{"id":"5b294edc-742f-462a-a835-df51b27ab3cd","arxiv_id":"2501.16497","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"RESTA defends LLMs against jailbreak attacks by adding random noise to user-prompt embeddings and aggregating token votes for the first 20 generated tokens.","lead":"The paper proposes RESTA, a defense that adds random noise to a language model's input embeddings and aggregates votes over noisy copies during generation, to block jailbreaking attacks. Tested on Vicuna and Llama-2, it reports better robustness-versus-utility tradeoffs than SmoothLLM, but only against a single baseline and with per-attack tuned parameters.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed superiority over SmoothLLM is not established by a controlled comparison: RESTA's noise type and sigma are selected per attack, while SmoothLLM is fixed at defaults, so the tradeoff advantage may be a selection artifact.","rationale":"I read the paper as a proof-of-concept that embedding-space smoothing with token aggregation can reduce attack success rate with less utility loss than SmoothLLM. The method is clearly specified in Algorithm 1, and the four perturbation schemes plus prefix smoothing are sensible. The ablation comparing embedding noise to character noise supports the claim that embedding perturbation matters. However, the central claim is comparative: it requires that the comparison be fair. Section 4.4's fixed-default SmoothLLM and per-attack RESTA configurations violate that condition in the most load-bearing way. This is a correctness risk, not a disagreement with consensus: the tested artifacts are real, but the evidence does not yet establish the claimed tradeoff advantage. The reader's identified prefix-smoothing assumption in Section 3.3 is also a real limitation and deserves a delayed-harmful-content test, but it mainly affects generalization beyond JailbreakBench-style attacks; the fairness of the baseline comparison directly affects the central claim as stated. I therefore keep the verdict conditional rather than rejecting, since the concern is testable and the method could survive it.","tokens_in":12194,"tokens_out":5072,"duration_ms":48779,"concrete_test":"Re-run the Section 4.4 comparison with one fixed RESTA configuration (e.g., hard directional noise, sigma=1.0) across all attack/model pairs, and trace SmoothLLM's ASR-versus-utility frontier by sweeping its character swap rate q in {2%, 5%, 10%, 20%} and k in {10, 20}, reporting standard errors over at least 3 seeds. If the SmoothLLM frontier dominates the fixed RESTA point, or if no single RESTA configuration beats SmoothLLM at matched utility, the superiority claim in the abstract fails. If RESTA's fixed configuration still Pareto-dominates the tuned baseline on all pairs, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Table 1 in Section 4.4 reports RESTA at different perturbation families and noise levels for each attack (GCG: hard sigma=1.0; PAIR: hard sigma=1.0; RS-Vicuna: soft sigma=1.5; RS-Llama: orthogonal sigma=0.05) but evaluates SmoothLLM only at its default 10 samples and 10% character swap. This is not a controlled comparison. Because RESTA is allowed to pick its best operating point per attack, while the baseline is not tuned, the headline 'superior robustness versus utility tradeoffs' may reflect cherry-picking rather than a property of the method. The Appendix tradeoff curves (Figures 2-6) show RESTA alone; no SmoothLLM frontier is drawn. A practitioner cannot choose the noise type based on knowing the attack in advance, so a single fixed RESTA configuration must be compared against a tuned SmoothLLM frontier. Additionally, the absence of error bars means the reported ASR and utility gaps are not shown to be statistically significant.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes RESTA (Randomized Embedding Smoothing and Token Aggregation), an inference-time defense for LLMs that adds random noise to the embedding vectors of the user-content portion of a prompt, generates k noisy copies of the response prefix in parallel, aggregates next-token predictions by majority vote for the first l output tokens, and then continues generation in the standard unperturbed manner. The method is evaluated on Vicuna-13B and Llama-2-7B against GCG, PAIR, and RS jailbreak attacks from JailbreakBench, with utility measured by AlpacaEval and IFEval. The central claim is that RESTA achieves superior robustness-versus-utility tradeoffs compared with the SmoothLLM baseline.","tokens_in":12543,"tokens_out":2317,"duration_ms":22096,"significance":"The core idea is timely and practically appealing: operating in the embedding domain, avoiding auxiliary LLMs, and smoothing only a prefix of the output are all cost-saving and conceptually interesting choices. If the empirical claims held under controlled comparison, the paper would be a useful contribution to the growing literature on inference-time jailbreak defenses. However, as presented, the experimental evidence does not yet establish the headline claim of superior tradeoffs, because RESTA's hyperparameters are selected per