Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models
Yongcan Yu, Yanbo Wang, Ran He, Jian Liang

TL;DR
This paper introduces Test-time Immunization (TIM), a universal, adaptive defense framework that detects and mitigates various jailbreak attacks on large language models, including multimodal variants, during inference.
Contribution
The paper proposes TIM, a novel self-evolving defense framework that effectively counters diverse jailbreak strategies in LLMs and multimodal models, surpassing existing tailored defenses.
Findings
TIM effectively detects jailbreak activities during inference.
TIM reduces jailbreak success rates across multiple models.
TIM maintains model performance while enhancing security.
Abstract
While (multimodal) large language models (LLMs) have attracted widespread attention due to their exceptional capabilities, they remain vulnerable to jailbreak attacks. Various defense methods are proposed to defend against jailbreak attacks, however, they are often tailored to specific types of jailbreak attacks, limiting their effectiveness against diverse adversarial strategies. For instance, rephrasing-based defenses are effective against text adversarial jailbreaks but fail to counteract image-based attacks. To overcome these limitations, we propose a universal defense framework, termed Test-time IMmunization (TIM), which can adaptively defend against various jailbreak attacks in a self-evolving way. Specifically, TIM initially trains a gist token for efficient detection, which it subsequently applies to detect jailbreak activities during inference. When jailbreak attempts are…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Topic Modeling · Domain Adaptation and Few-Shot Learning
MethodsSoftmax · Attention Is All You Need
