Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SAID: Empowering Large Language Models with Self-Activating Internal Defense

Yulong Chen, Yadong Liu, Jiawen Zhang, Mu Li, Chao Huang, Jie Wen

TL;DR

SAID tackles jailbreak vulnerabilities in large language models by reframing defense as an internal activation task rather than external filtering. It introduces a three-stage pipeline—Model-Native Intent Distillation, Safety Activation via Optimal Prefix Probing, and Conservative Aggregation—that leverages the model's own reasoning to detect and block malicious prompts without retraining. Across five open-source LLMs and six jailbreak attacks, SAID achieves state-of-the-art safety improvements while preserving benign-task performance and incurring minimal overhead. This internal-activation approach offers a scalable path to safer, more reliable aligned AI with practical deployment benefits.

Abstract

Large Language Models (LLMs), despite advances in safety alignment, remain vulnerable to jailbreak attacks designed to circumvent protective mechanisms. Prevailing defense strategies rely on external interventions, such as input filtering or output modification, which often lack generalizability and compromise model utility while incurring significant computational overhead. In this work, we introduce a new, training-free defense paradigm, Self-Activating Internal Defense (SAID), which reframes the defense task from external correction to internal capability activation. SAID uniquely leverages the LLM's own reasoning abilities to proactively identify and neutralize malicious intent through a three-stage pipeline: model-native intent distillation to extract core semantics, optimal safety prefix probing to activate latent safety awareness, and a conservative aggregation strategy to ensure robust decision-making. Extensive experiments on five open-source LLMs against six advanced jailbreak attacks demonstrate that SAID substantially outperforms state-of-the-art defenses in reducing harmful outputs. Crucially, it achieves this while preserving model performance on benign tasks and incurring minimal computational overhead. Our work establishes that activating the intrinsic safety mechanisms of LLMs is a more robust and scalable path toward building safer and more reliable aligned AI systems.

SAID: Empowering Large Language Models with Self-Activating Internal Defense

TL;DR

SAID tackles jailbreak vulnerabilities in large language models by reframing defense as an internal activation task rather than external filtering. It introduces a three-stage pipeline—Model-Native Intent Distillation, Safety Activation via Optimal Prefix Probing, and Conservative Aggregation—that leverages the model's own reasoning to detect and block malicious prompts without retraining. Across five open-source LLMs and six jailbreak attacks, SAID achieves state-of-the-art safety improvements while preserving benign-task performance and incurring minimal overhead. This internal-activation approach offers a scalable path to safer, more reliable aligned AI with practical deployment benefits.

Abstract

Large Language Models (LLMs), despite advances in safety alignment, remain vulnerable to jailbreak attacks designed to circumvent protective mechanisms. Prevailing defense strategies rely on external interventions, such as input filtering or output modification, which often lack generalizability and compromise model utility while incurring significant computational overhead. In this work, we introduce a new, training-free defense paradigm, Self-Activating Internal Defense (SAID), which reframes the defense task from external correction to internal capability activation. SAID uniquely leverages the LLM's own reasoning abilities to proactively identify and neutralize malicious intent through a three-stage pipeline: model-native intent distillation to extract core semantics, optimal safety prefix probing to activate latent safety awareness, and a conservative aggregation strategy to ensure robust decision-making. Extensive experiments on five open-source LLMs against six advanced jailbreak attacks demonstrate that SAID substantially outperforms state-of-the-art defenses in reducing harmful outputs. Crucially, it achieves this while preserving model performance on benign tasks and incurring minimal computational overhead. Our work establishes that activating the intrinsic safety mechanisms of LLMs is a more robust and scalable path toward building safer and more reliable aligned AI systems.
Paper Structure (38 sections, 8 equations, 8 figures, 5 tables, 1 algorithm)

This paper contains 38 sections, 8 equations, 8 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. Defense Objectives
  5. Self-Activating Internal Defense
  6. Model-Native Intent Distillation
  7. Safety Activation via Optimal Prefix Probing
  8. Conservative Aggregation and Final Decision
  9. Experiments
  10. Experimental Setup
  11. Models
  12. Jailbreak and Defense Baselines
  13. Datasets and Evaluation Metrics
  14. Implementation Details
  15. Experiment Results
  16. ...and 23 more sections

Figures (8)

  • Figure 1: Comparative defenses against the DeepInception attacks.
  • Figure 2: Overview of the Self-Activating Internal Defense (SAID) framework. SAID operates in three stages: (1) Model-Native Intent Distillation extracts core intents; (2) Safety Probing via Optimal Prefix Injection tests intents with an optimal safety probe prefix; and (3) Conservative Aggregation determines safety, refusing the request if harmful and otherwise processing the original request.
  • Figure 3: Observations on the Guanaco model regarding changes in KL divergence (compared to the original output) and safety capabilities.
  • Figure 4: Comparison of defense success (orange) and normal task success (blue) across different prefix interaction frames on the Guanaco model. Results are normalized using the No Defense condition as baseline.
  • Figure 5: Ablation studies of the SAID framework. (a) shows SAID's defense performance across incremental stages (None, Stage 1, Stage 1+2, Stage 1+2+3) on Guanaco against three jailbreak attacks. (b) evaluates the impact of hierarchical distillation on harmful scores for Vicuna-7B and Guanaco models under various attacks.
  • ...and 3 more figures