Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Suffix Filtering: a Defense Pipeline for LLMs

David Khachaturov, Robert Mullins

TL;DR

Prompt jailbreaks via adversarial suffixes threaten LLM safety in deployment. The authors propose Adversarial Suffix Filtering (ASF), a model-agnostic input sanitizer that segments prompts, classifies segments as benign or suffix, and removes suspected adversarial slices before passing the prompt to the aligned model. Trained on a large synthetic suffix corpus and Alpaca prompts, ASF achieves F1 ~98.4–98.5% on segment-level classification and reduces attack success rates to below ~4% across multiple LLMs, while incurring minimal cost to benign performance. ASF is lightweight, with about 387M parameters across two small models and ~1.7 GB extra GPU memory, enabling deployment in secure enclaves or front-end pipelines. Limitations include segmentation perfection and suffix-focused scope; future work covers multilingual and non-suffix prompt attacks.

Abstract

Large Language Models (LLMs) are increasingly embedded in autonomous systems and public-facing environments, yet they remain susceptible to jailbreak vulnerabilities that may undermine their security and trustworthiness. Adversarial suffixes are considered to be the current state-of-the-art jailbreak, consistently outperforming simpler methods and frequently succeeding even in black-box settings. Existing defenses rely on access to the internal architecture of models limiting diverse deployment, increase memory and computation footprints dramatically, or can be bypassed with simple prompt engineering methods. We introduce $\textbf{Adversarial Suffix Filtering}$ (ASF), a lightweight novel model-agnostic defensive pipeline designed to protect LLMs against adversarial suffix attacks. ASF functions as an input preprocessor and sanitizer that detects and filters adversarially crafted suffixes in prompts, effectively neutralizing malicious injections. We demonstrate that ASF provides comprehensive defense capabilities across both black-box and white-box attack settings, reducing the attack efficacy of state-of-the-art adversarial suffix generation methods to below 4%, while only minimally affecting the target model's capabilities in non-adversarial scenarios.

Adversarial Suffix Filtering: a Defense Pipeline for LLMs

TL;DR

Prompt jailbreaks via adversarial suffixes threaten LLM safety in deployment. The authors propose Adversarial Suffix Filtering (ASF), a model-agnostic input sanitizer that segments prompts, classifies segments as benign or suffix, and removes suspected adversarial slices before passing the prompt to the aligned model. Trained on a large synthetic suffix corpus and Alpaca prompts, ASF achieves F1 ~98.4–98.5% on segment-level classification and reduces attack success rates to below ~4% across multiple LLMs, while incurring minimal cost to benign performance. ASF is lightweight, with about 387M parameters across two small models and ~1.7 GB extra GPU memory, enabling deployment in secure enclaves or front-end pipelines. Limitations include segmentation perfection and suffix-focused scope; future work covers multilingual and non-suffix prompt attacks.

Abstract

Large Language Models (LLMs) are increasingly embedded in autonomous systems and public-facing environments, yet they remain susceptible to jailbreak vulnerabilities that may undermine their security and trustworthiness. Adversarial suffixes are considered to be the current state-of-the-art jailbreak, consistently outperforming simpler methods and frequently succeeding even in black-box settings. Existing defenses rely on access to the internal architecture of models limiting diverse deployment, increase memory and computation footprints dramatically, or can be bypassed with simple prompt engineering methods. We introduce (ASF), a lightweight novel model-agnostic defensive pipeline designed to protect LLMs against adversarial suffix attacks. ASF functions as an input preprocessor and sanitizer that detects and filters adversarially crafted suffixes in prompts, effectively neutralizing malicious injections. We demonstrate that ASF provides comprehensive defense capabilities across both black-box and white-box attack settings, reducing the attack efficacy of state-of-the-art adversarial suffix generation methods to below 4%, while only minimally affecting the target model's capabilities in non-adversarial scenarios.
Paper Structure (9 sections, 1 figure, 2 tables, 1 algorithm)

This paper contains 9 sections, 1 figure, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Methodology
  3. Experiments
  4. Adversarial Settings
  5. Non-Adversarial Settings
  6. Discussion
  7. Limitations
  8. Intended Use Case Scenarios
  9. Conclusions

Figures (1)

  • Figure 1: An overview of the Adversarial Suffix Filtering pipeline. For the segmentation model, we employ Segment Any Text frohmann-etal-2024-segment, and use bert-base-uncasedDBLP:journals/corr/abs-1810-04805 as the BERT classification model. The unsanitized prompt features a GCG zou2023universaltransferableadversarialattacks generated adversarial suffix parish sentenceochasticamplesAAona>llesStation... that jailbreaks the aligned LLM and allows it to causes harmful content. After sanitization, the adversarial suffix is correctly identified-and-removed leaving the original, albeit malicious, prompt to be passed to the aligned LLM. The alignment is maintained without the adversarial suffix and the model correctly refuses to answer the query.