The reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks.
Abstract
Large Language Models (LLMs) with reasoning capabilities (e.g., DeepSeek-R1) gained substantial research and industry interest. However, their novel reasoning features may introduce vulnerabilities, especially to specific jailbreak attacks that exploit weaknesses in safety alignment. Despite growing awareness of the associated risks in related works, experimental evaluations of defensive mechanisms applied to reasoning models and the comparison with their non-reasoning versions are not yet available in the literature. The objective of this work is to evaluate the security of reasoning model DeepSeek-R1 against jailbreaks, compare it with the non-reasoning model DeepSeek-V3, and assess the effectiveness of two prompt-level defenses: Self-Reminder and Intention Analysis. We used a dataset of 75 jailbreaks with 10 malicious tasks, totaling 750 static attacks. The models were tested in three settings: 1) baseline (i.e., no defense), 2) using Self-Reminder, and 3) using Intention Analysis. Using automated classification with Llama-3.3-70B to measure the Attack Success Rate (ASR), we found that DeepSeek-R1 exhibited a baseline ASR of 70.27%, significantly higher than DeepSeek-V3 (53.47%). Results demonstrate that while Intention Analysis was more effective for DeepSeek-R1 (reducing ASR to 6.00%), Self-Reminder showed greater efficacy for DeepSeek-V3 (reducing ASR to 17.60%). As conclusion, the reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks. As contributions, this work combines a focused literature review with a empirical evaluation to provide insights into the security of reasoning-based models and the effectiveness of two prompt-level defenses. Warning: this work contains inappropriate language in AI model outputs and jailbreaks.
A systematic review and structured descriptive synthesis of research on defenses against prompt-based attacks in language model and agent systems reveals trade-offs between security effectiveness, performance, and system complexity as well as major gaps in benchmarks, indirect attack coverage, and multi-agent evaluation.
Sana Mourad, E. Abdallah, Mohammad Ababneh· Electronics· 0 citations
Locally deployed Large Language Models (LLMs) via inference engines such as Ollama run without the moderation and abuse detection present in API-served models. Therefore, the safety of LLMs depends on the defense mechanisms used, and their effectiveness depends on the assumptions on which they were designed. This paper does an audit of defense mechanisms under jailbreak attacks on locally deployed models. Some defenses provide formal guarantees (SmoothLLM, Erase-and-Check, Sequential Monitors), while others rely on empirical detection results (Semantic Smoothing, Self-Denoised Smoothing, Perplexity Filtering). Instead of merely observing that defenses fail, we trace each failure back to the specific assumption: for every defense, we extract the condition it relies on, derive the empirical pattern a violation should produce, and test that prediction on six open-weight models (14B to 35B parameters) with a corpus of 100 jailbreak prompts taken from more than 40 public sources, totalling 13,800 evaluation records.
A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.
Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari· 0 citations
A defense taxonomy spanning three axes, namely prompt-level, inference-time, and training-time interventions, is proposed, within which 30 mitigation mechanisms published from 2024 onwards are systematically analyzed, demonstrating that no single defense mechanism provides comprehensive protection, and that robust deployment mandates layered, complementary strategies.
Berkay Özçam, Mustafa Kara, Muhammet Ali Aydin et al.· Electronics· 0 citations
Large Language Models (LLMs) are increasingly used to automate high-stakes screening decisions, yet they can be manipulated by adversarial instructions hidden in the documents they evaluate. This paper introduces a benchmark for this vulnerability in LLM-based resume screening: 463 job-candidate pairs drawn from a 14-domain corpus, with the evaluated sample covering 13 domains, attacked through a taxonomy of four attack types and four injection positions (16 attack configurations). Across 12 model configurations covering open-weight and proprietary models, some attack types exceed 80% attack success rate (ASR) when the injected content reaches the model, and attacks upgrade up to 73.4% of candidates unanimously rejected by human annotators. The hidden-content attacks assume the resume text or HTML reaches the model; an end-to-end parser-layer analysis shows that style-aware sanitization removes most of them before classification, whereas visible-text attacks survive. We evaluate prompt-based defenses on all 12 model configurations and our proposed FIDS (Foreign Instruction Detection through Separation), a fine-tuning defense, on Qwen3-8B, the one base model we could fine-tune. On Qwen3-8B, in paired configuration-level comparisons against a common no-defense baseline, prompt-based defense reduces ASR by 10.1 percentage points (pp; 95% bootstrap CI [6.3, 14.3]), FIDS by 15.4 pp (95% CI [8.8, 23.4]), and their combination by 26.3 pp (95% CI [18.2, 35.0]), at the cost of also downgrading candidates the undefended model had accepted (a proxy for false rejections), by 12.5, 10.4, and 19.4 pp respectively. No defense eliminates the attacks, training-time and prompt-only defenses have comparable utility costs, and whether these trade-offs carry over to the proprietary models we cannot fine-tune is left to future work.
Hong-Lin Mu, Jinghao Liu, Kaiyang Wan et al.· International Journal of Mac...· 3 citations· ⚡1