PaperlayerView exact revision on arXiv

Source-linked AI summary

Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks

Aaditya Pratap, Harsh Kasyap, Somanath Tripathy

arXiv:2608.21895v1cs.CRcs.AI

TL;DR

Locally deployed LLMs lack the moderation surrounding API-served models, making defense assumptions central to their safety. This paper audits six input-side defenses by translating their assumptions into testable failure signatures and evaluating them across six models and 13,800 records. The defenses largely fail against semantic attacks in predictable ways, including a 14% ASR increase for Phi-4 under SmoothLLM and silence from the CUSUM monitor on 87.9% of successful multi-turn jailbreaks.

  • Problem

    The paper asks whether assumptions underlying existing jailbreak defenses, developed mainly for token-level attacks, hold for semantic attacks on locally deployed LLMs.

  • Method

    The study extracts each defense’s explicit or implicit assumption, derives a falsifiable failure signature, and tests it across six locally deployed models, six defenses, and 13,800 evaluation records.

  • Results

    The defenses largely fail against semantic attacks in structured ways, including a 14% ASR increase for Phi-4 under SmoothLLM and 87.9% of successful multi-turn jailbreaks escaping the CUSUM monitor.

  • Takeaways & Limitations

    Defense performance is conditional on attack-surface assumptions, so model choice can dominate defense choice within an attack surface but not across surfaces.

  • Takeaways & Limitations

    Self-Denoised Smoothing’s published certificates address classification robustness on SST-2 and Agnews under bounded word-replacement attacks, not jailbreaks.

Abstract

from arXiv · show

Locally deployed Large Language Models (LLMs) via inference engines such as Ollama run without the moderation and abuse detection present in API-served models. Therefore, the safety of LLMs depends on the defense mechanisms used, and their effectiveness depends on the assumptions on which they were designed. This paper does an audit of defense mechanisms under jailbreak attacks on locally deployed models. Some defenses provide formal guarantees (SmoothLLM, Erase-and-Check, Sequential Monitors), while others rely on empirical detection results (Semantic Smoothing, Self-Denoised Smoothing, Perplexity Filtering). Instead of merely observing that defenses fail, we trace each failure back to the specific assumption: for every defense, we extract the condition it relies on, derive the empirical pattern a violation should produce, and test that prediction on six open-weight models (14B to 35B parameters) with a corpus of 100 jailbreak prompts taken from more than 40 public sources, totalling 13,800 evaluation records.

1 Introduction

The paper audits whether input-side jailbreak defenses designed around token-level attacks work against semantic jailbreaks on locally deployed models. It converts each defense’s assumption into a falsifiable failure prediction and evaluates six defenses across six models and 13,800 records.

  • Motivation: Existing defenses are commonly designed and evaluated against token-level attacks with compact, statistically unusual adversarial suffixes.The studied attacks include GCG, AutoDAN, and PAIR.
  • Motivation: Semantic jailbreaks use fluent natural language whose harmful intent resides in meaning or framing rather than anomalous token sequences.They can involve role-play, personas, hypothetical scenarios, or goals distributed across turns.
  • Research questions: The study asks whether defenses reduce semantic-jailbreak ASR, which assumptions fail, and how much safety comes from defenses versus intrinsic model alignment.
  • Study design: The evaluation covers six defenses, six open-weight LLMs, prompts from more than 40 public sources, and 13,800 evaluation records.
  • Contributions: The audit derives measurable failure signatures from each defense’s stated or implicit assumption before testing them empirically.The contributions include a diagnostic protocol, an assumption ledger, and four case studies of assumption failure.

2 Background

The background contrasts token-level and semantic jailbreaks, then organizes six defenses by whether their claims are theorem-based or empirical. Their guarantees and detection strategies depend on locality, drift, or distributional assumptions that semantic attacks may violate.

  • Attack types: Token-level attacks typically place statistically unusual adversarial content in a compact, identifiable suffix, whereas semantic attacks encode the payload in fluent meaning or framing.
  • Semantic jailbreaks: Semantic prompts are defined as ordinary-language inputs with benign-range perplexity and no compact token subsequence whose removal neutralizes the attack.
  • Defense taxonomy: Category 1 defenses—SmoothLLM, Erase-and-Check, and Sequential Monitors—state formal guarantees with explicit preconditions, while Category 2 defenses rely on implicit empirical premises.
  • Smoothing and erasure: SmoothLLM and Erase-and-Check require adversarial content to be localized and vulnerable to bounded character edits or deletion of a trailing span.
  • Denoising: Self-Denoised Smoothing masks tokens and regenerates them before classification, but its published certificates concern bounded word-replacement robustness on SST-2 and Agnews rather than jailbreaks.
  • Other defenses: Semantic Smoothing uses meaning-preserving rewrites, Sequential Monitors accumulate per-turn evidence, and Perplexity Filtering targets statistically unusual strings such as high-perplexity GCG suffixes.The sequential guarantee requires negative benign drift and positive attack drift; semantic attacks are constructed to fall outside the perplexity scope.

