PaperlayerView exact revision on arXiv

Source-linked AI summary

Reflex-Guard: A Low-Latency Guardrail for LLM Prompt Safety Using Dense Semantic Embeddings

Istiaque Ahmed, Afia Anjum Borsha, Ranat Das Prangon, Abu-fuad Ahmad, Thi Hong Tran

arXiv:2608.17556v1cs.CRcs.CLcs.LG

TL;DR

Reflex-Guard addresses the latency and privacy limitations of existing LLM prompt-safety guardrails by running jailbreak-aware preprocessing, dense semantic embeddings, and fast binary classifiers locally. On a balanced evaluation of 30,568 prompts, it achieved 95.9% recall at 37.6 ms end-to-end latency, while attack-specific probability patterns motivated adaptive thresholding.

  • Problem

    Existing guardrails can detect unsafe prompts but often impose 250-900 ms delays and require routing user data through external moderation services, creating latency and privacy concerns for real-time applications.

  • Method

    Reflex-Guard combines jailbreak-aware preprocessing, compact dense sentence-transformer embeddings, and seven fast binary classifiers in a local guardrail architecture.

  • Results

    95.9% recall at 37.6 ms end-to-end latency was achieved on 30,568 prompts, with GCG and Base64 receiving higher harmfulness scores than DrAttack prompts.

  • Takeaways & Limitations

    Different attack types occupy distinct probability regions, supporting adaptive thresholds and context-aware guardrail design for local deployment.

  • Takeaways & Limitations

    The evaluation covers three attack types and is mainly English-focused, while production traffic, additional harmful sources, multilingual performance, and white-box attackers remain insufficiently evaluated.

Abstract

from arXiv · show

Large Language Models (LLMs) in real-world applications often face the risks of specially crafted prompts designed to bypass the safety controls. Existing guardrail methods, such as LLM-as-a-judge and cloud-based safety APIs are able to detect unsafe content. However, they often add a delay of about 250-900 ms to each request. This delay is too high for real-time applications, when the system usually needs to respond in less than 100 ms. Furthermore, routing user prompts through external moderation endpoints raises significant data privacy concerns. This paper introduces Reflex-Guard, a lightweight guardrail that runs locally. It uses jailbreak-aware preprocessing, compact sentence-transformer embeddings, and seven fast binary classifiers. Together, these components enable high-accuracy prompt safety filtering with much lower latency than existing solutions. Through systematic evaluation on a strategically balanced dataset of 30,568 samples drawn from five complementary sources, we demonstrate that Reflex-Guard achieves 95.9% recall on harmful prompts at 37.6 ms end-to-end latency. It is faster than existing baselines, including Llama Guard 2 at 255 ms and SafeDecoding at 723 ms. It can detect 100% of GCG suffix attacks and Base64-encoded prompts using the default threshold. However, DrAttack structured prompts required lowering the threshold to 0.03 for optimal detection, as they produced a distinct probability distribution. Reflex-Guard achieves Reflex Efficiency Score (RES) scores up to 16.79, significantly outperforming Llama Guard 2 (11.90) and SafeDecoding (9.80). This analysis offers practical deployment advice and shows that different attack types occupy distinct regions in the embedding probability space.

I. INTRODUCTION

LLM jailbreaks exploit weaknesses in safety alignment, while existing defenses can be too slow, costly, or privacy-sensitive for real-time use. Reflex-Guard addresses this gap with a local embedding-based architecture and a unified efficiency metric.

  • Motivation: Jailbreak attacks use role-play, adversarial suffixes, encoding, and structured prompts to bypass LLM safety alignment.These attack families can conceal harmful intent or manipulate model behavior in different ways.
  • Motivation: Existing guardrails provide strong detection but may impose excessive latency or require sending prompts to external moderation services.The resulting capability-efficiency and privacy trade-offs are problematic for real-time and sensitive applications.
  • Contributions: Reflex-Guard is a low-latency local architecture for detecting harmful and jailbreak-style prompts before they reach the target LLM.The design targets simultaneous improvements in safety, latency, and privacy.
  • Contributions: The paper introduces RES, a unified metric for evaluating detection effectiveness against computational cost.RES supports comparisons across guardrail systems and deployment priorities.
  • Contributions: A systematic comparison evaluates seven lightweight classifiers on a diverse benchmark of benign and adversarial prompts.The comparison seeks the best trade-off between detection performance and latency.
  • Contributions: Different adversarial prompt families produce distinct detection patterns, motivating adaptive threshold selection for heterogeneous attacks.The paper also presents deployment guidance based on speed, recall, and overall efficiency.

II. RELATED WORK

Prior guardrails span LLM judges, cloud moderation, attack-specific defenses, and embedding classifiers, but few studies jointly address sub-100 ms latency, heterogeneous attacks, and security-efficiency trade-offs. Reflex-Guard contributes an integrated evaluation framework and RES metric for this gap.

  • LLM-Based Guardrails: LLM-based guardrails achieve strong detection but require full transformer passes that can incur 255–400 ms latency.This exceeds the sub-100 ms target described for real-time systems.
  • Cloud Moderation: Cloud moderation APIs are easy to deploy but introduce 100–300 ms network latency, privacy concerns, and inconsistent evasion testing.These services may also over-filter or miss evasive prompts.
  • Jailbreak Attacks: GCG, DrAttack, and Base64 attacks use adversarial suffixes, benign templates, and encoded strings to bypass safety filters.Their differing mechanisms motivate evaluation across multiple attack vectors.
  • Embedding-Based Detection: Sentence transformers provide compact dense embeddings suitable for semantic safety classification and real-time edge deployment.The cited BGE model produces 384-dimensional normalized embeddings with 33 million parameters.
  • Research Gap: Existing work rarely evaluates sub-100 ms latency, multiple attack types, and the security-latency trade-off within one framework.These gaps make production suitability difficult to assess.
  • Research Gap: Reflex-Guard analyzes attack-specific thresholds, introduces RES, and evaluates jailbreak-aware preprocessing against GCG, Base64, and DrAttack.Table I summarizes comparisons with existing approaches.

III. PROPOSED FLEX-GUARD METHOD

Reflex-Guard combines jailbreak-aware preprocessing, dense embeddings, lightweight classifiers, and threshold-based decisions in a local pipeline. Preprocessing detects and decodes obfuscation patterns so harmful intent is more visible to the classifier.

  • Overall Architecture: The pipeline preprocesses prompts, generates semantic embeddings, classifies them, and blocks or allows input using a threshold.Its components are designed for low-overhead operation.
  • Jailbreak-Aware Preprocessing: The preprocessor scans for Base64 payloads, GCG-style suffixes, and DrAttack structural templates in sequence.Base64 content is decoded and marked with a DECODED prefix.
  • Jailbreak-Aware Preprocessing: Base64 detection uses a sliding four-character window to identify substrings matching valid Base64 character patterns.Detected substrings are decoded before embedding.
  • Jailbreak-Aware Preprocessing: GCG-style suffixes are detected but retained because the BGE embedding model handles their noise and their presence can indicate an attack.The preprocessing pipeline therefore treats different obfuscation types differently.
  • Performance: Preprocessing adds less than 0.1 ms overhead per request.Base64 decoding is important because encoded prompts can resemble benign content in embedding space without decoding.

B. Dense Semantic Embedding Stage

The embedding stage converts each preprocessed prompt into a compact normalized semantic representation for binary safety classification. BGE embeddings use query formatting, mean pooling, and L2 normalization to support angular-similarity decisions.

  • Embedding Generation: BGE transforms the preprocessed prompt into a 384-dimensional L2-normalized dense semantic vector.The approximately 33-million-parameter model is compact and captures semantic structure for safety classification.
  • Embedding Generation: The pipeline prefixes inputs with “query:” before encoding to activate BGE’s task-specific attention patterns.The resulting embedding is used as the classifier feature vector.
  • Pooling: Mean pooling combines the token embeddings h_1 through h_n into a sentence-level embedding e.Here, n denotes sequence length and e is a 384-dimensional pooled representation.
  • Normalization: L2 normalization places embeddings on the unit hypersphere so decisions depend on angular similarity rather than vector magnitude.The normalized embedding uses the Euclidean norm of the pooled vector.
  • Similarity: Cosine similarity between L2-normalized embeddings is computed as their dot product.The compared vectors are denoted u and v.

