Sentinel cuts large language model jailbreaks by spotting hidden intent
Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
Artificial IntelligenceCryptography and Security
Summary
Large language models can be tricked by cleverly hidden prompts that make them produce harmful content. The authors propose SENTINEL, a defense method that watches how the model's responses match parts of the input to detect bad intentions. By looking for where the output aligns with harmful parts of the input, SENTINEL decides when to stop the model from generating unsafe text. Their tests show SENTINEL effectively blocks most jailbreaks while avoiding unnecessary refusals.
What this means in practice
- •For ai platform operators: Improve safety by integrating SENTINEL to detect and stop harmful outputs from large language models before completion.
- •For content moderation teams: Use SENTINEL’s intent extraction to better identify malicious or harmful prompt attempts for more effective filtering in user-generated content.
Authors
Luoyu Chen, Weiqi Wang, Chenhan Zhang, Zhiyi Tian, Shui Yu
Abstract
Large language models (LLMs) remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle protection and excessive over-refusal. We propose SENTINEL, a plug-and-play, generation-time jailbreak defense that reframes mitigation as an intent extraction problem. Our key insight is that instruction-tuned LLMs exhibit strong input--output semantic consistency: regardless of jailbreak complexity, generated outputs tend to align with the attacker's true intent. SENTINEL exploits this property by matching semantically aligned input--output regions to extract intention-revealing subsequences, scores these subsequences using refusal-direction projections to estimate harmfulness, and halts generation when necessary. Experiments on HarmBench across multiple LLMs show that SENTINEL reduces jailbreak success rates to close to 5\% while maintaining low over-refusal. We further demonstrate robustness to adaptive attacks and provide a mechanistic interpretation: SENTINEL re-distributes jailbreak features from alignment blind spots to aligned regions.