REVIEW 4 major objections 4 minor 1 cited by
Smoothed Embeddings for Robust Language Models
T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read RESTA adds random noise to token embeddings and aggregates majority votes over the first 20 response tokens, claiming to block GCG, PAIR, and RS jailbreaks while keeping higher utility than SmoothLLM.
desk verdict Novel embedding-space smoothing defense with a real idea, but the headline comparison to SmoothLLM is under-supported because RESTA is tuned per attack while SmoothLLM is fixed at defaults. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is embedding-space randomized smoothing with token-level aggregation. Given a prompt, RESTA creates $k=10$ independently noised copies of the user-content embedding sequence using one of four perturbation schemes (isotropic Gaussian, hard directional, soft directional, or orthogonal noise), runs the decoder once per copy, and picks the next output token by majority vote. This is repeated for the first $l=20$ tokens, producing a 'smoothed prefix,' after which a single greedy decode continues from the unperturbed embeddings. The mechanism works by disrupting the adversarial signal in the prompt while preserving the semantic direction of the user content, so that the model's first decision — comply or refuse — is made on a robustified input.
What would settle it
Run an adaptive jailbreak that optimizes a suffix so that the model's response starts with twenty benign tokens (e.g., a neutral acknowledgment) and only afterwards produces the harmful content; if such a response achieves high attack success under RESTA with $l=20$ but near-zero success when the smoothing window covers the entire output, the prefix-smoothing premise is refuted.
Extended reading notes
Core claim
RESTA's central claim is that smoothing in embedding space rather than token space yields a better robustness-versus-utility tradeoff than the SmoothLLM baseline. On the GCG attack against Vicuna-13B, RESTA with hard directional noise at $\sigma = 1.0$ lowers attack success rate from 94% (undefended) to 2% while keeping AlpacaEval at 50.3% and IFEval at 27.5%; SmoothLLM reaches 7% ASR but drops AlpacaEval to 27.8% and IFEval to 24%. The method also drives PAIR ASR from 84.1% to 30.4% and RS ASR from 96% to 44% on Vicuna, and RS ASR on Llama-2-7B from 69% to 0% with minimal utility loss. The noise is applied only to the user-content portion of the input, and only the first $l=20$ output tokens are smoothed, after which generation continues greedily on unperturbed embeddings.
Load-bearing premise
The defense assumes a jailbreak must show its intent within the first 20 response tokens; a harmful response that begins with harmless-sounding tokens and transitions to harmful content only after the smoothed prefix would bypass the defense.
Editorial extensions
If this is right
- RESTA can be wrapped around any existing autoregressive LLM without retraining, auxiliary models, or prompt rewriting, so it can be deployed as a drop-in inference-time filter.
- Because smoothing runs only on the first $l=20$ tokens, the added compute is roughly $k$ forward passes for the prefix instead of the whole response, making the defense practical for long generations.
- The per-attack differences in preferred noise type suggest that the defense can be tuned by choosing a perturbation scheme, with hard directional noise strong against PAIR and soft directional noise strong against RS.
- RESTA can be combined with input-output guard models: since it does not depend on a secondary model, its protection does not add a second attack surface.
Reading between the lines
- A natural next test the paper does not run is an adaptive attack that injects Gaussian noise-aware or expectation-over-noise optimization into the suffix search; if such an attack reduces RESTA's advantage, the robustness may rely on the attacker treating the defense as a black box.
- The embedding-domain smoothing idea should transfer to instruction-tuned models with continuous prompt embeddings, and possibly to vision-language models where a shared embedding space exists; the token-aggregation step would need modification for non-token outputs.
