PaperlayerView exact revision on arXiv

Source-linked AI summary

X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability

Xiaoya Lu, Dongrui Liu, Yi Yu, Luxin Xu, Jing Shao

arXiv:2502.09990v3cs.CRcs.AIcs.CLcs.CVcs.LG

TL;DR

Multi-turn jailbreak defense remains challenging, and existing defenses can trade robustness for usability because they do not precisely distinguish harmful from safe representations. X-Boundary pushes harmful representations away from boundary-safe ones; the paper reports improved defense with lower over-refusal and nearly preserved general capability.

  • Problem

    Existing defenses can improve jailbreak robustness while reducing general capability or over-refusing safe prompts, and they fail to precisely distinguish harmful from boundary-safe representations.

    Source: §1 · p. 1

  • Method

    X-Boundary explicitly formulates a distinction boundary by pushing harmful representations away from boundary-safe representations while keeping trained boundary-safe representations close to their originals.

    Source: §1 · p. 2

  • Results

    X-Boundary relatively reduces ASR across ten jailbreak attacks by over 70% and lowers ORR by approximately 20% compared with other defense methods, with almost no decline in general capability.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The explicit boundary enables harmful representations to be removed without disrupting safe ones, balancing jailbreak robustness and usability.

    Source: §5 · p. 8

    X-Boundary relies on representation-level intervention and is not applicable to black-box models; the authors also have not thoroughly investigated resolving the trade-off during pre-training.

    Source: Limitations · p. 9

Abstract

from arXiv · show

Despite the rapid development of safety alignment techniques for LLMs, defending against multi-turn jailbreaks is still a challenging task. In this paper, we conduct a comprehensive comparison, revealing that some existing defense methods can improve the robustness of LLMs against multi-turn jailbreaks but compromise usability, i.e., reducing general capabilities or causing the over-refusal problem. From the perspective of mechanism interpretability of LLMs, we discover that these methods fail to establish a boundary that exactly distinguishes safe and harmful feature representations. Therefore, boundary-safe representations close to harmful representations are inevitably disrupted, leading to a decline in usability. To address this issue, we propose X-Boundary to push harmful representations away from boundary-safe representations and obtain an exact distinction boundary. In this way, harmful representations can be precisely erased without disrupting safe ones. Experimental results show that X-Boundary achieves state-of-the-art defense performance against multi-turn jailbreaks, while reducing the over-refusal rate by about 20% and maintaining nearly complete general capability. Furthermore, we theoretically prove and empirically verify that X-Boundary can accelerate the convergence process during training. Please see our code at: https://github.com/AI45Lab/X-Boundary.

1 Introduction

The paper identifies a trade-off in jailbreak defense: methods that improve robustness can reduce general capability or over-refuse safe prompts. It attributes this to imprecise separation of harmful and boundary-safe representations and proposes X-Boundary to separate them.

1 Introduction

  • Defense methods can compromise usability through reduced general capability or over-refusal of safe prompts, including harmless questions containing sensitive terms.The paper gives a harmless question about meth as an example of a prompt rejected because it contains a sensitive term.Source: §1 · p. 1
  • The authors report that prior methods alleviating over-refusal weaken defense robustness, leaving the robustness–usability trade-off unresolved.Their comparison includes four widely used defense methods.Source: §1 · p. 1
  • Existing defenses fail to distinguish harmful from boundary-safe representations precisely, so nearby safe representations can be affected and their prompts rejected.Boundary-safe prompts are harmless but frequently rejected by LLMs.Source: §1 · pp. 1–2
  • X-Boundary relatively reduces ASR across ten jailbreak attacks by over 70%, lowers ORR by approximately 20% versus other defense methods, and nearly preserves general capability.The authors also report a 22% improvement in learning speed.Source: §1 · p. 2
  • On DeepSeek-R1 distilled reasoning models, X-Boundary outperforms other methods in defense effectiveness, keeps average ORR below 10%, and preserves 99% of reasoning ability.The authors report that existing methods either fail to establish effective defenses or severely impair reasoning capabilities.Source: §1 · p. 2

2 The Trade-Off Between Defense Robustness and LLM Usability

The section compares four defenses for single-turn and multi-turn jailbreaks alongside over-refusal and general capability. It reports that adding multi-turn training data worsens the robustness–usability trade-off, while over-refusal mitigation methods can weaken defense robustness.

