Source-linked AI summary
Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection
Lixing Lin, Juli You, Yue Li, Luyun Lin, Yiqing Wang, Zhen Zhang, Moxuan Zheng
TL;DR
Safety classifiers often miss harmful prompts disguised by adversarial framing. Reflect-Guard distills GPT-4o-mini’s structured reasoning into QLoRA-fine-tuned Llama-Guard-3-8B, which reflects before classifying. It improves adversarial detection across WildGuardTest and JailbreakBench, while its reported evidence includes single-run and teacher-bias limitations.
Problem
Safety classifiers perform well on straightforward harmful prompts but remain vulnerable to jailbreaks that disguise malicious intent through adversarial framing.
Method
Reflect-Guard distills GPT-4o-mini’s structured reflections and fine-tunes Llama-Guard-3-8B with QLoRA to generate analysis before safety verdicts.
Results
+40.8 pp adversarial recall and 82.5% relative attack-success-rate reduction are reported across WildGuardTest and JailbreakBench.
Takeaways & Limitations
The results support teaching safety classifiers to reason about adversarial intent rather than relying only on surface patterns.
Takeaways & Limitations
Results come from a single training run without quantified seed variance, and teacher-generated reflections may transfer GPT-4o-mini’s phrasing or safety biases.
Abstract
from arXiv · showhide
Large language model (LLM) safety classifiers such as Llama Guard are effective at detecting overtly harmful prompts but remain vulnerable to adversarial jailbreak attacks that disguise malicious intent through role-play scenarios, fictional framing, and indirect requests. We present Reflect-Guard, a method that augments LLM-based safety classifiers with chain-of-thought self-reflection capabilities through parameter-efficient fine-tuning. Our approach distills analytical reasoning from GPT-4o-mini into structured reflection annotations, then trains Llama-Guard-3-8B via QLoRA to generate logical self-reflections before issuing safety verdicts. Using only 1000 training examples and updating just 0.5% of model parameters (~42M), Reflect-Guard achieves substantial improvements on two challenging benchmarks. On WildGuardTest, F1 score improves from 0.770 to 0.842 (+7.2 pp), with recall on adversarial prompts increasing from 0.513 to 0.921 (+40.8 pp). On JailbreakBench, the attack success rate drops from 10.3% to 1.8%, representing an 82.5% relative reduction. These gains are especially pronounced on adversarial inputs, where the explicit reasoning step enables the model to see through obfuscation techniques that defeat standard pattern-matching approaches. Our results demonstrate that teaching safety classifiers to reason about adversarial intent, rather than simply classify surface patterns, is a promising direction for robust LLM safety.
1 Introduction
Existing safety classifiers detect straightforward harmful prompts but remain vulnerable to adversarial framing that disguises malicious intent. Reflect-Guard addresses this gap by training Llama-Guard-3-8B to generate explicit self-reflections before safety verdicts.
- Motivation: Adversarial jailbreaks evade surface-level classifiers by disguising harmful requests through fictional, role-play, hypothetical, or educational framing.Llama-Guard-3-8B recalls only 51.3% of adversarial WildGuardTest prompts.
- Motivation: Human reviewers analyze framing and underlying intent, whereas current classifiers make binary decisions without interpretable intermediate reasoning.
- Approach: Reflect-Guard adds chain-of-thought self-reflection to safety classification through knowledge distillation and parameter-efficient fine-tuning.
- Approach: The method distills GPT-4o-mini reflections from 1,000 examples, fine-tunes Llama-Guard-3-8B with QLoRA, and generates reflection before each verdict.The reflection analyzes adversarial techniques and harm indicators before classification.
- Results: +40.8 pp adversarial recall and 82.5% relative attack-success-rate reduction demonstrate improved detection on challenging jailbreak inputs.The reported gains occur alongside strong performance on non-adversarial inputs.
2 Related Work
Prior work develops safety classifiers, jailbreak attacks, and reasoning-based safeguards, but Reflect-Guard combines structured reasoning distillation with lightweight fine-tuning for adversarial-intent analysis.
