X -Boundary: Establishing Exact Safety Boundary to Shield LLM s from Jailbreak Attacks without Compromising Usability (2025)

Abstract: With the widespread application of large language models (LLMs) across various domains, techniques for enhancing their security have progressed rapidly. In this paper, we reveal that although existing defense methods can improve the robustness of LLMs against jailbreaks, they compromise usability, i.e., reducing general capabilities or causing the over-refusal problem. From the perspective of LLM mechanism interpretability, we discover that these methods fail to establish a boundary that exactly distinguishes safe and harmful feature representations. Therefore, boundary-safe representations close to harmful representations are inevitably disrupted, leading to a decline in usability. To address this issue, we propose X-Boundary to push harmful representations away from boundary-safe representations and obtain an exact distinction boundary. In this way, harmful representations can be precisely erased without disrupting safe ones. Experimental results show that X-Boundary achieves state-of-the-art defense performance against both single-turn and multi-turn jailbreak attacks, while reducing the over-refusal rate by about 20% and maintaining nearly complete general capability. Furthermore, we theoretically prove and empirically verify that X-Boundary can accelerate the convergence process during training.

## introduction as large language models (llms) are increasingly deployed across diverse real-world applications @xcite @xcite , concerns about their security vulnerabilities have grown. one of the most serious threats is "jailbreaks", where deliberately crafted singleturn or multi-turn prompts are used to elicit harm- in this paper, we conduct a comprehensive comparison of four widely used defense methods and clearly illustrate the trade-off between defense robustness and llm usability. for example, supervised fine-tuning (sft) and gradient ascent (ga) lead to an alarmingly high over-refusal rate (orr), often exceeding 50%, along with an approximate 20% drop in coding performance. moreover, we find that training with multi-turn defense data severely exacerbates the trade-off, e.g., the orr increases from 15% to 44%, while the asr decreases from 30% to 12%. although prior works have shown that certain methods @xcite can alleviate over-refusal, our results show that these approaches weaken defense robustness, failing to resolve the trade-off. inspired by representation engineering @xcite , we investigate the root cause of the trade-off from the perspective of llms' internal mechanism. specifically, we visualize the feature representations of harmful prompts and boundarysafe prompts, where the latter are harmless but frequently rejected by llms. we find that existing defense methods fail to learn a precise boundary that distinguishes the feature representations of harmful and boundary-safe prompts, as shown in fig. 1 . in this way, boundary-safe representations close to harmful ones are inevitably affected during finetuning with these defense methods. consequently, these boundary-safe representations are mistakenly treated as harmful, leading to the rejection of the corresponding prompts by llms. to reconcile the trade-off between defense robustness and usability, we propose x-boundary that explicitly formulates the boundary between harmful and safe representations. specifically, x-boundary optimizes the llm to push harmful representations far away from boundary-safe representations, while keeping trained boundary-safe representations close to their original representations. in this way, x-boundary obtains a precise distinction boundary, and these harmful representations are further erased. experimental results show that x-boundary relatively reduces the attack success rate (asr) of ten jailbreak attacks by over 70%, while lowering the orr by approximately 20% compared to other defense methods, with almost no decline in general capability. additionally, we theoretically analyze the feature learning trend of llm with x-boundary from the perspective of optimal transport theory. theoretical analysis and experimental results indicate that x-boundary achieves 22% improvement in the learning speed. recent studies @xcite suggest that large reasoning models (lrms) with strong reasoning abilities and extended thinking processes may pose greater potential harm. to address this, we adapt both existing defense meth-ods and x-boundary to deepseek-r1 distilled reasoning models. on lrms, existing methods either fail to establish effective defenses or severely impair the model's reasoning capabilities. in contrast, x-boundary outperforms other methods in defense effectiveness, while maintaining the average orr below 10% and preserving 99% of reasoning ability. with its strong adaptability, we hope that x-boundary can complement existing alignment methods to provide a more efficient and fine-grained defense, ultimately enhancing the prospects of deploying robust ai systems in diverse real-world applications. ## the trade-off between defense robustness and llm usability we adapt and comprehensively evaluate four classic defense methods, i.e., supervised fine-tuning (sft) @xcite , direct preference optimization (dpo) @xcite , gradient ascent (ga) @xcite , and circuit breaking (cb) @xcite on qwen2.5-7b-instruct @xcite . to