black-box defense framework that exposes concealed intent through semantic rewriting and consensus-based risk assessment. Given an input prompt, SRD-GUARD generates five semantically related rewrites that preserve the underlying objective while removing unnecessary contextual packaging. The original prompt and rewrites are jointly evaluated by multiple independent LLM-based safety scorers on a continuous risk scale. A decision module combines absolute risk thresholds with relative risk changes between the original and rewritten prompts to adaptively intercept, preserve, or warn on requests. We evaluate SRD-GUARD against UNIATTACK, CIPHER, and DeepInception on Llama-3-8B-Uncensored and DeepSeek-V4-Flash using AdvBench and OR-Bench-Hard. SRD-GUARD achieves average DSRs of 91.44% and 100%, with ORRs of 8.00% and 12.00%, respectively. Compared with evaluated baselines, it provides a more favorable DSR--ORR trade-off. Ablation studies show that rewriting exposes concealed harmful intent, joint scoring improves robustness to individual evaluator behavior, and risk-adaptive decision making enables selective handling of ambiguous inputs. These results demonstrate that semantic intent exposure, consensus-based risk assessment, and relative-risk-aware routing provide an effective and selective approach to black-box jailbreak defense. The artifact is available at https://anonymous.4open.science/status/CICD-Guard-D648.

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 20 of its 28 references that are in the map. First posted on arXiv 6 Sep 2026.

Builds on

20 of 28 references.

Closest ancestors · 9

Same direction, newest first

  1. 2026Automated jailbreak attack targeting multiple defense strategies15 Jun
  2. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks2 Mar
  3. 2024Intention Analysis Makes LLMs A Good Jailbreak Defender12 Jan
  4. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  6. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  7. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  9. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 11

  1. 2022Training language models to follow instructions with human feedbackcited by 15,856
  2. 2024The Llama 3 Herd of Modelscited by 14,486
  3. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,968
  4. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,181
  5. 2024Qwen2.5-Coder Technical Reportcited by 1,179
  6. 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 961
  7. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  8. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 235
  9. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 222
  10. 2024Phi-3 Safety Post-Training: Aligning Language Models with a "Break-Fix" Cyclecited by 32
  11. 2026Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinementcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Models
  2. 2026Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats
  3. 2025Friend or Foe: How LLMs' Safety Mind Gets Fooled by Intent Shift Attack
  4. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
  5. 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models
  6. 2025Sugar-Coated Poison: Benign Generation Unlocks LLM Jailbreaking
  7. 2025GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms
  8. 2026LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense