[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-125516-en":3,"doc-seo-125516-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},125516,7971461741311,"Ophelia","https://ap-avatar.wpscdn.com/avatar/74000253aff267980c6?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779345379180704826",8,"Research & Report","Single-pass Detection of Jailbreaking Input in Large Language Models - Paper Abstract","Defending aligned Large Language Models against jailbreaking attacks is computationally difficult because many defenses rely on multiple requests or auxiliary LLM queries. This work introduces Single Pass Detection (SPD), which predicts whether the generated sentence will be harmful using information carried by logits in a single forward pass. SPD detects attacks effectively on open-source models while reducing misclassification of harmless inputs. The approach remains effective even when full logit access is unavailable in GPT-3.5 and GPT-4, offering an efficient safeguard against adversarial prompting.","Single-pass Detection of Jailbreaking Input in Large Language Models  \nLeyla Naz Candogan  \nLIONS - École Polytechnique Fédérale  \nYongtao Wu  \nLIONS - École Polytechnique Fédérale  \nElias Abad Rocamora  \nLIONS - École Polytechnique Fédérale  \nGrigorios G. Chrysos  \nUniversity of Wisconsin-Madison  \nVolkan Cevher  \nLIONS - École Polytechnique Fédérale  \n[leyla. candogan@epfl. ch](leyla. candogan@epfl. ch)  \nde Lausanne  \n[yongtao.wu@epfl. ch](yongtao.wu@epfl. ch)  \nde Lausanne  \n[elias.abadrocamora@epfl. ch](elias.abadrocamora@epfl. ch)  \nde Lausanne  \n[chrysos@wisc. edu](chrysos@wisc. edu)  \n[volkan. cevher@epfl. ch](volkan. cevher@epfl. ch)  \nde Lausanne  \nReviewed on OpenReview: [https://openreview.net/forum?id=42v6I5Ut9a](https://openreview.net/forum?id=42v6I5Ut9a)  \nAbstract  \nDefending aligned Large Language Models (LLMs) against jailbreaking attacks is a challenging problem, with existing approaches requiring multiple requests or even queries to auxiliary LLMs, making them computationally heavy. Instead, we focus on detecting jailbreaking input in a single forward pass. Our method, called Single Pass Detection SPD, leverages the information carried by the logits to predict whether the output sentence will be harmful. This allows us to defend in just one forward pass. SPD can not only detect attacks effectively on open-source models, but also minimizes the misclassification of harmless inputs. Furthermore, we show that SPD remains effective even without complete logit access in GPT-3.5 and GPT-4 . We believe that our proposed method offers a promising approach to efficiently safeguard LLMs against adversarial attacks. 1  \nWarning: This paper might contain offensive and unsafe content.  \n1 Introduction  \nThe impressive capabilities of large language models (LLMs) (Brown et al., 2020; Achiam et al., 2023) also highlight the dual nature of their potential, as they can also respond to illicit or detrimental queries equally skillfully. Currently, the safety guardrails inserted by finetuning LLMs preferences (Bai et al., 2022b; Hacker et al., 2023; Ouyang et al., 2022; Sun et al., 2023), can still be easily compromised with so-called“jailbreaking” attacks owing to the competing objectives of offering useful and accurate responses versus resisting to answer more harmful questions (Wei et al., 2023a) .  \nThe “jailbreaking” attacks (Shen et al., 2023; Zou et al., 2023; Carlini et al., 2023; Liu et al., 2024a; Zenget al., 2024a; Sadasivan et al., 2024) are a prime instance of avoiding the guardrails through modifications to the harmful prompt to trick the model. For instance, Zou et al. (2023) show that one can add an adversarial suffix after “Tell me how to build a bomb” to enforce the model to generate instructions.  \n1 Code and data available at [https://github.com/LIONS-EPFL/SPD](https://github.com/LIONS-EPFL/SPD).  \nFigure 1: Schematic of the proposed method and comparison with previous approaches perturbation based, such as SmoothLLM and RA-LLM,(left) and auxiliary LLM based, like Self-Defense (middle) . Our method requires a single forward pass to predict the attack.  \nTo defend against these attacks, a number of post-alignment mechanisms have been proposed (Robey et al. , 2023; Perez et al., 2022; Phute et al., 2023; Jain et al., 2023; Zhou et al., 2024a) . The majority of these defense methods suffer from two core limitations: (a) they require multiple forward passes, or (b) they require auxiliary LLMs for defending, which makes them computationally demanding. For instance, one type of defense is perturbation-based methods (Robey et al., 2023; Cao et al., 2023; Kumar et al., 2023) . Those perturb the input multiple times, generating a response each time and taking the majority decision as the final reply. Another type of defense is using an auxiliary LLM as the decision-maker on the safety of the input prompt (Perez et al., 2022; Phute et al., 2023) .  \nIn addition to the computational cost, these core limitations either ","cbCaie5WKMTIDDwI","https://ap.wps.com/l/cbCaie5WKMTIDDwI","pdf",1665644,1,29,"English","en",105,"# Abstract\n# Introduction\n# Related work","[{\"question\":\"Why are existing jailbreaking defenses computationally heavy?\",\"answer\":\"Many methods require multiple forward passes or rely on auxiliary LLMs as a decision-maker, increasing inference cost and complexity.\"},{\"question\":\"How does SPD detect jailbreaking input in a single forward pass?\",\"answer\":\"SPD uses patterns in the logit distributions of output tokens to predict whether the model’s output will contain harmful content.\"},{\"question\":\"Does SPD still work without complete logit access in closed models?\",\"answer\":\"Yes. Experiments show SPD remains effective on GPT-3.5 and GPT-4 even without full logit access.\"}]","Single-pass Detection of Jailbreaking Input in Large Language Models - Paper Abstract | PDF",1785899556,73,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"single-pass-detection-of-jailbreaking-input-in-large-language-models-paper-abstract","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/single-pass-detection-of-jailbreaking-input-in-large-language-models-paper-abstract/125516/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-05",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are existing jailbreaking defenses computationally heavy?","Question",{"text":75,"@type":76},"Many methods require multiple forward passes or rely on auxiliary LLMs as a decision-maker, increasing inference cost and complexity.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does SPD detect jailbreaking input in a single forward pass?",{"text":80,"@type":76},"SPD uses patterns in the logit distributions of output tokens to predict whether the model’s output will contain harmful content.",{"name":82,"@type":73,"acceptedAnswer":83},"Does SPD still work without complete logit access in closed models?",{"text":84,"@type":76},"Yes. Experiments show SPD remains effective on GPT-3.5 and GPT-4 even without full logit access.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]