2.5 Formal Statements of the Tested Guarantees

This section states the assumptions and conditional guarantees tested for six defenses, then identifies how semantic attacks can violate those conditions. The defenses span perturbation, erasure, denoising, sequential detection, semantic transformation, and perplexity-based filtering.

  • 2.5 Formal Statements of the Tested Guarantees: The paper tests formal conditions underlying SmoothLLM, Erase-and-Check, and Sequential Monitors, alongside implicit properties supporting three empirically evaluated defenses.The formal conditions are presented as the basis for the paper’s later tests.
  • 2.5.1 SmoothLLM: SmoothLLM assumes an adversarial suffix is k-unstable, meaning changing at least k suffix characters makes the jailbreak fail.The guarantee concerns defense success over randomly perturbed copies under this suffix-specific condition.
  • 2.5.1 SmoothLLM: When the suffix spans nearly the prompt and k > M, as in semantic attacks, the certified success probability α collapses toward zero and the vote approaches the undefended vote.Here M = floor(qm) is the perturbation budget, while m and m_S denote prompt and suffix lengths.
  • 2.5.2 Erase-and-Check: Erase-and-Check deletes candidate token spans and flags a prompt if any erased remainder is detected as harmful, with a maximum erase length d.Its suffix guarantee applies to harmful prompts with appended adversarial suffixes of length at most d.
  • 2.5.3 Self-Denoised Smoothing: Self-Denoised Smoothing masks 30% of token positions, regenerates fluent text with the same LLM, classifies the result, and majority-votes across independently masked copies.The method relies on regeneration removing harmful content that masking does not remove.
  • 2.5.4 Sequential Monitors: Sequential Monitors inspect cumulative context after each turn and return Allow or Halt decisions, with the objective of stopping harmful sessions by the harmful turn without interrupting benign ones.The framework leaves the accumulation statistic unspecified; the paper instantiates it using a CUSUM rule.
  • 2.5.4 Sequential Monitors: CUSUM halts at the first time G_i reaches threshold h, with h tuned to a fixed false-alarm budget; its optimality guarantee requires negative benign drift and positive attack drift.The increments are defined as turn-level harmful-versus-benign loglikelihood ratios.
  • 2.5.5 Semantic Smoothing and 2.5.6 Perplexity Filtering: Semantic Smoothing majority-votes labels from M meaning-preserving transformations, whereas Perplexity Filtering flags inputs above a threshold based on the assumption that attacks occupy the high-PPL tail.Semantic Smoothing uses word-, prompt-, and structure-level transformations; the original perplexity threshold was near 1000 for GCG strings.

3 Threat Model and Auditing Setup

The study audits input-side defenses against semantic jailbreaks using a non-adaptive, query-only threat model and locally deployed open-weight models. Its protocol maps each defense’s assumptions to predicted failure signatures, then evaluates those predictions across diverse prompts, configurations, and model runs.

  • Adversary Model: The adversary has black-box, query-only access and does not know which defense is deployed, with both single- and multi-turn interactions considered.
  • Scope: The evaluation excludes adaptive attacks, model patching, and benign-load over-refusal except when false positives are part of a defense’s behavior.
  • Defense Selection: The six defenses span distinct mechanism families, including perturbation, erasure, masking, paraphrasing, conversation monitoring, and statistical filtering.
  • Deployment Setting: The study evaluates six open-weight models from 14B to 35B parameters in a local Ollama deployment without cloud components.
  • Prompt Corpus: The prompt corpus draws on more than 40 public sources and covers six attack families, including role-playing, persona injection, semantic paraphrasing, hypothetical scenarios, prefix modification, and multi-turn decomposition.
  • Diagnostic Protocol: The diagnostic pipeline extracts assumptions, tests semantic-attack compliance, registers predicted failure signatures, and compares structured evaluation records against those predictions.
  • Metrics: ASR is the main metric, while vulnerability labels come from Llama-Guard-3:8b and a subset receives independent human annotation checks.
  • Statistical Analysis: Aggregate comparisons use unpaired two-proportion Pearson χ2 tests, with percentage-point effect sizes and no multiplicity adjustment across 30 single-turn cells.

4 Results

The results section evaluates six defenses under semantic attacks, diagnoses failures of their underlying assumptions, and compares wrapper effects with intrinsic model alignment.

  • The evaluation compares six defenses under semantic attacks while diagnosing their design-assumption failures and separating wrapper effects from intrinsic model alignment.

