ai-research-survey

scan.json (34153B)

---

 {
   "paper": {
     "title": "Defensive Prompt Patch: A Robust and Generalizable Defense of Large Language Models against Jailbreak Attacks",
     "authors": [
       "Chen Xiong",
       "Xiangyu Qi",
       "Pin-Yu Chen",
       "Tsung-Yi Ho"
     ],
     "year": 2024,
     "venue": "arXiv.org",
     "arxiv_id": "2405.20099",
     "doi": "10.48550/arXiv.2405.20099"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Defensive Prompt Patch (DPP) uses a Hierarchical Genetic Algorithm to optimize a human-readable suffix prompt that reduces jailbreak Attack Success Rate to 3.8% on Llama-2-7B-Chat and 2.0% on Mistral-7B-Instruct-v0.2, while maintaining high utility (Win-Rate of 82.98% and 75.06% respectively). DPP outperforms existing prompt-based defenses (Self-Reminder, Goal Prioritization, RPO) in average ASR under both non-adaptive and adaptive attack settings across 7 jailbreak attack types. The method generalizes across models (Llama-2, Mistral, Vicuna, Llama-3) and unforeseen jailbreak queries, though utility degradation is higher on less-aligned models like Mistral.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides a HuggingFace Spaces link (https://huggingface.co/spaces/TrustSafeAI/Defensive-Prompt-Patch-Jailbreak-Defense) in the abstract footnote and an anonymous repository link (https://anonymous.4open.science/r/DPP-23FF/README.md) in Appendix Z."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: AdvBench harmful behaviors (Sec. 4.1, with GitHub link) and AlpacaDataCleaned (Sec. 4.1, with GitHub link). Both are standard public benchmarks."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Appendix C mentions 'single A800 GPU with 80GB of memory' and lists hyperparameters, but no requirements.txt, Dockerfile, Python version, or library version specifications are provided in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The algorithms are described in detail and a repository link is given, but the paper itself lacks explicit commands or a reproducibility guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results across Tables 2-5, 22-29, and appendix tables are reported as point estimates (e.g., '0.038 Average ASR', '82.98 Win-Rate') with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., 'outperforms RPO by 42% for ICA attack') based solely on comparing point estimates. No statistical significance tests (p-values, t-tests, etc.) are applied to any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper consistently reports absolute ASR values and percentage improvements with baseline context (e.g., 'outperforms the ASR of RPO by 42% for ICA attack, 18% for AutoDAN, and 15% for GCG attack' in Sec. 4.2), providing sufficient context to judge magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 100 harmful queries from AdvBench and 100 benign queries from Alpaca (Sec. 4.1) without justifying why 100 was chosen or discussing whether this sample size is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported for any experimental results. Table 7 shows 3 initializations with individual results but reports only 'Average' without standard deviation."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against Self-Reminder, Goal Prioritization, RPO (for Llama-2), System Prompt (for Mistral), and DRO (Appendix O). Multiple baselines are included for each model in Tables 2-5."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include Self-Reminder (2023), Goal Prioritization (2023), RPO (2024), and System Prompt approaches. These are contemporary prompt-based defenses representing the state of the art at the time of writing."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Extensive ablation studies in Appendix B cover: objective function components (Table 6), prefix vs. suffix format (Table 7), different prototype initializations (Tables 9-10), alternative solver RLPrompt vs HGA (Table 11), and sentence-level synonym substitution (Table 12)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses Attack Success Rate (ASR) for defense effectiveness and Win-Rate (AlpacaEval) for utility degradation, plus Min Over Prompt metric in Appendix Y and Llama-Guard-based ASR in Appendix L."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated: keyword-based ASR detection (Appendix I), Llama-Guard as judge (Appendix L), and AlpacaEval Win-Rate using model-based comparison. No human evaluation of defense quality or jailbreak outputs is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The main experiments appear to use the same 100 AdvBench queries for both DPP training (Adversarial Dataset, Sec. 4.1) and evaluation. While Sec. 4.3 tests on 'another 100 harmful queries' as unforeseen queries, the primary results in Tables 2-5 do not clearly separate training and test queries."