attack while the baseline is evaluated at fixed defaults, and because no uncertainty quantification is reported. The prefix-smoothing assumption, while plausible, is also not directly validated.","major_comments":[{"comment":"The comparison between RESTA and SmoothLLM is not controlled. RESTA is allowed a different noise type and noise level for each attack (GCG: hard, sigma=1.0; PAIR: hard, sigma=1.0; RS-Vicuna: soft, sigma=1.5; RS-Llama: orthogonal, sigma=0.05), while SmoothLLM is evaluated only at its default configuration of 10 samples and 10% character swapping. The reported advantage in robustness-versus-utility tradeoff may therefore be an artifact of per-attack hyperparameter selection rather than an intrinsic property of the method. The authors should either compare a single fixed RESTA configuration against a tuned SmoothLLM frontier, or report the selection procedure (e.g., validation-based selection) and show that the conclusion is robust to the choice of operating point.","section":"Section 4.4, Table 1"},{"comment":"The tradeoff curves in the main text and appendix show RESTA alone; no SmoothLLM frontier is drawn on the same axes. Since a practitioner cannot know the attack family in advance, the relevant comparison is whether a single RESTA configuration dominates a SmoothLLM operating point across all attacks, or whether RESTA's advantage requires knowing the attack. Without the baseline frontier, the claimed 'superior robustness versus utility tradeoffs' is not directly supported by the figures.","section":"Figures 2-6 and Appendix Figures 13-17"},{"comment":"No error bars, confidence intervals, or repeated-trial statistics are reported for any of the ASR or utility numbers. Given the modest absolute differences in some comparisons (e.g., GCG ASR of 2% versus 9% for two RESTA settings, or AlpacaEval scores in the 50-58 range), the reader cannot determine whether the reported gaps are statistically meaningful. The authors should report variance over multiple runs or at least provide confidence intervals derived from the benchmark samples.","section":"Section 4.4, Table 1 and Figures 2-6"},{"comment":"The response prefix smoothing design rests on the assumption that autoregressive generation continues along the theme established by the first l=20 tokens. This is load-bearing because the efficiency gain and several robustness results depend on the prefix determining the response sentiment. The paper provides anecdotal motivation but no direct evidence. If an attack can induce harmful content after the twentieth token without a telltale acceptance prefix, RESTA's prefix-smoothing defense would not block it. The authors should test this by measuring where harmful content begins in successful attacks under RESTA, or by comparing l=20 against larger prefix lengths to show that longer smoothing does not materially improve robustness.","section":"Section 3.3"}],"minor_comments":[{"comment":"The line 'Append token to output: y ← (y, y)' appears to contain a typo; it should likely be 'y ← (y, y_t)' or similar, since the left-hand side and right-hand side use the same variable name ambiguously.","section":"Algorithm 1"},{"comment":"The label 'Char-Peturb' is misspelled; it should be 'Char-Perturb'.","section":"Table 1"},{"comment":"The character-perturbation ablation is described as picking a 'fairly competitive operating point' but the selection criterion is not specified. Clarifying how the reported operating points were chosen would strengthen the ablation.","section":"Section 4.3"},{"comment":"The appendix links to public datasets and models but does not provide a link to the authors' own code or evaluation scripts. Releasing the implementation would improve reproducibility.","section":"Appendix A.1"}],"recommendation":"major_revision","confidential_remarks":"The paper is short and reads like a workshop-style submission. The core idea is plausible, but the evaluation as written does not support the headline claim because of the asymmetric hyperparameter tuning between RESTA and SmoothLLM and the absence of uncertainty quantification. I would encourage the editor to invite a revision with a controlled comparison, a fixed or principled hyperparameter selection procedure, and some validation of the prefix-smoothing assumption. The scope is appropriate for the venue, but the empirical case needs to be made more carefully."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you follow LLM jailbreak defenses. The core idea is genuinely new: instead of perturbing characters like SmoothLLM, RESTA adds noise to embedding vectors, runs k noisy forward passes, and aggregates by majority vote at the token level. The four noise schemes (isotropic, hard/soft directional, orthogonal) and the prefix-smoothing trick that limits the expensive defense to the first l output tokens are useful and clearly explained. The character-perturbation ablation is a good control, and it supports the claim that embedding-space smoothing is what does the work. No auxiliary model needed, which is a practical plus. The writing is straightforward and the benchmark setup is standard.