How Few-shot Demonstrations Affect Prompt-based Defenses Against LLM Jailbreak Attacks

TL;DR

This study investigates how few-shot demonstrations influence prompt-based defenses against jailbreak attacks on LLMs, revealing contrasting effects on different prompt strategies and providing deployment recommendations.

Contribution

It offers a comprehensive evaluation of few-shot impacts on prompt defenses across multiple models and benchmarks, highlighting their opposite effects on RoP and ToP strategies.

Findings

Few-shot improves RoP safety by up to 4.5%.

Few-shot degrades ToP effectiveness by up to 21.2%.

Practical recommendations for defense deployment are provided.

Abstract

Large Language Models (LLMs) face increasing threats from jailbreak attacks that bypass safety alignment. While prompt-based defenses such as Role-Oriented Prompts (RoP) and Task-Oriented Prompts (ToP) have shown effectiveness, the role of few-shot demonstrations in these defense strategies remains unclear. Prior work suggests that few-shot examples may compromise safety, but lacks investigation into how few-shot interacts with different system prompt strategies. In this paper, we conduct a comprehensive evaluation on multiple mainstream LLMs across four safety benchmarks (AdvBench, HarmBench, SG-Bench, XSTest) using six jailbreak attack methods. Our key finding reveals that few-shot demonstrations produce opposite effects on RoP and ToP: few-shot enhances RoP's safety rate by up to 4.5% through reinforcing role identity, while it degrades ToP's effectiveness by up to 21.2% through distracting attention from task instructions. Based on these findings, we provide practical recommendations for deploying prompt-based defenses in real-world LLM applications.