C. Classifier Ensemble and Threshold Decision

Reflex-Guard converts prompts into embeddings, classifies them with lightweight binary models, and applies a threshold to block or allow requests. The design supports deployment choices balancing detection performance, latency, and privacy.

  • Classifier Ensemble: Seven binary classifier architectures operate on prompt embeddings to separate harmful prompts from benign prompts.Supported models include Logistic Regression, XGBoost, LightGBM, HistGradientBoosting, Random Forest, AdaBoost, and K-Nearest Neighbors.
  • Classifier Ensemble: The harm probability for Logistic Regression is obtained by applying a sigmoid to z = wT x + b.The input embedding has 384 dimensions, and the sigmoid maps the raw score to a value between 0 and 1.
  • Threshold Decision: Lower thresholds increase blocking sensitivity but may raise false positives, whereas higher thresholds reduce false positives but may miss harmful prompts.The threshold can be adjusted according to anticipated attack vectors.
  • Threshold Decision: The decision rule blocks a prompt when its predicted harm probability p is at least τ and allows it otherwise.The default threshold is τ = 0.25, selected from validation performance.
  • Deployment Design: Local checks and compact BGE-small embeddings reduce network dependence and support privacy-sensitive deployment.The architecture keeps prompts within the deployment environment and supports horizontally scalable local instances.

A. Dataset Construction and Composition

The evaluation uses a strategically balanced dataset combining harmful and benign prompts from complementary sources. Separate training and test partitions are designed to assess performance on unseen attack sources while supporting reproducible benchmarking.

  • Dataset Composition: 30,568 prompts comprise 15,568 harmful and 15,000 benign samples.The dataset contains 26,000 training samples and 4,568 test samples.
  • Dataset Sources: Harmful data combines Anthropic Red Team, JailbreakBench, JailbreakHub/DAN, and MultiJail Bengali sources.Sampling, expansion, deduplication, and paraphrasing preserve diverse harmful intents and multilingual evasion cases.
  • Train-Test Separation: Training uses 13,000 harmful Anthropic Red Team prompts and 13,000 benign AlpacaEval prompts, while evaluation attacks come from held-out sources.Classifiers do not see JailbreakBench, JailbreakHub, or MultiJail during training.
  • Train-Test Separation: The 4,568-sample test set contains 2,568 harmful and 2,000 benign prompts under a stratified label split.This design targets reduced dataset-specific overfitting and more meaningful metric comparisons.
  • Reproducibility: Experiments use fixed software versions, random seeds, and deterministic cuDNN settings on commodity GPU and CPU environments.Latency measurements use ten warm-up passes followed by 100 sampled test prompts.

C. In-Distribution Classification Performance

On in-distribution test data, the classifiers clearly separate harmful from benign prompts. HistGradientBoosting and LightGBM provide the strongest overall performance, with stable cross-validation results.

  • Stability and Selection: The classifiers clearly separate harmful and benign prompts when test data follows the training distribution.HistGradientBoosting is selected for out-of-distribution evaluation based on its balance of F1, recall, and ROC performance.
  • Performance Results: LightGBM reaches 0.954 F1 and 95.8% recall, placing gradient-boosted models in the strongest performance group.Logistic Regression also performs strongly with 0.942 F1 and 94.7% recall.
  • Performance Results: 96.3% precision is highest for K-Nearest Neighbors, but its recall is lowest at 86.0%.This reflects a more conservative classification pattern that may miss more harmful prompts.
  • Stability and Selection: 0.990 ROC AUC is achieved by both HistGradientBoosting and LightGBM, while the top five classifiers exceed 0.984 ROC AUC.Five-fold cross-validation gives HistGradientBoosting and LightGBM mean F1 scores above 0.95 with standard deviations below 0.01.