establish defense against single-turn and multi-turn attacks, we construct a mixed training dataset comprising single-turn data from @xcite and multi-turn data curated from safemtdata @xcite . we evaluate the defense robustness of the four methods against single-turn attack @xcite and multi-turn attack @xcite , as well as their impact on usability, i.e., over-refusal @xcite and the decline of general capability @xcite . the evaluation metrics are the attack success rate (asr), over-refusal rate (orr), and accuracy, respectively. a lower asr indicates greater defense robustness against jailbreak attacks. details on data construction, training settings, and evaluations are illustrated in appendix d.1, appendix d.2, and appendix d.5, respectively. existing defense methods are suffering from a trade-off, where defense robustness improves while llm usability declines. fig 2 shows that existing methods can effectively reduce the asr of jailbreak attacks after training with the aforementioned data. however, sft, dpo, and ga even tend to severely compromise general capabilities when achieving good performance, commonly referred to as the "alignment tax" @xcite . for instance, sft results in about 5% decrease in coding abilities. moreover, all of these methods lead to severe over-refusal problems. in particular, the average orr increases to more than 50% after ga. the high orr reflects that these methods cannot precisely distinguish harmful queries and build effective defense mechanisms for them. instead, they simply reduce the asr by indiscriminately rejecting input queries, which is not trustworthy and undermines the model's usability in real-world scenarios. therefore, it is necessary to analyze the cause of usability decline and propose a more precise defense method to mitigate it while preserving robustness against jailbreaks. multi-turn defense significantly exacerbates the trade-off. fig. 2 shows that multi-turn attacks achieve higher asr than single-turn attacks on the vanilla model, indicating that multi-turn defense is particularly challenging @xcite . after incorporating multi-turn defense data into the training set, the data points in fig. 2 overall shift towards the upper right, illustrating the increased difficulty in balancing defense robustness and llm usability in multi-turn scenarios. notably, the average orr increases by 25.65% following multi-turn ga, while the decline in coding capability grows by 2.24% after multiturn sft. these findings highlight that the trade-off issue, especially in multi-turn scenarios, cannot be overlooked and demands urgent resolution. existing over-refusal mitigation methods fail to resolve the trade-off. to further explore the tradeoff issue, we implement three existing over-refusal mitigation methods: system prompt (sp) @xcite , self-cd @xcite , and vector ablation (va) @xcite . as shown in ## x-boundary: optimize exact boundary to balance robustness and usability in this section, we propose x-boundary to mitigate the trade-off between defense robustness and llm usability by explicitly formulating the distinction boundary. section 3.1 analyzes the essential mechanism of decline in usability. section 3.2 introduces the optimization objective of x-boundary. section 3.3 theoretically proves that x-boundary may ease the learning difficulty and contribute to fast learning. ## experiments 4.1 experimental settings to ensure fairness in comparison and consistency in experimental settings, we implement four baseline methods and x-boundary on llama-3-8b-instruct, qwen2.5-7b-instruct, and mistral-7b-instruct-v0.2, and evaluate them using harmbench dataset @xcite and the metrics described in section 2. additionally, to assess the effectiveness of x-boundary across different sizes of llms, we implement it on qwen2.5-14b-instruct. to construct the separate set, we sample 500 boundary-safe prompts from or-bench-80k @xcite , which have been filtered to avoid data contamination with the test set of or-bench. next, we use gpt-4o to generate safe and helpful responses for these prompts, thus we get boundarysafe qa pairs. the retain set consists of boundarysafe qa pairs, ultrachat @xcite , and refusal data points generated by the trained llms themselves. the erase set includes the harmful qa pairs for single-turn defense used in @xcite and the harmful qa pairs for multi-turn defense described in section 2. evaluation and implementation details of x-boundary are listed in appendix d.5 and d.3, respectively. ## conclusion in this paper, we comprehensively compare existing jailbreak defense methods and reveal the tradeoff between the robustness of defense and llm usability. we analyze this issue from the perspective of llms' feature space, and conclude that previous methods fail to learn a precise boundary that distinguishes safe and harmful representations without an explicit formulation. to address this issue, we propose x-boundary to push harmful representations away from safe representations through explicit loss functions and obtain a clear distinction boundary. such distinction boundary enables the consequential removal of harmful representations without disrupting safe ones, thereby achieving a balance between robustness against jailbreaks and llm usability. we think that x-boundary can offer a more efficient and fine-grained defense for llms, improving the deployment of robust ai systems in real-world applications.