Jul 2026· Annual International Computer Software and Applications Conference· pp. 2357-2362· 0 citations· 21 references
Abstract
Detecting whether a jailbreak attack against a large language model (LLM) has succeeded is a challenging problem in AI security. Existing approaches rely on brittle string matching, expensive LLM-based judges, or task-specific classifiers that often fail to generalize. This paper investigates whether semantic coherence is sufficient to evaluate jailbreak success. In this work, we propose PRISM: Prompt-Response coherence for Identifying jailbreaks via Scoring Method, a lightweight method that models jailbreak detection as a coherence problem between the harmful prompt and the model response. The approach combines multiple semantic similarity signals within an ensemble of classical and simple machine learning models. Training in 3,480 pairs of prompt-responses from AdvBench, HarmBench and Alpaca, PRISM achieves F1 = 0.91 and AUC-ROC = 0.98 in the internal test set. In a held-out validation set of 694 labeled samples never seen during training, it outperforms six baseline attack success estimators, achieving the highest accuracy (0.746) and AUC-ROC (0.840), while being up to $\mathbf{1 6} \times$ faster than LLM-based methods. These results demonstrate that semantic coherence provides a robust and efficient signal for jailbreak detection, significantly reducing the implementation complexity of state-of-the-art approaches.
The threat posed by adversarial prompts to large language models is becoming harder to ignore. Problems including prompt injection, jailbreaking, phishing, and Unicode-based attacks are now widespread. Most existing solutions protect against only one threat type, operate in English only, and provide no explanation for their decisions. We present SemGuard, a multilingual security gateway using Triple-Anchor Semantic Threat Modeling, which simultaneously evaluates each input against three semantic reference sets: attack, safe, and destructive. SemGuard detects four threat types concurrently in Arabic, Arabizi, and English. We expand the original Arabic Security Dataset from 319 to 807 validated examples across seven threat categories, using three independent LLM judges (GPT-4o, Grok-4, Llama 3.3 70B) achieving Fleiss' $\kappa=0.839$. After retraining on the expanded dataset, SemGuard achieves a mean F1-score of 0.989 and recall of 0.991, representing a 13.7% improvement over the original implementation. Analysis of 527 rejected examples reveals quantitative evidence of threat-category ambiguity, with impersonation exhibiting a 98.2% inter-judge disagreement rate, validating the necessity of the Triple-Anchor framework. This work also presents the first Arabic LLM security dataset with a formal LLM-as-Judge annotation protocol.
Abdullah M. Abughallous, Somia Abufakher· IEEE Jordan Conference on Ap...· 0 citations
The assessment of jailbreak attacks against large language models currently suffers from inconsistent evaluation criteria and methods, leading to unreliable estimates of attack success rates. We propose JailMeter, an evidence-based evaluation framework designed to more faithfully measure jailbreak effectiveness. Inspired by the Information Bottleneck theory, JailMeter applies dual-feedback optimization to filter jailbreak noise from model responses while preserving content relevant to the original malicious question. This process produces concise evidence for a rigorous assessment under which an attack is validated only when the response captures the malicious intent and delivers a complete answer, thereby signaling a substantive bypass of model safety alignment. We evaluate JailMeter on JailMeter-Eva, a challenging benchmark containing 330 human-labeled, non-rejected jailbreak instances. JailMeter achieves an accuracy of 97.27%, substantially outperforming existing evaluation methods. To support large-scale evaluation, we further distill JailMeter into a small language model, JailMeter\textsubscript{SLM}, which maintains comparable reliability with significantly reduced computational costs. Code and dataset are available at https://github.com/Magi2B0y/JailMeter.
Qingjia Huang, Jingyu (Jack) Zhang, Jianguo Wu et al.· Annual Meeting of the Associ...· 0 citations
This work proposes an explanation-aware safety framework that augments binary harmfulness detection with structured, human-interpretable explanations capturing severity, strategies, trigger spans, ratio-nales, and derived safety factors, and introduces a human–LLM hybrid annotation and canonicaliza-tion pipeline.
Sunghee Dong, Sungwon Yi, Kangmin Bae et al.· 0 citations
This work proposes a novel jailbreak framework: YAE, which enhances the model's dependency on external information by constructing a RAG‐based knowledge base containing harmful Q&A content and leverages Guide MoE, a routing‐inspired prompting strategy, to guide the model toward alternative reasoning trajectories through expert‐role prompting and domain‐specific perturbations.
Locally deployed Large Language Models (LLMs) via inference engines such as Ollama run without the moderation and abuse detection present in API-served models. Therefore, the safety of LLMs depends on the defense mechanisms used, and their effectiveness depends on the assumptions on which they were designed. This paper does an audit of defense mechanisms under jailbreak attacks on locally deployed models. Some defenses provide formal guarantees (SmoothLLM, Erase-and-Check, Sequential Monitors), while others rely on empirical detection results (Semantic Smoothing, Self-Denoised Smoothing, Perplexity Filtering). Instead of merely observing that defenses fail, we trace each failure back to the specific assumption: for every defense, we extract the condition it relies on, derive the empirical pattern a violation should produce, and test that prediction on six open-weight models (14B to 35B parameters) with a corpus of 100 jailbreak prompts taken from more than 40 public sources, totalling 13,800 evaluation records.
Ensuring the safety of large language models (LLMs) requires rigorous evaluation against adversarial and jailbreaking attempts that can expose harmful behaviors. Malicious prompt generation, while inherently risky, is essential for systematically stress-testing model defenses and uncovering alignment vulnerabilities. Jailbreak attacks against large language models are often studied either through direct prompt rewriting or through search-based optimization over unconstrained prompt variants. We introduce TAPE-JB (Trait-Aligned Prompt Evolution for Jailbreaking LLMs), a genotype-guided evolutionary framework for adversarial prompt generation that searches over structured prompt traits while preserving the original harmful intention. Our method combines iterative prompt rewriting with an alignment-aware fitness function that jointly optimizes attack effectiveness, semantic faithfulness to the source intention, and realization of the intended prompt strategy. Across experiments, TAPE-JB consistently improves over simpler prompting baselines and outperforms CL-GSO on AdvBench, with a 14 percentage-point gain. Our results also show that the generated attacks retain cross-model transferability and that the proposed method remains effective in Polish (76% of attack success rate), demonstrating its applicability beyond the original English benchmark. These findings highlight the value of structured evolutionary search for systematic red-teaming of language models.
Karolina Seweryn, Anna Wróblewska, Szymon Łukasik· Proceedings of the Genetic a...· 0 citations