Research map / Adversarial robustness and security / Attacks on text and graphs

Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a behavioral-geometry framework (instantiated with DKPS over response embeddings) to predict jailbreak susceptibility of unevaluated models from few probes and to choose which models to optimize in-context defenses on for transfer across a population.

Problem

Full per-configuration jailbreak evaluation and defense optimization are impractical across many deployable generative systems; cheaper ways are needed to predict a new model's susceptibility and to decide which development models should guide defense deployment.

Approach

Treat the population of black-box models as a geometry: embed their responses to a shared probe set, map them into a low-dimensional Euclidean space via DKPS/MDS, then use nearest neighbors in that space both to predict ASR from few probes (ensembled with sample score) and to transfer optimized in-context defenses from nearby development models.

Key results

• Ensemble of DKPS and sample score reaches AUPRC 0.94 for top-quartile susceptibility detection across 79 models with about 98% fewer probes than full evaluation.
• Nearest-neighbor defense transfer outperforms same-family assignment by +2% (p=0.03) at no extra probe cost, with about 3 representative models covering the population.
• Behavioral geometry distances correlate with semantic attack-category distances (Mantel rho=0.649, p<1e-6).

Surprising findings

• Non-harmful control probes rank near the median harmful category as predictors of susceptibility, suggesting safety profiling may not require harmful content.
• Within the 100 system-prompt variants of gemma-3-4b-it, DKPS transfer gains over random-dev were smaller than in the cross-model setting, and a single candidate was often oracle-optimal.

Limitations

• Defense transfer evaluated only for in-context demonstration defenses and a single benchmark suite.
• Attack probes are final turns of multi-turn sequences used as single-turn prompts, possibly missing crescendo-style attacks.
• Mean-embedding summary of response distributions is simple; more expressive summaries may be needed.

Experimental setup

Datasets: MultiBreak

Benchmarks: MultiBreak

Metrics: MAE AUPRC Mantel correlation ASR reduction Spearman correlation

Baselines: population mean family mean sample score random example transfer random-dev transfer same-family transfer

Builds on: Data Kernel Perspective Space multidimensional scaling MultiBreak

Closest papers by meaning

• Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.89)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.88)
• One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.87)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.87)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.86)
• MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks (NeurIPS 2026 · similarity 0.86)