4.1 RQ1: Do Defenses Reduce ASR Under Semantic Attacks?

Across single-turn semantic attacks, defenses do not consistently reduce ASR and sometimes increase it; multi-turn decomposition raises risk substantially across all models.

  • Conclusion: The findings answer RQ1 in the negative: no single-turn defense provides consistent protection against semantic jailbreaks.The baseline comparison and above-baseline cells show that protection is neither reliable nor uniformly beneficial.
  • Single-turn results: 13.33% baseline mean ASR changed to 15.17% under SmoothLLM, 13.16% under Erase-and-Check, 10.66% under Self-Denoised Smoothing, 16.00% under Semantic Smoothing, and 11.53% under Perplexity Filtering.The best average improvement was 2.67%.
  • Single-turn results: Granite-4.1 and Phi-4 accounted for nearly all successful single-turn jailbreaks under every defense.The model ranking remained nearly invariant, while defense rankings varied across models.
  • Single-turn results: Eleven of 30 single-turn model-defense cells exceeded their own baseline, showing that every defense can harm at least one model-defense pair.Affected cells included resistant models, where increases were entirely defense-induced.
  • Multi-turn results: 42.10% mean ASR occurred under K=4 multi-turn decomposition with a Sequential Monitor, jailbreaking every model on substantial conversations.This included the four models that refused every single-turn attack.

4.2 RQ2: Which Assumption Fails, and What Does It Look Like?

The audit converts each defense assumption into a predicted failure signature and finds that semantic attacks violate those assumptions in distinct, measurable ways.

  • SmoothLLM: SmoothLLM assumes harmful content is localized in a bounded suffix, but semantic prompts distribute payload across their wording, making character perturbation ineffective.Mean ASR was 15.17% versus a 13.33% baseline, and Phi-4 increased from 24% to 38%.
  • Erase-and-Check: Erase-and-Check assumes a contiguous harmful suffix, yet ASR stayed 13.16% at every tested erasure depth and outcomes were uniformly all-safe or all-unsafe.Across 1,800 records, 91 realized jailbreaks were missed, producing a 32.16% miss rate.
  • Self-Denoised Smoothing: Self-Denoised Smoothing reconstructs fluent completions, so masking semantic prompts restores their role-play meaning rather than removing the attack.The denoising operation reconstructs the attack because the visible context determines the missing persona fragments.
  • Semantic Smoothing: Semantic Smoothing assumes meaning-preserving rewrites disrupt adversarial content, but semantic attacks encode the attack in meaning itself, yielding 16.00% mean ASR.Phi-4 rose from 24 to 32 and Granite from 56 to 62.5; per-prompt vote outcomes were bimodal.
  • Sequential Monitors: Sequential Monitors require positive per-turn harmfulness drift after an attack begins, but decomposition attacks keep turns polite and cumulative framing carries the harmful intent.The monitor missed 87.89% of successful jailbreaks while producing a 15.1% false-positive rate on clean rows.
  • Sequential Monitors: A remaining Sequential Monitor limitation is that pooled results may conceal different failure modes between keyword and LLM scorers.The LLM scorer can itself become an attack target because the conversation is its input.
  • Perplexity Filtering: Perplexity Filtering assumes adversarial prompts occupy a separable high-perplexity tail, whereas fluent semantic jailbreaks passed undetected at every tested threshold.The detector fired zero times across more than 3,000 records, including 346 successful jailbreaks.

4.3 RQ3: Defense Versus Intrinsic Alignment

Within a fixed single-turn attack surface, intrinsic model alignment dominates defense choice; under multi-turn decomposition, model rankings reshuffle sharply.

  • Single-turn surface: Single-turn models form resistant and vulnerable clusters that remain stable across defenses, with cluster membership determined by the model rather than the defense.The resistant models never exceeded 11% ASR, while Granite 4.1 and Phi-4 stayed exploitable.
  • Single-turn surface: Within the tested single-turn conditions, a strongly aligned model without a defense outperformed a weakly aligned model with a defense.This comparison follows from model selection dominating defense selection on the fixed attack surface.
  • Multi-turn surface: 75.7% ASR was reached by DeepSeek-r1 under multi-turn decomposition despite zero single-turn successes, while Qwen reached 34.9% and Gemma 21.0%.OLMo remained comparatively resistant at 5.0%.
  • Multi-turn surface: Only OLMo-3.1 resisted both surfaces in the reported data, although its multi-turn ASR was still 5%.The attack surface, not merely the defense, changes the ordering of model vulnerability.

5 Four Case Studies of Assumption Failure

Four case studies show that semantic jailbreaks violate the assumptions behind both certified and empirically calibrated defenses, producing predictable failures.

