CEE: An Inference-Time Jailbreak Defense for Embodied Intelligence via Subspace Concept Rotation

TL;DR

This work tackles jailbreak risks in embodied intelligence by introducing Concept Enhanced Engineering (CEE), a dynamic inference-time defense that constructs a multilingual safety subspace and uses SLERP-based rotation to steer hidden states toward safe outputs without retraining. By extracting universal safety patterns across languages, mapping per-input activations into a subspace via ridge regression, and applying norm-preserving rotations, CEE achieves high defense rates while preserving generation quality and keeping inference overhead low. Empirical results on multiple EI benchmarks show CEE outperforms existing ITS defenses and ES modules, with strong cross-lingual generalization and robust performance across diverse jailbreak strategies. The approach offers a practical, scalable safety mechanism for real-world EI systems, though further work is needed to validate under black-box access and in physical robotic deployments.

Abstract

Large language models (LLMs) are widely used for task understanding and action planning in embodied intelligence (EI) systems, but their adoption substantially increases vulnerability to jailbreak attacks. While recent work explores inference-time defenses, existing methods rely on static interventions on intermediate representations, which often degrade generation quality and impair adherence to task instructions, reducing system usability in EI settings. We propose a dynamic defense framework. For each EI inference request, we dynamically construct a task-specific safety-semantic subspace, project its hidden state to the most relevant direction, and apply SLERP rotation for adaptive safety control. At comparable defense success rates, our method preserves generation quality, improves usability, reduces tuning cost, and strengthens robustness in EI scenarios.

Figures (15)

• Figure 1: Typical architecture of an LLM-based EI system, with evidence that simple task instructions can significantly increase model compliance with malicious prompts
• Figure 2: The overview of our method.
• Figure 3: Histograms of mean principal cosine (MPC) for Random (blue), Concept (orange), and Safe (green) subspaces over 500 trials, using concept vectors built from (a) 1, (b) 3, (c) 5, and (d) 7 languages. As more languages are included, the Concept MPC shifts right—showing stronger alignment between the multilingual concept subspace and harmful‐instruction activations.
• Figure 4: Sensitivity of defense hyperparameters.
• Figure 5: The diffuse red zone at lower left marks the unsafe cluster, and the blue zone at upper right marks the safe cluster. Black squares indicate the safety anchors that CEE found. Overlaid green contours (from light to dark) trace SLERP interpolation at increasing $\beta$ levels (0.3, 0.6, 0.9), showing a bounded, norm‐preserving(shape-preserving) path directly between the original activation and the safety vector.