- The paper's utility metrics are instruction-following and chat-quality scores; the same defense on code-generation or reasoning tasks could behave differently because those tasks depend on long-range consistency that prefix smoothing does not protect.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes RESTA (Randomized Embedding Smoothing and Token Aggregation), an inference-time defense for LLMs that adds random noise to the embedding vectors of the user-content portion of a prompt, generates k noisy copies of the response prefix in parallel, aggregates next-token predictions by majority vote for the first l output tokens, and then continues generation in the standard unperturbed manner. The method is evaluated on Vicuna-13B and Llama-2-7B against GCG, PAIR, and RS jailbreak attacks from JailbreakBench, with utility measured by AlpacaEval and IFEval. The central claim is that RESTA achieves superior robustness-versus-utility tradeoffs compared with the SmoothLLM baseline.
Significance. The core idea is timely and practically appealing: operating in the embedding domain, avoiding auxiliary LLMs, and smoothing only a prefix of the output are all cost-saving and conceptually interesting choices. If the empirical claims held under controlled comparison, the paper would be a useful contribution to the growing literature on inference-time jailbreak defenses. However, as presented, the experimental evidence does not yet establish the headline claim of superior tradeoffs, because RESTA's hyperparameters are selected per attack while the baseline is evaluated at fixed defaults, and because no uncertainty quantification is reported. The prefix-smoothing assumption, while plausible, is also not directly validated.
major comments (4)
- [Section 4.4, Table 1] The comparison between RESTA and SmoothLLM is not controlled. RESTA is allowed a different noise type and noise level for each attack (GCG: hard, sigma=1.0; PAIR: hard, sigma=1.0; RS-Vicuna: soft, sigma=1.5; RS-Llama: orthogonal, sigma=0.05), while SmoothLLM is evaluated only at its default configuration of 10 samples and 10% character swapping. The reported advantage in robustness-versus-utility tradeoff may therefore be an artifact of per-attack hyperparameter selection rather than an intrinsic property of the method. The authors should either compare a single fixed RESTA configuration against a tuned SmoothLLM frontier, or report the selection procedure (e.g., validation-based selection) and show that the conclusion is robust to the choice of operating point.
- [Figures 2-6 and Appendix Figures 13-17] The tradeoff curves in the main text and appendix show RESTA alone; no SmoothLLM frontier is drawn on the same axes. Since a practitioner cannot know the attack family in advance, the relevant comparison is whether a single RESTA configuration dominates a SmoothLLM operating point across all attacks, or whether RESTA's advantage requires knowing the attack. Without the baseline frontier, the claimed 'superior robustness versus utility tradeoffs' is not directly supported by the figures.
- [Section 4.4, Table 1 and Figures 2-6] No error bars, confidence intervals, or repeated-trial statistics are reported for any of the ASR or utility numbers. Given the modest absolute differences in some comparisons (e.g., GCG ASR of 2% versus 9% for two RESTA settings, or AlpacaEval scores in the 50-58 range), the reader cannot determine whether the reported gaps are statistically meaningful. The authors should report variance over multiple runs or at least provide confidence intervals derived from the benchmark samples.
- [Section 3.3] The response prefix smoothing design rests on the assumption that autoregressive generation continues along the theme established by the first l=20 tokens. This is load-bearing because the efficiency gain and several robustness results depend on the prefix determining the response sentiment. The paper provides anecdotal motivation but no direct evidence. If an attack can induce harmful content after the twentieth token without a telltale acceptance prefix, RESTA's prefix-smoothing defense would not block it. The authors should test this by measuring where harmful content begins in successful attacks under RESTA, or by comparing l=20 against larger prefix lengths to show that longer smoothing does not materially improve robustness.
minor comments (4)
- [Algorithm 1] The line 'Append token to output: y ← (y, y)' appears to contain a typo; it should likely be 'y ← (y, y_t)' or similar, since the left-hand side and right-hand side use the same variable name ambiguously.
- [Table 1] The label 'Char-Peturb' is misspelled; it should be 'Char-Perturb'.
- [Section 4.3] The character-perturbation ablation is described as picking a 'fairly competitive operating point' but the selection criterion is not specified. Clarifying how the reported operating points were chosen would strengthen the ablation.
