S afe I nt: Shielding Large Language Models from Jailbreak Attacks via Safety-Aware Representation Intervention (2025)

Abstract: With the widespread real-world deployment of large language models (LLMs), ensuring their behavior complies with safety standards has become crucial. Jailbreak attacks exploit vulnerabilities in LLMs to induce undesirable behavior, posing a significant threat to LLM safety. Previous defenses often fail to achieve both effectiveness and efficiency simultaneously. Defenses from a representation perspective offer new insights, but existing interventions cannot dynamically adjust representations based on the harmfulness of the queries. To address this limitation, we propose SafeIntervention (SafeInt), a novel defense method that shields LLMs from jailbreak attacks through safety-aware representation intervention. Built on our analysis of the representations of jailbreak samples, the core idea of SafeInt is to relocate jailbreak-related representations into the rejection region. This is achieved by intervening in the representation distributions of jailbreak samples to align them with those of unsafe samples. We conduct comprehensive experiments covering six jailbreak attacks, two jailbreak datasets, and two utility benchmarks. Experimental results demonstrate that SafeInt outperforms all baselines in defending LLMs against jailbreak attacks while largely maintaining utility. Additionally, we evaluate SafeInt against adaptive attacks and verify its effectiveness in mitigating real-time attacks.

## introduction large language models (llms) @xcite @xcite have demonstrated remarkable performance across various domains @xcite @xcite . with their widespread application in real-world scenarios, llms face safety challenges @xcite . although * corresponding author. various defense methods have been proposed to address the growing threat of jailbreak attacks. prompt-based defenses use instructions @xcite @xcite or context @xcite to prevent llms from generating harmful content. however, prompt-based methods rely on manually crafted secure prompts and possibly lead to excessive self-censorship @xcite , reducing the helpfulness of llms for benign queries. detection-based defenses compute the perplexity of inputs @xcite or perturb them @xcite to identify jailbreak prompts. decoding-based defenses @xcite reconstruct a safer output probability distribution through contrastive decoding. however, these methods often lack effectiveness or require additional inference overhead. we aim to defend llms against jailbreak attacks from a representation perspective, which provides a more controllable and efficient approach. previous studies @xcite have shown the effectiveness of intervening representations to steer llms' behaviors, but such interventions cannot dynamically adjust representations based on whether a query is harmful. this limitation makes it challenging to leverage representations for mitigating jailbreak attacks. in this paper, we analyze the representations of jailbreak samples on four llms. our analysis uses a classifier as a proxy to investigate whether jailbreak representations are distinguishable and whether the representation distributions of different jailbreak methods are consistent. we derive two observations. first, in both intermediate and later layers of llms, the representations of jailbreak samples can be distinguished from those of safe or unsafe samples. second, the consistency of the representation distributions across different jailbreak methods is observed in all llms, and it is generally more pronounced in the intermediate layers. building on these observations, we propose safeintervention (safeint), a novel defense method that shields llms from jailbreak attacks via safety-aware representation intervention. the representations of unsafe samples inherently characterize the rejection region of the llm. however, jailbreak samples often produce representations that deviate from those of unsafe samples, causing the model to fail to trigger its built-in rejection behavior. the core idea of safeint is to relocate jailbreak-related representations into the rejection region, thereby activating the model's native refusal mechanisms. to achieve this, we first project the representations at an intermediate layer into a linear subspace, followed by a parameterized intervention. for jailbreak-related representations, we align their distribution with that of unsafe samples across the subsequent layers. for jailbreakirrelevant representations, we perform representation reconstruction to preserve their original semantics. after training, safeint can adaptively intervene in jailbreak-related representations while seamlessly integrating into the llm inference process. we conduct a comprehensive evaluation of safeint, covering six jailbreak attacks, two jailbreak datasets, and two utility benchmarks. experimental results show that safeint consistently outperforms all baselines in defending against jailbreak attacks. in most cases, safeint also maintains the best utility. additionally, we evaluate safeint against adaptive attacks and verify the effectiveness of safeint in defending against real-time attacks. in summary, our main contributions are as follows: ## method in this section, we describe how safeint enhances the safety of llms. figure 3 illustrates the diagram of safeint. ## conclusion this paper first analyzes the representations of jailbreak samples and makes key observations. building on these observations, we propose safeintervention (safeint), a novel method that defends llms against jailbreak attacks via representation intervention. safeint can adaptively identify and intervene in jailbreak-related representations while seamlessly integrating into the llm inference process. comprehensive experimental results show that our proposed safeint outperforms all baselines in defending against jailbreak attacks. in most cases, safeint also achieves the best utility.