AlcaTRAz is a prompt‑level defense that uses rule trees to insert controlled character‑level perturbations into input text, disrupting jailbreak attacks without modifying or retraining the target LLM. It operates solely on the input, making it suitable for black‑box deployments, and was evaluated on 33 open‑weight models and 22 jailbreak types, outperforming three baseline defenses in 73.4 % of model‑attack combinations. While it significantly reduces high‑severity jailbreak success, it does not eliminate it and is intended as one layer of a broader defense strategy.
By Jakub Re\v{s}, Petr Ka\v{s}ka, Martin Pere\v{s}\'ini, Martin Ukrop, Kamil Malinka
arXiv:2608. 15594v1 Announce Type: new Abstract: Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails.
By Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu, Ruihong Huang
arXiv:2512. 14751v3 Announce Type: replace-cross Abstract: Finetuning pretrained large language models (LLMs) has become the standard paradigm for developing downstream applications.
By Yixin Tan, Zhe Yu, Rui Wen, Jun Sakuma
arXiv:2605. 07032v2 Announce Type: replace-cross Abstract: The evolution of generative models from next-token predictors to autonomous engines of complex systems necessitates rigorous safety hardening.
By Montaser Mohammedalamen, Kevin Roice, Reginald McLean, Alyssa Lefaivre \v{S}kopac
The paper introduces SSRFT (Supervised Safe-Role Fine‑Tuning), a new framework that reframes safety alignment for large language models as internalizing a predefined safe role rather than relying on explicit refusal patterns. SSRFT builds a Safe‑Role Question‑Answer dataset from psychometric questions, limited jailbreak prompts, and a safe‑role description, then synthesizes and validates role‑consistent responses to expose models to diverse safety scenarios. Experiments on multiple base and instruct models demonstrate that SSRFT yields more robust and generalizable safety alignment, better resilience to prefilling attacks, improved generalization to unseen jailbreak domains, and reduced over‑refusal on benign queries while preserving general capabilities.
By Jinghao Pang, Jitai Hao, Qiang Huang, Zhaochun Ren, Jun Yu
arXiv:2602. 05746v2 Announce Type: replace-cross Abstract: Prompt injection is a critical vulnerability in LLM agents, yet the strongest methods still rely on human red-teamers and hand-crafted prompts.
By Xin Chen, Jie Zhang, Florian Tram\`er