2 The Trade-Off Between Defense Robustness and LLM Usability

  • The comparison adapts SFT, DPO, GA, and Circuit Breaking on Qwen2.5-7B-Instruct, using mixed single-turn and multi-turn defense data.Evaluation covers single-turn and multi-turn attack robustness, over-refusal, and general capability, measured by ASR, ORR, and accuracy.Source: §2 · pp. 2–3
  • SFT, DPO, and GA can compromise general capability, and all evaluated methods cause severe over-refusal; average ORR exceeds 50% after GA.SFT decreases coding ability by about 5%.Source: §2 · p. 3
  • After adding multi-turn defense data, average ORR rises by 25.65% with multi-turn GA, while coding-capability decline grows by 2.24% with multi-turn SFT.The figure’s points overall shift toward the upper right after multi-turn data are added.Source: §2 · p. 3, Figure 2 · p. 3
  • System Prompt, Self-CD, and Vector Ablation do not noticeably reduce ORR in defense-fine-tuned models and increase multi-turn ASR by 20%, 7.5%, and 22.5%, respectively.The passage reports that these methods substantially compromise defense robustness.Source: §2 · p. 3

3 X-Boundary: Optimize Exact Boundary to Balance Robustness and Usability

X-Boundary addresses the usability cost of imprecise harmful-versus-safe representation boundaries by explicitly separating harmful and boundary-safe representations. Its formulation combines representation losses, and its analysis links clustered features to faster learning.

3 X-Boundary: Optimize Exact Boundary to Balance Robustness and Usability

  • The section frames explicit boundary formulation as a way to mitigate the trade-off between defense robustness and LLM usability.It presents analysis of the existing boundary, the optimization objective, and convergence-rate analysis.Source: §3 · p. 3

3.1 The Imprecise Distinction Boundary of Existing Multi-Turn Defense Methods.

  • Existing defenses learn an imprecise boundary, mixing some boundary-safe representations with harmful ones and causing refusals of safe, helpful queries.Boundary-safe QA pairs are harmless prompts that are frequently rejected; their answers are both safe and helpful.Source: §3.1 · pp. 3–4

3.2 Explicit Formulation for Distinction Representation Boundary

  • X-Boundary explicitly pushes harmful representations away from boundary-safe ones so harmful representations can be erased without disrupting safe representations.The method constructs separate, erase, and retain sets for separating representations, erasing harmful knowledge, and preserving safe knowledge.Source: §3.2 · p. 4
  • The retain loss preserves safe representations by minimizing their ℓ2 distance from their original representations, while also retaining refusal responses to harmful queries.The overall objective is a weighted combination of retain, erase, and separate losses.Source: §3.2 · pp. 4–5

3.3 Theoretical Analysis of X-Boundary

  • The theoretical analysis uses Wasserstein k-variance to characterize feature-learning trends and shows that X-Boundary supports more clustered features and faster learning.The stated proposition assumes the feature distribution is (n, ∆)-clusterable.Source: §3.3 · p. 5
  • Under the stated loss thresholds, X-Boundary accelerates convergence by 26.47% on Llama-3-8B-Instruct and 18.29% on Qwen2.5-7B-Instruct.The theoretical analysis relates smaller feature-cluster radius to smaller k-variance and faster learning.Source: §3.3 · p. 5

4 Experiments

Across the experiments, X-Boundary balances jailbreak defense and usability, with results spanning standard models, larger models, and large reasoning models. The ablations show that multi-turn defense data and boundary-safe data affect attack success and over-refusal differently.

4.2 Main Results

  • Without explicit boundary formulation, boundary-safe representations close to harmful ones are misclassified; with X-Boundary, the two representation groups are clearly separated.The visualization supports the proposed explicit distinction boundary.Source: §4.2 · p. 6, Figure 6 · p. 7
  • X-Boundary relatively reduces single-turn and multi-turn ASR by more than 40% while keeping the increase in ORR on OKTest within 5% across three LLMs.On Llama-3-8B-Instruct, its average ORR is 20.05% lower than CB; on Qwen2.5-7B-Instruct, its average ORR is 58.50% lower than GA.Source: §4.2 · p. 6, Table 1 · p. 6
  • X-Boundary generally limits declines in general knowledge, math, and coding to no more than 0.5% versus vanilla models.For Mistral-7B-Instruct-v0.2, it achieves lower ASR than SFT without compromising coding capability, while SFT reduces coding ability by 7%.Source: Table 1 · p. 6, §4.2 · p. 7
  • 13.13% and 10.03% hypervolume increases on OKTest and PHTest, respectively, place X-Boundary at the lower-left of the ASR–ORR plot and advance the Pareto frontier.The figure samples and evaluates data points every 100 training steps.Source: §4.2 · p. 7, Figure 7 · p. 7

X-Boundary is effective across different sizes

  • On Qwen2.5-14B-Instruct, X-Boundary reduces ASR by more than 60%, keeps the ORR increase within 5% versus vanilla, and has approximately 40% lower ORR than CB at comparable ASR.Its performance is reported as stable relative to Qwen2.5-7B-Instruct.Source: X-Boundary is effective across… · p. 7

