文章背景与核心概要
随着大语言模型（LLM）越来越多地以本地化方式部署（例如通过 Ollama），且缺乏基于 API 服务中常见的集中式审核，安全重任完全转移到了本地防御机制上。本文对现有的输入侧越狱防御机制进行了严格的审计。作者认为，这些防御机制失效的根本原因在于其底层假设存在缺陷。通过提取各种防御策略（包括 SmoothLLM、擦除与检查（Erase-and-Check）、顺序监控器（Sequential Monitors）和困惑度过滤（Perplexity Filtering））的核心条件，研究人员推导出了失效的经验模式，并使用包含 13,800 条越狱评估记录的综合语料库，在六个开源权重模型（14B 至 35B 参数）上对其进行了验证。
Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks
arXiv: 2608.21895
Authors: Aaditya Pratap, Harsh Kasyap, Somanath Tripathy
Submitted: 22 August 2026
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks
arXiv: 2608.21895
Authors: Aaditya Pratap, Harsh Kasyap, Somanath Tripathy
Submitted: 22 August 2026
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Summary
As Large Language Models (LLMs) are increasingly deployed locally (e.g., via Ollama) without the centralized moderation found in API-based services, the burden of safety shifts entirely to local defense mechanisms. This paper presents a rigorous audit of existing input-side jailbreak defenses. The authors argue that the failure of these defenses is rooted in flawed underlying assumptions. By extracting the core conditions of various defense strategies—including SmoothLLM, Erase-and-Check, Sequential Monitors, and Perplexity Filtering—the researchers derive empirical patterns for failure and validate them against six open-weight models (14B to 35B parameters) using a comprehensive corpus of 13,800 jailbreak evaluation records.
Summary
As Large Language Models (LLMs) are increasingly deployed locally (e.g., via Ollama) without the centralized moderation found in API-based services, the burden of safety shifts entirely to local defense mechanisms. This paper presents a rigorous audit of existing input-side jailbreak defenses. The authors argue that the failure of these defenses is rooted in flawed underlying assumptions. By extracting the core conditions of various defense strategies—including SmoothLLM, Erase-and-Check, Sequential Monitors, and Perplexity Filtering—the researchers derive empirical patterns for failure and validate them against six open-weight models (14B to 35B parameters) using a comprehensive corpus of 13,800 jailbreak evaluation records.
Key Research Focus
The study evaluates the effectiveness of defense mechanisms by categorizing them into two primary types: * Formal Guarantee Defenses: Strategies such as SmoothLLM, Erase-and-Check, and Sequential Monitors that rely on mathematical or structural constraints. * Empirical Detection Defenses: Strategies such as Semantic Smoothing, Self-Denoised Smoothing, and Perplexity Filtering that rely on observed patterns.
Key Research Focus
The study evaluates the effectiveness of defense mechanisms by categorizing them into two primary types: * Formal Guarantee Defenses: Strategies such as SmoothLLM, Erase-and-Check, and Sequential Monitors that rely on mathematical or structural constraints. * Empirical Detection Defenses: Strategies such as Semantic Smoothing, Self-Denoised Smoothing, and Perplexity Filtering that rely on observed patterns.
Methodology
Instead of simply documenting that these defenses fail, the authors employ a systematic auditing framework: 1. Assumption Extraction: Identifying the specific condition or hypothesis upon which each defense is built. 2. Pattern Derivation: Determining the empirical signature that would manifest if that specific assumption were violated. 3. Large-Scale Testing: Utilizing a dataset of 100 diverse jailbreak prompts sourced from over 40 public repositories to test the robustness of these defenses across multiple model architectures.
Methodology
Instead of simply documenting that these defenses fail, the authors employ a systematic auditing framework: 1. Assumption Extraction: Identifying the specific condition or hypothesis upon which each defense is built. 2. Pattern Derivation: Determining the empirical signature that would manifest if that specific assumption were violated. 3. Large-Scale Testing: Utilizing a dataset of 100 diverse jailbreak prompts sourced from over 40 public repositories to test the robustness of these defenses across multiple model architectures.
Access the Paper
Access the Paper
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
License