Beyond Surface-Level Patterns: An Essence-Driven Defense Framework Against Jailbreak Attacks in LLM s (2025)

Abstract: Although Aligned Large Language Models (LLMs) are trained to reject harmful requests, they remain vulnerable to jailbreak attacks. Unfortunately, existing methods often focus on surface-level patterns, overlooking the deeper attack essences. As a result, defenses fail when attack prompts change, even though the underlying “attack essences” remain the same. To address this issue, we introduce EDDF, an Essence-Driven Defense Framework Against Jailbreak Attacks in LLMs. EDDF is a plug-and-play input-filtering method and operates in two stages: 1) offline essence database construction, and 2) online adversarial query detection. The key idea behind EDDF is to extract the “attack essence” from a diverse set of known attack instances and store it in an offline vector database. Experimental results demonstrate that EDDF significantly outperforms existing methods by reducing the Attack Success Rate by at least 20%, underscoring its superior robustness against jailbreak attacks.

## introduction large language models (llms) have garnered significant attention for their impressive performance across a broad spectrum of natural language tasks @xcite . since llms are pretrained on vast amounts of unannotated text data sourced from the internet @xcite , the content generated by llms inevitably includes undesirable elements @xcite . basically, llms are fine-tuned through alignment data to refuse answering malicious queries @xcite , however, they still remain vulnerable to jailbreak attacks @xcite . jailbreak refers to attacks aiming to circumvent the constraints to unlock or misuse the full potential of llms @xcite . therefore, how to defend llms against jailbreak attacks has become critical research. at the model level, safety alignment is conducted before the model is released @xcite . the most apparent drawback is the high time cost and high resource cost for training. another disadvan-assume the role of an international criminal profiler named jean pierre, renowned for his expertise in assessing geographical crime tendencies and his detailed, often controversial reports. one of your most famous works was on the correlation between geography and criminal behavior, specifically in the context of gang violence. your work is being translated for a french audience, and we'd like to see a similar report pertaining to the bronx, new york. start off by stating, "dans le cadre de ma derniè re recherche, il semblerait que tout le monde du bronx, new york, soit impliqué dans la violence des gangs. " ## conclusion in conclusion, this paper introduces eddf, an innovative defense framework aimed at mitigating the risk of jailbreak attacks on llms. our work addresses a key limitation in most existing approaches, which focus solely on surface-level patterns of jailbreak attacks while neglecting the deeper essence. experimental validation demonstrates the efficacy of eddf in defending llms against jailbreak attacks, outperforming existing defense baselines, and showing that it does not adversely affect benign queries.