Combining defenses improves language model safety against jailbreak attacks
CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation
Cryptography and SecurityComputation and Language
Summary
Some people try to trick large language models (LLMs) into giving harmful or unintended answers, called jailbreak attacks. Defenses exist that work by changing the input or blocking bad outputs, but it’s not clear which work best or how to combine them. The authors studied 15 defenses and 19 attacks together under consistent conditions to figure this out. They found that no single defense stops all attacks, but using multiple defenses in a careful way can make models much safer without making them less useful.
What this means in practice
- •For ai safety engineers: Design layered defense strategies to reduce jailbreak attack success in deployed language models by combining multiple defenses effectively.
- •For software security teams: Implement consistent evaluation frameworks to benchmark and improve protections against adversarial prompt attacks on AI services.
Authors
Jiale Luo, Eric Han
Abstract
Defenses against jailbreak attacks on Large Language Models (LLMs) operate at different pipeline stages, such as input modification or output guard, but it remains unclear which defenses to deploy at each stage and how to combine them. Prior empirical studies, fragmented by inconsistent attack-success-rate definitions and experimental settings, have evaluated defenses largely in isolation. Here we present the first systematic study, to our knowledge, of defense combinations both within and across pipeline stages, under a consistent threat model of direct, black-box, single-turn attacks. Our decision framework standardizes evaluation through a principled attack-success-rate formulation with controlled query budgets, together with explicit fairness rules. Across 19 attacks and 15 defenses, we find that no single defense is universally best, but well-chosen combinations achieve substantial safety with minimal utility degradation, yielding practical recommendations for layered defense pipelines.