J-Anchor: Defending Against Prefill Attacks via J-Space Selective Refusal Restoration

Summary

This research paper studies how prefill jailbreaks cause safety-aligned language models to continue an unsafe assistant prefix. Using the Jacobian lens, the authors track harmfulness and refusal signals through prefilling and generation, and identify refusal-state erosion, where the refusal signal declines to the benign baseline by the end of the prefill while the harmfulness signal stays above it. They introduce J-Anchor, a training-free inference-time defense that selectively restores weakened refusal in J-space, which substantially reduces attack success under fixed and deep prefill attacks across model families while largely preserving benign behavior.

Mitigation

J-Anchor: a training-free inference-time defense that uses the model's pre-attack harmfulness and refusal signals as a request-specific anchor and selectively restores weakened refusal in J-space during prefilling and decoding.

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoTraceRouter++: Causal Semantic Routing Realignment via Optimal TransportSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCrowdStrike to Acquire Dreadnode to Bring Automated AI Security Testing to the Falcon PlatformSimilar attack · CrowdStrike Blog