D. Out-of-Distribution Robustness Evaluation

Reflex-Guard detects GCG and Base64 attacks at the default threshold but requires a lower threshold for DrAttack prompts. Latency varies substantially across classifiers, creating deployment-specific trade-offs.

  • Attack Robustness: 100% detection is achieved for all 100 Base64 prompts at τ = 0.25 after jailbreak-aware preprocessing and decoding.Without preprocessing, recall falls to 7% and mean predicted probability to 0.09.
  • Attack Robustness: DrAttack detection rises from 0% at τ = 0.25 to 100% recall at τ = 0.03 with no false positives among 2,000 benign samples.DrAttack probabilities are much lower, with a mean of 0.05, indicating that one fixed threshold does not fit all attack families.
  • Latency: 37.59 ms total component latency makes LightGBM the fastest classifier, while Logistic Regression reaches 37.97 ms.Both remain below 100 ms and maintain recall above 94.7%.
  • Latency: 166.94 ms for Random Forest and 106.20 ms for AdaBoost make them less suitable for strict real-time settings.LightGBM and Logistic Regression are favored for latency-sensitive systems, while HistGradientBoosting is preferred for safety-critical systems.
  • Latency: 53.17 ms mean end-to-end latency is reported for Logistic Regression, compared with 37.97 ms component latency.P99 latency reaches 325.80 ms for Logistic Regression and 284.73 ms for LightGBM.

F. Reflex Efficiency Score Comparison

RES combines recall and latency to compare guardrail efficiency. Logistic Regression and HistGradientBoosting lie on the security–latency Pareto frontier and outperform the baselines in RES.

  • Metric definition: RES combines recall and latency into a single efficiency metric for comparing guardrails.Recall is written as a decimal, latency in milliseconds, and the logarithm penalizes latency sublinearly.
  • Results: 16.79 RES is achieved by Logistic Regression, with 94.73% recall and 48.92 ms end-to-end mean latency.
  • Results: 95.89% recall is achieved by HistGradientBoosting, with RES 16.67 at 52.87 ms, only 0.12 points below Logistic Regression.
  • Baseline comparison: 41% higher RES than Llama Guard 2 and 71% higher than SafeDecoding is achieved by the best Reflex-Guard configuration.Llama Guard 2 achieves 11.90 RES, while SafeDecoding achieves 9.80.
  • Deployment guidance: Logistic Regression is recommended for maximum speed, whereas HistGradientBoosting is preferred when maximum recall matters.HistGradientBoosting improves recall by 1.16 percentage points while adding 3.95 ms latency.

G. Threshold Sensitivity Analysis

Attack families occupy distinct probability ranges, so a single threshold does not detect them equally well. DrAttack requires a lower threshold than GCG and Base64 attacks, motivating attack-aware calibration.

  • Probability distributions: 0.79, 0.63, and 0.05 are the mean probabilities for GCG, Base64, and DrAttack attacks, respectively.These distinct distributions motivate threshold-sweep analysis and attack-specific operating points.
  • Threshold selection: The optimal threshold is selected by maximizing F1 to balance precision and recall at the operating point.Threshold sweeps are used to study detection sensitivity and identify suitable operating points.
  • DrAttack sensitivity: 100% DrAttack recall occurs at τ = 0.03, but recall falls to 75% at 0.04, 58% at 0.05, and 0% by 0.07.DrAttack probabilities are tightly clustered between 0.019 and 0.023, with standard deviation 0.008.
  • DrAttack sensitivity: 98.7% general recall at τ = 0.03 is only 0.4 percentage points below the default 99.1% result.Among 2,000 benign AlpacaEval samples, no prompt exceeds 0.03, producing zero false positives.
  • Adaptive thresholds: τ = 0.25 is effective for GCG and Base64, while DrAttack requires τ = 0.03 because its probabilities are much lower but remain separated from benign prompts.The proposed adaptive strategy applies the lower threshold to DrAttack-like patterns and retains the default for GCG, Base64, and normal prompts.