\n\nThe main weakness is exactly what the stress-test note flags. Table 1 lets RESTA pick its best noise type and sigma separately for each attack (hard sigma=1.0 for GCG, soft sigma=1.5 for RS, orthogonal sigma=0.05 for RS-Llama), while SmoothLLM is evaluated only at its default 10% character swap and 10 samples. That is not a controlled tradeoff comparison. The abstract's \"superior robustness versus utility tradeoffs\" claim needs a SmoothLLM frontier (its ASR-utility curve across perturbation rates), or at least a single fixed RESTA configuration evaluated across all attacks. The appendix tradeoff curves show only RESTA, so the reader cannot tell how much of the advantage is method versus hyperparameter selection. I also note the absence of error bars: ASR gaps of a few points may be noise, and the ASR judge is an LLM with its own variance. The prefix-smoothing assumption in Section 3.3 is stated clearly but untested against an adaptive attack that delays harmful content beyond token 20; that could be a real limitation, though it does not invalidate the current results. Minor: no RESTA code is released, only links to the external baselines.\n\nThat said, the margins over SmoothLLM are large on utility (often 20+ AlpacaEval points), so the qualitative conclusion may survive a proper tuning sweep. The flaws are fixable in revision, not fatal. This is a solid proof-of-concept, appropriate for a workshop or a short paper. I would engage with it, ask for the controlled comparison, and not cite the abstract claim as established.","headline":"Novel embedding-space smoothing defense with a real idea, but the headline comparison to SmoothLLM is under-supported because RESTA is tuned per attack while SmoothLLM is fixed at defaults.","tokens_in":12919,"tokens_out":2556,"would_cite":true,"duration_ms":34419,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RESTA adds random noise to token embeddings and aggregates majority votes over the first 20 response tokens, claiming to block GCG, PAIR, and RS jailbreaks while keeping higher utility than SmoothLLM.","keywords":["RESTA","jailbreak defense","randomized smoothing","embedding perturbation","token aggregation","prefix smoothing","adversarial robustness","large language models"],"falsifier":"Run an adaptive jailbreak that optimizes a suffix so that the model's response starts with twenty benign tokens (e.g., a neutral acknowledgment) and only afterwards produces the harmful content; if such a response achieves high attack success under RESTA with $l=20$ but near-zero success when the smoothing window covers the entire output, the prefix-smoothing premise is refuted.","tokens_in":12032,"feed_emoji":"🛡️","tokens_out":7532,"duration_ms":56590,"temperature":0.7,"pith_summary":"This paper proposes a defense against jailbreaking attacks on large language models, called Randomized Embedding Smoothing and Token Aggregation (RESTA). The idea is to add random noise to the embedding vectors of the user prompt, generate the first few output tokens by majority vote over several noisy copies of the model, and then finish generation normally. The paper claims that this preserves the prompt's meaning better than character-level smoothing, so RESTA reduces attack success rates against GCG, PAIR, and random-search jailbreaks while retaining higher AlpacaEval and IFEval scores than SmoothLLM. The paper argues this gives a practical, compute-light way to harden chat models without auxiliary LLMs.","feed_headline":"Embedding noise cuts jailbreak success to 2% while keeping utility","feed_subtitle":"Smoothing only the first 20 tokens preserves quality while blocking GCG, PAIR, and random-search jailbreaks.","key_machinery":"The load-bearing mechanism is embedding-space randomized smoothing with token-level aggregation. Given a prompt, RESTA creates $k=10$ independently noised copies of the user-content embedding sequence using one of four perturbation schemes (isotropic Gaussian, hard directional, soft directional, or orthogonal noise), runs the decoder once per copy, and picks the next output token by majority vote. This is repeated for the first $l=20$ tokens, producing a 'smoothed prefix,' after which a single greedy decode continues from the unperturbed embeddings. The mechanism works by disrupting the adversarial signal in the prompt while preserving the semantic direction of the user content, so that the model's first decision — comply or refuse — is made on a robustified input.","core_discovery":"RESTA's central claim is that smoothing in embedding space rather than token space yields a better robustness-versus-utility tradeoff than the SmoothLLM baseline. On the GCG attack against Vicuna-13B, RESTA with hard directional noise at $\\sigma = 1.0$ lowers attack success rate from 94% (undefended) to 2% while keeping AlpacaEval at 50.3% and IFEval at 27.5%; SmoothLLM reaches 7% ASR but drops AlpacaEval to 27.8% and IFEval to 24%. The method also drives PAIR ASR from 84.1% to 30.4% and RS ASR from 96% to 44% on Vicuna, and RS ASR on Llama-2-7B from 69% to 0% with minimal utility loss. The noise is applied only to the