- Safety classifiers: Llama Guard and related classifiers support content moderation, multilingual coverage, refined categories, adversarial training, injection detection, and agent-safety evaluation.
- Jailbreak attacks: Jailbreak methods include gradient-based suffixes, iterative semantic attacks, hybrid approaches, and role-play or fictional templates.
- Reasoning for safety: Prior safety research applies chain-of-thought, deliberative alignment, and self-critique to content moderation and alignment.
- Positioning: Reflect-Guard distills structured safety reflections into a lightweight LoRA adapter, avoiding multi-turn prompting and teacher-model inference.
- Knowledge distillation: The approach transfers analytical reasoning patterns about adversarial techniques rather than output distributions.
3 Method
Reflect-Guard decomposes safety classification into generated reflection followed by a verdict, trains this behavior on teacher-annotated examples, and deploys it through QLoRA without external inference APIs.
- Problem formulation: The model generates a logical analysis r from prompt x, then predicts verdict y conditioned on both x and r.A single autoregressive model implements both stages.
- Problem formulation: The conditional model factorization makes reflection an intermediate rationale that conditions the downstream safety decision.
- Training data: The training set contains 1,000 examples from WildGuardMix and AdvBench, including 773 harmful and 227 benign prompts.
- Training data: GPT-4o-mini annotates each prompt with a 2–4 sentence reflection identifying adversarial techniques, intent, and supporting indicators.
- Fine-tuning: QLoRA fine-tunes Llama-Guard-3-8B with 4-bit quantization and approximately 42M trainable parameters, or 0.5% of the full model.
- Inference: At inference, the model emits tagged reflection, safety verdict, and optional category codes, with reflection retained for interpretability.No external API is required; the capability is internalized in the LoRA adapter.
4 Experimental Setup
The evaluation tests Reflect-Guard on adversarial and standard safety classification using WildGuardTest and JailbreakBench, with metrics designed to capture detection quality and recall-sensitive deployment priorities.
- Benchmarks: WildGuardTest contains 1,699 prompts, including 754 harmful and 945 benign examples, with an adversarial subset of 796 prompts.The adversarial subset disguises harmful intent through obfuscation techniques.
- Benchmarks: JailbreakBench contains 282 harmful prompts generated by GCG, JBC, and PAIR attack methods.Detection rate is the primary metric because all prompts are ground-truth harmful.
- Baseline: The baseline uses Llama-Guard-3-8B with identical 4-bit NF4 quantization but no LoRA adapter or reflection instruction.This isolates reflection fine-tuning from quantization and prompt-level effects.
- Metrics: WildGuardTest evaluation reports accuracy, precision, recall, and F1 with harmful as the positive class.
- Metrics: Because safety deployment prioritizes recall, the evaluation also reports F2, which weights recall twice as heavily as precision.
- Metrics: JailbreakBench reports detection rate by attack method and overall attack success rate, while WildGuardTest provides adversarial versus non-adversarial breakdowns.
5 Results
Reflect-Guard improves harmful-prompt detection, with the largest gains on adversarial jailbreaks, while also exposing false-positive and category-coverage limitations. Qualitative analysis links missed baseline cases to adversarial framing and residual failures to underrepresented harm types.
- Overall performance: 0.842 F1, up from 0.770, reflects a 7.2 percentage point overall improvement, driven primarily by higher recall.Precision decreases by 9.8 percentage points, indicating a shift toward catching more harmful prompts at the cost of additional false positives.
- Adversarial robustness: 0.921 adversarial recall, up from 0.513, shows Reflect-Guard catches 92.1% of disguised harmful prompts versus 51.3% for the baseline.Non-adversarial F1 also improves from 0.867 to 0.882.
- JailbreakBench: 1.8% attack success rate, down from 10.3%, represents an 82.5% relative reduction on JailbreakBench.PAIR attacks show the largest improvement, while GCG detection rises from 93% to 99% and JBC attacks reach 100% detection.
- Qualitative analysis: 29 harmful cases, including 27 adversarially framed prompts, are caught by reflection after both comparison conditions predict safety.The cases involve role-play, fictional alternate realities, or professional personas; the reflection identifies framing and harm indicators.
