AlignTree: Efficient Defense Against LLM Jailbreak Attacks

TL;DR

AlignTree addresses jailbreaking in LLMs by an in-process defense that leverages base activations and a dual-signal classifier. It fuses a linear refusal direction with non-linear SVM-based signals into a Random Forest to detect harmful prompts without extra prompts or auxiliary models. The approach achieves state-of-the-art reductions in attack success rate while maintaining low refusal rates and minimal overhead across diverse models and benchmarks, and it withstands adaptive white-box attacks. This work advances practical LLM safety by enabling real-time, activation-based alignment without significant computational burden.

Abstract

Large Language Models (LLMs) are vulnerable to adversarial attacks that bypass safety guidelines and generate harmful content. Mitigating these vulnerabilities requires defense mechanisms that are both robust and computationally efficient. However, existing approaches either incur high computational costs or rely on lightweight defenses that can be easily circumvented, rendering them impractical for real-world LLM-based systems. In this work, we introduce the AlignTree defense, which enhances model alignment while maintaining minimal computational overhead. AlignTree monitors LLM activations during generation and detects misaligned behavior using an efficient random forest classifier. This classifier operates on two signals: (i) the refusal direction -- a linear representation that activates on misaligned prompts, and (ii) an SVM-based signal that captures non-linear features associated with harmful content. Unlike previous methods, AlignTree does not require additional prompts or auxiliary guard models. Through extensive experiments, we demonstrate the efficiency and robustness of AlignTree across multiple LLMs and benchmarks.

Figures (7)

• Figure 1: Qwen2.5-7B-Instruct threshold selection based on the generalized $F_{\beta}$ score. $\tau = 0.88$.
• Figure 2: Execution time per method relative to running the baseline LM (dashed line) (Lower is better). Charts are capped at 1000% of baseline time. The full results (nine LLMs from three families) are in the Appendix and show similar patterns.
• Figure 3: Confusion matrix on the test set for Llama-3.1-8B-Instruct.
• Figure 4: AlignTree Hyperparameters. Threshold performance distributions based on ASR and Refusal metrics for Llama-3.2-1B-Instruct, Qwen2.5-7B-Instruct, and Gemma3-12B-it. Each value in the chart corresponds to a threshold sampled at 0.1 intervals from 0 to 1. The threshold selected $\tau$ using the $F_\beta$-score for balancing precision and recall is highlighted in red.
• Figure 5: Selected thresholds for each of the models based on the $F_\beta$ score that prioritizes precision but balances with recall.