4.3 Performance on Large Reasoning Models

  • On DeepSeek-R1-distilled models, X-Boundary maintains average ORR below 10% and preserves 99% reasoning capability while achieving outstanding defense performance.CB and DPO reduce average ASR by only around 10% on Distilled-Qwen; SFT degrades reasoning capability by over 5% and substantially increases average ORR.Source: §4.3 · p. 7, Figure 8 · p. 8

4.4 Ablation Study

  • Adding multi-turn defense data reduces ActorAttack ASR from 63.00% to 15.50% on Qwen2.5-7B-Instruct but raises ORR on OR-Bench and PHTest by about 30.00%; boundary-safe data lowers ORR mainly on synthetic benchmarks.Its effect is limited on manually crafted XSTest and OKTest, which may differ in distribution from the synthetic training data.Source: §4.4 · p. 8
  • Increasing boundary-safe data can lower ORR but sharply increase jailbreak ASR, whereas separate loss further reduces ORR by an average of 9.75% on three benchmarks.Adding boundary-safe data alone has limited room to lower OR-Bench ORR because its QA pairs share that benchmark’s synthetic source.Source: §4.4 · p. 8

5 Conclusion

The paper concludes that X-Boundary explicitly separates harmful and safe representations to reduce the robustness–usability trade-off.

5 Conclusion

  • X-Boundary uses explicit loss functions to separate harmful from safe representations, enabling harmful representations to be removed without disrupting safe ones.The paper presents this as a way to balance jailbreak robustness and LLM usability.Source: §5 · p. 8

Limitations

The paper identifies two limitations: pre-training causes remain unexamined, and X-Boundary’s representation-level intervention is unavailable for black-box models.

  • The pre-training stage remains unexamined because the LLMs’ pre-training processes are closed-source, and representation-level intervention makes X-Boundary inapplicable to black-box models.The authors identify the latter as restricting use in some practical settings.Source: Limitations · p. 9

Ethical considerations

The paper situates X-Boundary amid work on jailbreaks, defenses, and usability, then reports its evaluation and ethical considerations. Its reasoning-model evaluation also notes shorter outputs as a possible concern.

Ethical considerations

  • The authors expect future work to strengthen content moderation and ethical usage protocols because training data containing harmful or offensive questions and answers could pose risks.They say they do not consider the method to directly cause severe negative societal consequences, while noting possible misuse by malicious actors.Source: Ethical considerations · p. 9

A Related Work

  • Prior work spans multi-turn attacks that decompose harmful queries or adapt them using model feedback, alongside defenses based on refusal training, safe-instruction prioritization, unlearning, prompts, guardrails, and representation engineering.The paper also reviews usability decline and over-refusal mitigation approaches, including contrastive decoding and false-refusal-vector ablation.Source: A Related Work · pp. 12–13

B The Optimization Process of X-Boundary

  • Algorithm 1’s stated inputs include a frozen reference model, an optimizable model, an input-representation function, erase, retain, and boundary datasets, and loss hyperparameters.The passage identifies the optimization process and its required inputs, but does not specify its steps.Source: B The Optimization Process of X-Boundary · p. 13

C.1 Evaluation of Existing Over-Refusal Mitigation Methods

  • On defense-fine-tuned models, system prompts, Self-Contrastive Decoding, and vector ablation reduce over-refusal less noticeably and substantially weaken defense effectiveness.Self-Contrastive Decoding and vector ablation rely on refusal vectors or tokens, which are ineffective for methods without fixed refusal templates, such as CB.Source: §C.1 · p. 13

C.2 Performance on Qwen2.5-14B-Instruct

  • X-Boundary achieves state-of-the-art defense and the lowest over-refusal rate on Qwen2.5-14B-Instruct.Table 5 compares existing defense methods and X-Boundary on that model.Source: §C.2 · p. 13, Table 5 · p. 14

C.3 Defense Performance Against Single-Turn Jailbreak Attacks

  • Across seven single-turn jailbreak attacks, X-Boundary effectively reduces attack success rates.The evaluated attacks include GCG, PAIR, PAP, AutoDAN, Obfuscation, Splitting, and Multilingual.Source: §C.3 · p. 14

C.4 The Effect of Defense Methods on the LLMs’ Reasoning Ability

  • X-Boundary does not degrade general capability on reasoning models, but its shorter output lengths may indirectly affect reasoning performance.The authors identify preventing output-length reduction as a direction for future research.Source: §C.4 · p. 14

C.5 The Trade-Off between Robustness and General Capability

X-Boundary is reported to balance multi-turn jailbreak robustness and general capability, with ablations and sensitivity analyses examining its losses, boundary-safe data, and representation effects.