user-content portion of the input, and only the first $l=20$ output tokens are smoothed, after which generation continues greedily on unperturbed embeddings.","pith_inferences":["A natural next test the paper does not run is an adaptive attack that injects Gaussian noise-aware or expectation-over-noise optimization into the suffix search; if such an attack reduces RESTA's advantage, the robustness may rely on the attacker treating the defense as a black box.","The embedding-domain smoothing idea should transfer to instruction-tuned models with continuous prompt embeddings, and possibly to vision-language models where a shared embedding space exists; the token-aggregation step would need modification for non-token outputs.","The paper's utility metrics are instruction-following and chat-quality scores; the same defense on code-generation or reasoning tasks could behave differently because those tasks depend on long-range consistency that prefix smoothing does not protect."],"forward_implications":["RESTA can be wrapped around any existing autoregressive LLM without retraining, auxiliary models, or prompt rewriting, so it can be deployed as a drop-in inference-time filter.","Because smoothing runs only on the first $l=20$ tokens, the added compute is roughly $k$ forward passes for the prefix instead of the whole response, making the defense practical for long generations.","The per-attack differences in preferred noise type suggest that the defense can be tuned by choosing a perturbation scheme, with hard directional noise strong against PAIR and soft directional noise strong against RS.","RESTA can be combined with input-output guard models: since it does not depend on a secondary model, its protection does not add a second attack surface."],"supporting_citations":[{"why":"Supplies the SmoothLLM baseline whose robustness-utility tradeoff RESTA claims to beat.","marker":"Robey et al., 2023"},{"why":"Provides the JailbreakBench attack prompt artifacts and the automatic ASR evaluation methodology used for all attack settings.","marker":"Chao et al., 2024"},{"why":"Source of the GCG attack artifacts and of the observation that jailbreak optimization targets an acceptance prefix.","marker":"Zou et al., 2023"},{"why":"Source of the PAIR attack prompts used in the experiments.","marker":"Chao et al., 2023"},{"why":"Source of the random-search (RS) attack framework and its attack templates.","marker":"Andriushchenko et al., 2024"},{"why":"Establishes the randomized smoothing idea that RESTA adapts to embeddings and autoregressive generation.","marker":"Cohen et al., 2019"},{"why":"Provides the AlpacaEval benchmark and the length-controlled win-rate metric used to measure utility.","marker":"Dubois et al., 2024"},{"why":"Provides the IFEval benchmark and prompt-level loose accuracy metric used to measure instruction following.","marker":"Zhou et al., 2023"}],"fun_headline_variants":["RESTA: embedding noise cuts jailbreak success to 2% while preserving utility","Embedding smoothing beats token smoothing for LLM robustness","Random noise in embeddings: jailbreak ASR drops from 94% to 2%","RESTA defense: robust against GCG, PAIR, RS with low utility cost","Smoothing embeddings, not tokens, offers better LLM security tradeoff"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes a jailbreak must show its intent within the first 20 response tokens; a harmful response that begins with harmless-sounding tokens and transitions to harmful content only after the smoothed prefix would bypass the defense.","fun_headline_variants_meta":{"raw":{"variants":["RESTA: embedding noise cuts jailbreak success to 2% while preserving utility","Embedding smoothing beats token smoothing for LLM robustness","Random noise in embeddings: jailbreak ASR drops from 94% to 2%","RESTA defense: robust against GCG, PAIR, RS with low utility cost","Smoothing embeddings, not tokens, offers better LLM security tradeoff"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000889,"raw_usage":{"total_tokens":3797,"prompt_tokens":866,"completion_tokens":2931,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":482,"completion_tokens_details":{"reasoning_tokens":2837}},"tokens_in":482,"tokens_out":2931,"duration_ms":19757,"temperature":1.0,"reasoning_tokens":2837,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T12:49:24.259057+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an adaptive jailbreak that optimizes a suffix so that the model's response starts with twenty benign tokens (e.g., a neutral acknowledgment) and only afterwards produces the harmful content; if such a response achieves high attack success under RESTA with $l=20$ but near-zero success when the smoothing window covers the entire output, the prefix-smoothing premise is refuted.","supporting_citations":[{"cited_title":"The results summarized in Table 2 show that 13 Figure 10: Process to get a response with a smoothed response prefix","cited_arxiv_id":null,"evidence_quote":"Provides the JailbreakBench attack prompt artifacts and the automatic ASR evaluation methodology used for all attack settings."}],"review_version":1}