mlsanityData to 7 Oct 2026

CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation

arXiv 2609.21793 ↗First posted 18 Sep 2026cs.CR cs.CLcited by 1

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Defenses against jailbreak attacks on Large Language Models (LLMs) operate at different pipeline stages, such as input modification or output guard, but it remains unclear which defenses to deploy at each stage and how to combine them. Prior empirical studies, fragmented by inconsistent attack-success-rate definitions and experimental settings, have evaluated defenses largely in isolation. Here we present the first systematic study, to our knowledge, of defense combinations both within and across pipeline stages, under a consistent threat model of direct, black-box, single-turn attacks. Our decision framework standardizes evaluation through a principled attack-success-rate formulation with controlled query budgets, together with explicit fairness rules. Across 19 attacks and 15 defenses, we find that no single defense is universally best, but well-chosen combinations achieve substantial safety with minimal utility degradation, yielding practical recommendations for layered defense pipelines.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 35 of its 61 references that are in the map. First posted on arXiv 18 Sep 2026.

Builds on

35 of 61 references.

Closest ancestors · 21

Same direction, newest first

  1. 2025TeleAI-Safety: A comprehensive LLM jailbreaking benchmark towards attacks, defenses, and evaluations5 Dec
  2. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections10 Oct
  3. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Models12 Jun
  4. 2025GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods24 Feb
  5. 2024SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt Chains10 Nov
  6. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusal25 Apr
  7. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  9. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  10. 2024Defending LLMs against Jailbreaking Attacks via Backtranslation26 Feb
  11. 2024GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis21 Feb
  12. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
9 more
  1. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuning9 Feb
  2. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs8 Feb
  3. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
  4. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  5. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  6. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  7. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  8. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  9. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 14

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  6. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  8. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  9. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  10. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  11. 2025GuardReasoner: Towards Reasoning-based LLM Safeguardscited by 89
  12. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
2 more
  1. 2023Applying Large Language Models and Chain-of-Thought for Automatic Scoringcited by 68
  2. 2026Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teamingcited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026False Floors: LLM Safety Routing Evaluations Break Under Distribution Shiftcited by 0