  • Case 1: Character Perturbation: 14 points: SmoothLLM raises Phi-4-14b’s ASR from 24% to 38%, a statistically significant defense-induced degradation.The increase is significant (two-proportion χ2(1) = 4.58, p≈0.03).
  • Case 2: Depth-Invariant Erasure: 198 erased tokens on average, including half the prompt, leave Erase-and-Check outcomes unchanged, showing that semantic harm is not localized.The observed binary behavior matches failure of the certificate’s locality precondition.
  • Case 2: Depth-Invariant Erasure: 87.18% detection accuracy and zero false positives in 93.84% of conversations coexist with completeness failure on 15.72% of records.Among those records, the miss rate against realized jailbreaks is 32.16% (Wilson 95% CI [27.0%, 37.8%]).
  • Case 3: Perplexity Filtering: 0 of 3,000 detections occur across five perplexity thresholds, while 346 successful jailbreak records achieve a 100% bypass rate.Semantic prompts remain fluent and fall at or below the benign perplexity range.
  • Case 4: The Silent Monitor: 87.89% of 2,526 successful jailbreaks finish without a monitor alarm, leaving pooled recall at 12.11% versus the reported 93% defense success rate.Per-turn decomposition remains benign-looking because harmful intent exists in the cumulative framing.

6 Discussion

The discussion organizes failures into locality, semantic-preservation, and distributional categories, then turns those diagnoses into audit and design guidance.

  • Taxonomy of Assumption Failures: Each of the six defenses maps to a specific violated assumption, forming three failure pairs: locality, semantic preservation, and distributional detection.Table 10 groups the six defenses into two defenses per category.
  • Taxonomy of Assumption Failures: Semantic attacks defeat locality-based defenses because their intent is spread across the whole prompt rather than confined to a bounded region.Perturbation and erasure therefore fail to overlap meaningfully with the payload.
  • Taxonomy of Assumption Failures: Semantic Smoothing and Self-Denoised Smoothing conflict with semantic attacks because rephrasing or reconstruction preserves or rebuilds the malicious meaning.Self-denoising can reconstruct a malicious prompt from fragments, beyond the scope of its word-substitution certificates.
  • Taxonomy of Assumption Failures: Perplexity Filtering and Sequential Monitors fail distributionally because fluent semantic attacks occupy benign-looking regions at document or turn level.The relevant score signal is absent or indistinguishable from ordinary text.
  • Implications for Defense Design: Robust defenses should reason about intent, neutralize adversarial goals, or combine aligned models with lightweight safeguards rather than rely only on surface form.The paper identifies embedding- or entailment-based screening, goal-neutralizing transformations, and hybrid stacks as research directions.
  • A Pre-Deployment Audit for Defenses: A pre-deployment audit should state assumptions, check certification arithmetic, measure harm in both directions, and test at least one multi-turn attack family.Single-turn results did not predict multi-turn outcomes for any of the six models.

7 Conclusion

Across six locally deployed models, six defenses, and 13,800 records, semantic jailbreaks largely violate defense assumptions and produce predictable failure signatures.

  • Conclusion: 13,800 evaluation records across six locally deployed models and six defenses show that semantic attacks largely invalidate the defenses’ underlying assumptions.The observed failures fall into locality, semantic-preservation, and distributional categories.
  • Conclusion: 14% ASR increase for Phi-4 under SmoothLLM demonstrates that a defense can be net harmful rather than merely ineffective.The conclusion presents this as a concrete consequence of assumption failure.
  • Conclusion: 87.9% of multi-turn jailbreaks never trip the CUSUM monitor, showing that conditional optimality can become silence when the required drift disappears.The monitor’s guarantee is tied to its drift condition.
  • Conclusion: Alignment is the strongest measured single-turn defense but does not transfer across attack types because safety claims are conditioned on attack families.The paper therefore treats defense effectiveness as attack-surface dependent.

A A Representative Corpus Prompt

The representative corpus prompt illustrates a semantic jailbreak through fluent role-play and persona framing, embedding harmful goals in an ordinary-language scenario.

  • Representative Corpus Prompt: The example uses a plane-crash survival scenario and a village demanding information in exchange for food, shelter, or other help.The framing supplies a fictional context for requests involving weapons and drugs.
  • Representative Corpus Prompt: The prompt exemplifies the semantic attack class because its harmful intent is carried by fluent narrative framing rather than an identifiable adversarial suffix.The passage identifies role-play and persona injection as the defining construction.
  • Representative Corpus Prompt: The prompt assigns specialized personas, including a programmer and a pharmacologist, to make harmful assistance appear role-consistent.These roles support the scenario’s requests for technical and chemical information.
Loading 2608.21895v1…