- [Appendix A.1] The appendix links to public datasets and models but does not provide a link to the authors' own code or evaluation scripts. Releasing the implementation would improve reproducibility.
Circularity Check
No significant circularity: the paper reports direct benchmark measurements and makes no fitted-parameter or self-citation-based derivation.
full rationale
The paper makes no formal derivation whose conclusion is equivalent to its assumptions. Its central quantitative content consists of measured Attack Success Rates and utility scores from standard benchmarks (JailbreakBench, AlpacaEval, IFEval), obtained by running the proposed RESTA defense and the SmoothLLM baseline. No parameter is fit to a subset of the reported outcomes and then used to 'predict' a closely related outcome; the sigma and noise-type choices are experimental operating points, not fitted parameters renamed as predictions. The prefix-smoothing rationale in Section 3.3 is an empirical observation about autoregressive continuation, cited from the GCG attack design, and is not circular with the robustness results. There is no load-bearing self-citation chain: the defense is defined in Algorithm 1 without relying on any prior result by the same authors, and the references to prior randomized smoothing defenses are motivational rather than constitutive. The comparison to SmoothLLM is not perfectly controlled because RESTA's noise type and sigma are selected per attack while SmoothLLM uses defaults, and the appendix tradeoff curves do not show a SmoothLLM frontier; however, this is a concern about experimental validity and fairness of comparison, not about circularity. Likewise, the absence of error bars weakens statistical claims but does not make any reported quantity definitionally equal to an input. Accordingly, no circular step can be exhibited with quoted text, so the appropriate finding is no significant circularity.
Assumptions & free parameters
free parameters (4)
- sigma (noise level) =
Per attack: 0.8/1.0 (GCG), 0.4/1.0 (PAIR), 1.5 (RS Vicuna), 0.05 (RS Llama)
- smoothing samples k =
10
- prefix length l =
20
- noise type =
Hard (GCG/PAIR), soft (RS Vicuna), orthogonal (RS Llama)
assumptions (4)
- domain assumption The sentiment or theme of an autoregressive response is established by the first few tokens, so smoothing only the prefix suffices.
- domain assumption Embedding noise preserves semantic information better than character-level perturbations.
- domain assumption The Llama-3-70B-based judge correctly identifies jailbroken responses.
- domain assumption AlpacaEval and IFEval are valid proxies for model utility.
Cite this review
Pith. "Pith review of Smoothed Embeddings for Robust Language Models." pith.science (2026). https://pith.science/paper/QPUQBPMV
@misc{pith2026250116497,
author = {Pith},
title = {Pith review of: Smoothed Embeddings for Robust Language Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/QPUQBPMV}},
note = {Machine review of arXiv:2501.16497}
}
read the original abstract
Improving the safety and reliability of large language models (LLMs) is a crucial aspect of realizing trustworthy AI systems. Although alignment methods aim to suppress harmful content generation, LLMs are often still vulnerable to jailbreaking attacks that employ adversarial inputs that subvert alignment and induce harmful outputs. We propose the Randomized Embedding Smoothing and Token Aggregation (RESTA) defense, which adds random noise to the embedding vectors and performs aggregation during the generation of each output token, with the aim of better preserving semantic information. Our experiments demonstrate that our approach achieves superior robustness versus utility tradeoffs compared to the baseline defenses.
Figures
Figures from the paper (15 more)
Forward citations
Cited by 1 Pith paper
-
Embedding Poisoning: Bypassing Safety Alignment via Embedding Semantic Shift
Small single-dimension perturbations to embeddings of high-risk tokens can flip aligned LLM responses from refusal to harmful output, and a search algorithm (SEP) locates such perturbations across models.