- Qualitative analysis: 109 benign prompts become false positives because role-play, sensitive topics, or “loopholes” resemble adversarial inputs.The authors identify reflection confidence or self-contradiction as possible future calibration signals.
- Qualitative analysis: 78 harmful prompts are missed by all conditions, concentrating in private-information and social-stereotype categories with limited training coverage.These residual failures are characterized as category-coverage failures rather than adversarial-framing failures.
6 Analysis and Discussion
Reflect-Guard improves adversarial safety detection, but the gains involve precision trade-offs, residual failures, and unresolved generalization and reproducibility limits. Ablations indicate that SFT supplies most overall improvement, while reflection preferentially strengthens adversarial recall.
- Error analysis: Reflect-Guard introduces 108 new false positives, including benign fictional, role-play, and security-related prompts, while 103 false negatives remain.Some false negatives involve private information, stereotypes, and discrimination, where sophisticated framing leads reflections to classify intent as educational or benign.
- Error analysis: The method’s precision decreases by 9.8 pp overall and 13.5 pp on adversarial prompts, motivating thresholds, cascaded verification, or human review.The authors frame this operating point as prioritizing recall because missed harmful prompts can cause harm, whereas false positives cause unnecessary refusal.
- Ablation findings: Prompting alone provides no benefit: F1 is 0.761 versus 0.770 for the baseline, with identical 89.7% JailbreakBench detection.This rules out the reflection instruction text alone as the source of improvement.
- Ablation findings: +9.0 pp F1 improvement comes from SFT on the decision boundary, reaching 0.860 versus the 0.770 baseline.The SFT-only condition also achieves 100.0% JailbreakBench detection, indicating that fine-tuning accounts for most of the aggregate gain.
- Ablation findings: Reflect-Guard trades 1.8 pp overall F1 for a +7.6 pp adversarial-recall gain over SFT-only, reaching 0.921 versus 0.845.On adversarial prompts, precision falls by 7.9 pp, while non-adversarial precision rises by 1.6 pp and recall falls by 4.4 pp.
- Ablation findings: The opposing subset trends suggest reflection internalizes adversarial-framing features rather than merely shifting a global decision threshold.Adversarial F2 favors Reflect-Guard at 0.869 versus 0.833, while overall F2 is nearly tied at 0.855 versus 0.856.
- Ablation findings: Ground-truth labels during synthesis add only 0.6 pp F1: blind reflections reach 0.836 versus 0.842 for the full method.This suggests label-informed teacher supervision sharpens reflection quality but is not strictly necessary.
- Limitations: Limitations include single-run evaluation, incomplete coverage of novel attacks, possible teacher-bias transfer, and untested multilingual and cross-cultural generalization.The training data and teacher reflections are English-only, and the authors note that 1,000 examples may miss underrepresented adversarial techniques.
7 Conclusion
Reflect-Guard augments Llama-Guard-3-8B with distilled chain-of-thought self-reflection to reason about adversarial techniques before issuing safety verdicts. It improves adversarial detection while motivating broader evaluation and work on false positives, attack diversity, and multilingual settings.
- Contribution: Reflect-Guard distills analytical reasoning from GPT-4o-mini into a QLoRA-finetuned Llama-Guard-3-8B model that reflects before classification.The reflection analyzes adversarial techniques before the model issues a safety verdict.
- Results: F1 rises from 0.770 to 0.842 on WildGuardTest, while adversarial recall increases from 0.513 to 0.921.Adversarial F2 also rises from 0.557 to 0.869.
- Results: Attack success rate drops from 10.3% to 1.8% on JailbreakBench.The result is reported alongside the WildGuardTest improvements.
- Ablation interpretation: SFT accounts for most aggregate F1 improvement, while reflection training further reallocates performance toward adversarial inputs.Reflection adds 7.6 pp adversarial recall over SFT-only and increases precision on non-adversarial inputs.
- Limitations and future work: Future work targets larger and more diverse attack sets, multi-turn scenarios, lower false positives on benign security content, and multilingual evaluation.The paper specifically identifies English-language scope and cross-cultural safety categories as areas for extension.