DELMAN : Dynamic Defense Against Large Language Model Jailbreaking with Model Editing (2025)

Abstract: Large Language Models (LLMs) are widely applied in decision making, but their deployment is threatened by jailbreak attacks, where adversarial users manipulate model behavior to bypass safety measures. Existing defense mechanisms, such as safety fine-tuning and model editing, either require extensive parameter modifications or lack precision, leading to performance degradation on general tasks, which is unsuitable to post-deployment safety alignment. To address these challenges, we propose DELMAN (**D**ynamic **E**diting for **L**L**M**s J**A**ilbreak Defe**N**se), a novel approach leveraging direct model editing for precise, dynamic protection against jailbreak attacks. DELMAN directly updates a minimal set of relevant parameters to neutralize harmful behaviors while preserving the model’s utility. To avoid triggering a safe response in benign context, we incorporate KL-divergence regularization to ensure the updated model remains consistent with the original model when processing benign queries. Experimental results demonstrate that DELMAN outperforms baseline methods in mitigating jailbreak attacks while preserving the model’s utility, and adapts seamlessly to new attack instances, providing a practical and efficient solution for post-deployment model protection.

## introduction large language models (llms) play a significant role in decision-making, underscoring the importance of aligning llms with safety standards and human values. to ensure that generated content aligns with human values and avoids harmful information, various safety alignment methods are employed throughout the model production pipeline, including pre-training by model providers, taskspecific adaptations by secondary developers, and deployment for user interactions (illustrated in the * w.wang is the corresponding author. considering that large-scale modifications to a model's architecture or parameters become impractical once deployed, and adversarial users represent only a minority, which making it infeasible to construct sufficient labeled datasets for fine-tuning, safety alignment in the deployment phase must meet three essential requirements: (1) minimal model modifications to ensure efficiency; (2) targeted defenses that address adversarial queries without compromising regular user interactions; a dynamic jailbreak defense mechanism is essential, one that is timely, precise, and minimal in required modifications to the deployed model while effectively countering adversarial attacks. to achieve this, our key motivation is to utilize direct editing that focuses on minimal parameter updates, minimizing interference with the model's overall performance. specifically, in this work, we in-figure 1 : upper: the three phases of safety alignment during llms production. lower: llms editing as a dynamic defense mechanism during the deployment stage. our contributions can be summarized as follows: ## methods the idea behind delman is to mitigate a model's harmful behavior by directly modifying the weights of specific layers, establishing a direct association between harmful tokens and safe responses. factual knowledge is stored in the mlp of specific layer l @xcite . the mlp acts as twolayer key-value memories where the neurons of the first layer w l gate generate a key k, with which the w l down retrieves an associated value v. the mlp layer can be expressed as: ## experiments we begin this section by detailing the configuration of our experiments, including evaluated datasets, jailbreak attacks, and models, along with compared baselines and evaluation metrics. then, we present the effectiveness of delman in terms of defense performance and utility preservation. next, we demonstrate the impact of single-behavior edit of delman, highlighting its transferability across datasets and harmful behaviors. last, we use a consecutive edit case study to illustrate that each edit, once applied, does not interfere with the edit established in previous phases. ## conclusion in this work, we introduce delman, a novel defense mechanism that directly edits model parameters to neutralize harmful behaviors by forming explicit connections. delman brings minimal parameter modification, preserving the utility on normal tasks and is capable of dynamic and consecutive edits. extensive experiments demonstrate superiority over existing baselines in terms of defense performance and utility preservation, as well as strong transferability. overall, delman demonstrates how token-level editing method can effectively enhance model safety while maintaining performance. in the future, it would be interesting to investigate more efficient methods for harmful token identification, for instane, using a minimal set of tokens (e.g., 20-30 tokens) to effectively cover the majority of harmful scenarios, which would significantly reduce computational costs. additionally, exploring the application of delman to domain-specific llms and vlms would validate its generalizability across different domains and modalities.