V. DISCUSSION

Reflex-Guard combines dense embeddings with lightweight classifiers to analyze attack-specific prediction patterns, false positives, deployment trade-offs, and evaluation boundaries. The discussion recommends threshold and classifier choices tailored to deployment goals while identifying dataset, attack, multilingual, and threat-model limitations.

  • Embedding Effectiveness in Safety Classification: Sentence-level pooling and L2 normalization help BGE embeddings emphasize prompt intent and semantic similarity over token noise, length, or word frequency.The paper attributes this to reduced sensitivity to GCG suffix noise and improved separation of harmful and benign prompts.
  • Analysis of Attack-Specific Probability Distributions: GCG attacks have a mean harmfulness probability of 0.79, compared with 0.63 for Base64 attacks and 0.05 for DrAttack prompts.DrAttack’s benign framing weakens the harmful signal and shifts embeddings toward an intermediate region between harmful and benign clusters.
  • Analysis of Attack-Specific Probability Distributions: DrAttack detection improves when the threshold decreases from 0.25 to 0.03 because its tightly clustered, low-score distribution is missed at the default threshold.The reported standard deviation for DrAttack prompts is 0.008.
  • False Positive Analysis: Precision exceeds 0.93 for top-performing models, while Logistic Regression has a 5.4% false positive rate at the default threshold of 0.25.The paper recommends routing near-threshold predictions to human review or a slower LLM-based judge.
  • Deployment Recommendations: LightGBM provides the fastest deployment option at 37.59 ms component latency and 95.76% recall, while HistGradientBoosting reaches 95.9% recall at 44.67 ms.Logistic Regression is recommended for balanced deployment, with RES 16.79, 94.73% recall, and 48.92 ms end-to-end latency.
  • Limitations: The evaluation uses 30,568 prompts from five sources and focuses on GCG, Base64, and DrAttack, so production diversity and other attack families remain outside its tested scope.The harmful training data mainly comes from the Anthropic Red-Team dataset.
  • Limitations: The study mainly evaluates English prompts, uses Bengali only as preliminary multilingual evidence, and compares baselines using reported rather than uniformly reproduced results.Its black-box threat model does not evaluate attackers who know the embedding model or classifier.
  • Ethics and Responsible Use: Thresholds should reflect application risk because false positives can block harmless requests and false negatives can allow unsafe prompts through.The paper advises defense in depth rather than treating Reflex-Guard as a complete safety solution.

VI. CONCLUSION AND FUTURE WORK

Reflex-Guard is presented as a lightweight local framework for real-time prompt safety filtering that combines preprocessing, dense embeddings, and fast binary classifiers. The paper concludes that attack-specific prediction patterns motivate adaptive guardrails, while future work should broaden evaluation, robustness, thresholding, and deployment testing.

  • VI. CONCLUSION AND FUTURE WORK: Reflex-Guard combines jailbreak-aware preprocessing, dense semantic embeddings, and fast binary classifiers for local, real-time prompt filtering.The framework is intended to operate before prompts reach the target LLM while reducing dependence on external moderation services.
  • VI. CONCLUSION AND FUTURE WORK: Different attack types produce distinct prediction patterns, supporting adaptive and context-aware guardrail design.The conclusion connects these patterns to the need for more general and robust deployment strategies.
  • VI. CONCLUSION AND FUTURE WORK: Future evaluations should use more diverse production-like traffic, broader harm categories, additional languages, code-mixed prompts, and translated jailbreaks.The paper specifically emphasizes low-resource multilingual robustness.
  • VI. CONCLUSION AND FUTURE WORK: Future robustness testing should include white-box, paraphrasing, multi-turn, indirect prompt-injection, and retrieval-based attacks.These attacks are proposed to assess robustness under more realistic threat conditions.
  • VI. CONCLUSION AND FUTURE WORK: Future deployment work should explore adaptive calibration, model compression, quantization, batching, and edge-device implementation.Adaptive thresholds could use prompt structure, attack signals, domain risk, and user context.
Loading 2608.17556v1…