Pith. sign in

REVIEW 9 cited by

SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.08983 v4 pith:MBBCYRW6 submitted 2024-02-14 cs.CR cs.AIcs.CL

Zhangchen Xu , Fengqing Jiang , Luyao Niu , Jinyuan Jia , Bill Yuchen Lin , Radha Poovendran This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords attacksjailbreakllmssafedecodingsafetyprobabilitiesresponsestokens
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

As large language models (LLMs) become increasingly integrated into real-world applications such as code generation and chatbot assistance, extensive efforts have been made to align LLM behavior with human values, including safety. Jailbreak attacks, aiming to provoke unintended and unsafe behaviors from LLMs, remain a significant/leading LLM safety threat. In this paper, we aim to defend LLMs against jailbreak attacks by introducing SafeDecoding, a safety-aware decoding strategy for LLMs to generate helpful and harmless responses to user queries. Our insight in developing SafeDecoding is based on the observation that, even though probabilities of tokens representing harmful contents outweigh those representing harmless responses, safety disclaimers still appear among the top tokens after sorting tokens by probability in descending order. This allows us to mitigate jailbreak attacks by identifying safety disclaimers and amplifying their token probabilities, while simultaneously attenuating the probabilities of token sequences that are aligned with the objectives of jailbreak attacks. We perform extensive experiments on five LLMs using six state-of-the-art jailbreak attacks and four benchmark datasets. Our results show that SafeDecoding significantly reduces the attack success rate and harmfulness of jailbreak attacks without compromising the helpfulness of responses to benign user queries. SafeDecoding outperforms six defense methods.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PUZZLED: Jailbreaking LLMs through Word-Based Puzzles

    cs.AI 2025-08 unverdicted novelty 6.0 of 10

    PUZZLED masks harmful keywords as word-search, anagram, or crossword puzzles and achieves a reported 88.8% average attack success rate across five leading LLMs.

  2. Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Fine-tuning a single transformer layer with activation targets scaled by each query's projection onto a refusal direction reduces over-refusal on four benchmarks while preserving safety and general capability.

  3. GloSS over Toxicity: Understanding and Mitigating Toxicity in LLMs via Global Toxic Subspace

    cs.CL 2025-05 conditional novelty 6.0 of 10

    Detoxifying LLMs by deleting a global, cross-layer 'toxic subspace' from feed-forward weights reduces toxic outputs more than layer-local subspace methods.

  4. The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions

    cs.CL 2025-02 conditional novelty 6.0 of 10

    Safety refusal in Llama 3.1 8B is governed by a dominant activation direction plus smaller interpretable directions, and removing prompt tokens that activate these secondary directions can bypass fine-tuned safety.

  5. JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation

    cs.CR 2025-02 conditional novelty 6.0 of 10

    JBShield detects jailbreaks by checking whether a prompt activates both a toxic concept and a jailbreak concept inside an LLM, then steers those concepts to produce a safe refusal.

  6. MoGU V2: Toward a Higher Pareto Frontier Between Model Usability and Security

    cs.CL 2025-09 conditional novelty 5.0 of 10

    MoGUv2 embeds small routers in the deeper layers of LLMs to dynamically blend a helpful variant and a refusal variant, improving safety against jailbreak and fine-tuning attacks while preserving usability.

  7. Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning

    cs.AI 2025-08 unverdicted novelty 5.0 of 10

    A jailbreak defense that reasons about hidden manipulations in attack prompts, trained with supervised fine-tuning plus entropy-guided reinforcement learning, generalizes to attacks never seen in training.

  8. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

  9. A Survey on Training-free Alignment of Large Language Models

    cs.CL 2025-08 conditional novelty 4.0 of 10

    A survey that catalogs and categorizes training-free LLM alignment methods into pre-decoding, in-decoding, and post-decoding, with a limited experimental comparison on one model.

Pith tools