Reference graph
Works this paper leans on
-
[3]
Jailbreaking black box large language models in twenty queries
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419,
-
[4]
JailbreakBench: An open robustness benchmark for jailbreaking large language models
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. JailbreakBench: An open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318,
-
[7]
Llama guard: Llm-based input-output safeguard for human-ai conversations
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674,
-
[8]
Baseline defenses for adversarial attacks against aligned language models
Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614,
-
[9]
Defending large language models against jailbreak attacks via semantic smoothing
Jiabao Ji, Bairu Hou, Alexander Robey, George J Pappas, Hamed Hassani, Yang Zhang, Eric Wong, and Shiyu Chang. Defending large language models against jailbreak attacks via semantic smoothing. arXiv preprint arXiv:2402.16192,
-
[10]
Certifying LLM safety against adversarial prompting
Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Soheil Feizi, and Hima Lakkaraju. Certifying LLM safety against adversarial prompting. arXiv preprint arXiv:2309.02705,
-
[11]
Certified robustness to adversarial examples with differential privacy
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 656–672. IEEE,
2019
-
[12]
URL https://arxiv.org/abs/ 2407.21783. Mantas Mazeika, Andy Zou, Norman Mu, Long Phan, Zifan Wang, Chunru Yu, Adam Khoja, Fengqing Jiang, Aidan O’Gara, Ellie Sakhaee, Zhen Xiang, Arezoo Rajabi, Dan Hendrycks, Radha Poovendran, Bo Li, and David Forsyth. TDC 2023 (LLM edition): The Trojan detection challenge. In NeurIPS Competition Track,
arXiv 2023
Show all 21 references
-
[13]
HarmBench: A standardized evaluation framework for automated red teaming and robust refusal
9 Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. HarmBench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249,
-
[16]
Rigor- LLM: Resilient guardrails for large language models against undesired content
Zhuowen Yuan, Zidi Xiong, Yi Zeng, Ning Yu, Ruoxi Jia, Dawn Song, and Bo Li. Rigor- LLM: Resilient guardrails for large language models against undesired content. arXiv preprint arXiv:2403.13031,
-
[17]
Certified robustness for large language models with self-denoising
Zhen Zhang, Guanhua Zhang, Bairu Hou, Wenqi Fan, Qing Li, Sijia Liu, Yang Zhang, and Shiyu Chang. Certified robustness for large language models with self-denoising. arXiv preprint arXiv:2307.07171,
-
[18]
Instruction-following evaluation for large language models
Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. Instruction-following evaluation for large language models. arXiv preprint arXiv:2311.07911,
-
[19]
Universal and transferable adversarial attacks on aligned language models
Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043,
-
[20]
[USER-CONTENT]
10 A Appendix / supplemental material A.1 Links to public code, models, and datasets used by our work We make use of the following publicly available code, models, and datasets in our work: • SmoothLLM (Robey et al., 2023): https://github.com/arobey1/smooth-llm • Vicuna-13B-v1...
2023
-
[21]
The results summarized in Table 2 show that 13 Figure 10: Process to get a response with a smoothed response prefix
for detecting jailbreaks in the original attack prompt and victim response artifacts given by JailbreakBench (Chao et al., 2024). The results summarized in Table 2 show that 13 Figure 10: Process to get a response with a smoothed response prefix. Figure 11: AlpacaEval evaluati...
2024
-
[2014]
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al
URL http://arxiv.org/abs/1312.6199. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288,
-
[2015]
org/abs/1412.6572
URL http://arxiv. org/abs/1412.6572. Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, and Milad Nasr. Query-based adversarial prompt generation. arXiv preprint arXiv:2402.12329,
-
[2019]
Length-controlled AlpacaEval: A simple way to debias automatic evaluators
Yann Dubois, Balázs Galambosi, Percy Liang, and Tatsunori B Hashimoto. Length-controlled AlpacaEval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404.04475,
-
[2022]
SmoothLLM: Defending large language models against jailbreaking attacks
Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. SmoothLLM: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684,
-
[2023]
Jailbreaking leading safety- aligned llms with simple adaptive attacks
Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety- aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151,
-
[2024]
Gabriel Alon and Michael Kamfonas
https://github.com/meta-llama/llama3/blob/ main/MODEL_CARD.md. Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132,
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.