C.5 The Trade-Off between Robustness and General Capability

  • X-Boundary occupies the lower-left region of the ASR-versus-capability plots, while training progress lowers ASR and increases coding and math capability decline.The figure samples models every 100 training steps.Source: §C.5 · p. 14, Figure 9 · p. 15

C.6 Ablation Studies on Three Loss Terms

  • The erase loss primarily reduces ASR, the retain loss preserves general capability and prevents substantial ORR increases, and the separate loss further preserves capability and reduces ORR.The authors report that all three loss terms contribute significantly to performance.Source: §C.6 · p. 15, Table 8 · p. 16

C.7 Sensitivity Analysis on Hyper-Parameters

  • X-Boundary is relatively insensitive to α; increasing β tends to lower ASR while raising ORR as erase and separate losses gain weight relative to retain loss.The tested α values were 5, 10, 15, and 20, and β values were 200, 250, 300, and 350.Source: §C.7 · p. 15, Figure 10 · p. 16

C.8 Ablation Studies on Three Models

  • Analyzing ablation experiments reported in Tables 9, 10, and 11 yields conclusions consistent with those in Section 4.4, according to the paper.Source: §C.8 · p. 16

C.9 Effects of the Size of Boundary-Safe Data

  • As boundary-safe data size increases, ORR generally decreases while multi-turn ASR tends to increase; without separate loss, 500 examples leave ASR hardly reduced.The authors conclude that changing boundary-safe data size alone makes balancing ASR and ORR difficult.Source: §C.9 · p. 16, Figure 11 · p. 17

C.10 Effects of Separate Loss and Boundary-Safe Data

  • Adding boundary-safe data to the retain set reduces the angle from original boundary-safe representations, and separate loss further reduces that angle while increasing separation from refusal representations.The authors interpret the increased separation as indicating a clearer distinction boundary.Source: §C.10 · p. 16

C.11 Details about Representation Visualization

  • The representation visualization extracts Llama-3-8B-Instruct features from layer 10 and displays them in two-dimensional t-SNE.Source: §C.11 · p. 16

D.1 Construction of Multi-Turn Defense Dataset

  • The multi-turn defense dataset SafeMTData contains harmful multi-turn queries and refusal responses; harmful responses are curated by attacking DeepSeek-Instruct and filtering with the HarmBench classifier.SFT uses SafeMTData directly, while DPO uses curated harmful responses as rejected data and refusal responses as chosen data; other methods incorporate the data into their defense or unlearning datasets.Source: §D.1 · pp. 16–17

D.2 Training Details of Baselines

The appendix describes baseline training configurations, X-Boundary’s training setup, and a comparison of computational resource consumption.

D.2 Training Details of Baselines

  • The four baselines are Multi-Turn SFT, Multi-Turn DPO, Gradient Ascent, and Circuit Breaker, with training configurations specified for the methods and models.The provided setup includes LoRA and optimizer details for SFT and DPO, data and loss settings for Gradient Ascent, and layer, rank, and loss-coefficient settings for Circuit Breaker.Source: §D.2 · pp. 17–18

D.3 Training Details of X-Boundary

  • X-Boundary uses LoRA, dynamically weighted losses, a grid-searched boundary-safe dataset size, and AdamW with a fixed learning rate of 1e-4.The selected boundary-safe data sizes are 500, 200, 100, and 50 for Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.2, Qwen2.5-7B-Instruct, and Qwen2.5-14B-Instruct, respectively.Source: §D.3 · p. 19

D.4 Comparison of Computational Resource Consumption

  • Table 12 compares computational resource consumption across algorithms using training time and VRAM usage tested on an A100 GPU.Source: §D.4 · p. 19

D.5 Evaluations

The evaluations cover multi-turn jailbreak robustness, over-refusal, and general capabilities using dedicated benchmarks and corresponding metrics.

  • Three multi-turn benchmarks cover role-playing induction (ActorAttack), iterative prompt refinement (RedQueen), and gradually escalating attacks (Crescendo).Source: §D.5 · pp. 19–20
  • Over-refusal evaluation uses XSTest boundary-case prompts, OKTest benign real-world questions, OR-Bench harmless queries, and PHTest suspicious-looking but safe prompts.Source: §D.5 · p. 20
  • General capability is assessed with MMLU, GSM8K, and HumanEval, covering domain knowledge, math reasoning, and code generation.Source: §D.5 · p. 20
  • Evaluation reports ASR for successful harmful elicitation, ORR for erroneous refusals on benign prompts, and standard-benchmark capability scores.Source: §D.5 · p. 20

E Theoretical Analysis of X-Boundary

The section defines clusterability through bounded-radius ball covers and frames its theoretical argument using prior propositions and triangle-inequality reasoning.

F Case Study

The case studies illustrate X-Boundary’s responses to boundary-safe queries, multi-turn jailbreaks, and dangerous content in reasoning models.

Loading 2502.09990v3…