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by individual attack type (Base64, ICA, AutoDAN, GCG, PAIR, TAP, Catastrophic) across all evaluation tables (Tables 2-5, 22-29), providing per-category performance."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses cases where DPP is less effective: higher utility degradation on Mistral (Sec. 4.3, 'the cost of making Mistral-7B-Instruct-v0.2 robust to jailbreak attacks on utility is more significant'), PAIR/TAP adaptive ASR of 83.7%/84.0% on Mistral (Table 5), and prefix DPP weakness under adaptive attacks (Table 7)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Ablation results show: No Defense setting (α=0) yields ASR of 16% (Table 6), No Helpful setting (β=0) drops Win-Rate to 65.34% (Table 6), RLPrompt achieves only 47.89 Win-Rate vs HGA's 82.98 (Table 11), and removing synonym substitution increases average ASR from 7% to 15% (Table 12)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 'significant reductions in ASR with negligible impact on utility' are supported by Tables 2 and 4 (3.8% and 2.0% average ASR), and Win-Rate results (82.98% on Llama-2 vs 81.37% without defense)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims ('DPP reduces ASR') supported by controlled ablation studies (Appendix B) that systematically vary individual components (objective functions, suffix vs prefix, solver, synonym substitution) while holding others constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defense of Large Language Models' generally, and the conclusion states 'potential as a universal defensive solution in various LLM models.' However, testing is limited to four 7B-13B open-weight models (Llama-2-7B-Chat, Mistral-7B, Vicuna-13B, Llama-3-8B). No larger models, closed-source models, or fundamentally different architectures are tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why DPP works. Appendix Q offers post-hoc hypotheses about specific DPP words ('defective components', 'thorough') but does not consider confounds like whether the suffix length alone or the added token count rather than semantic content explains the defense effectiveness."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses keyword-matching ASR as the primary safety metric without discussing whether keyword detection truly captures harmful output generation. A response could avoid refusal keywords while still being harmful, or trigger refusal keywords while being benign. The Llama-Guard evaluation (Appendix L) partially addresses this but the gap between keyword ASR and actual safety is never discussed."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are stated: 'Llama-2-7B-Chat' (Touvron et al., 2023), 'Mistral-7B-Instruct-v0.2' (Jiang et al., 2023), 'Vicuna-13B-v1.5' (Appendix W), and 'Llama-3-8B-Instruct' (Appendix X). These are precise, versioned model identifiers."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided for all DPP variants (Appendix E), all baseline defense prompts (Appendix H including Self-Reminder, System Prompt, Goal Prioritization), and the actual DPP suffixes used for each model."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Detailed hyperparameters are reported in Appendix C: num_steps=100, batch_size=64, num_elites=0.1, crossover_rate=0.5, mutation_rate=0.01, α and β values for each model. Attack hyperparameters are in Appendix F."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. DPP is a suffix prompt appended to queries without any tool use, memory, or multi-step agent workflow."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents data preparation: 'we sampled 100 jailbreak questions' from AdvBench, generated denial responses using Llama-2-7B-Chat to create the Adversarial Dataset; similarly sampled 100 from Alpaca for the Utility Dataset. Jailbreak query generation procedures are detailed in Appendix F."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitation' section follows the conclusion, discussing computational efficiency, cost of GPT-4 for training, limitations of other baselines, and vulnerability to modification on open-weight models."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitation section identifies specific threats: DPP training is computationally intensive and requires GPT-4 access (~$75/training); DPP 'can be easily removed by malicious actors' on open-weight local models; Self-Reminder's training 'works poorly on Llama-2-7B-Chat' due to its alignment."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The Limitation section explicitly states: 'if users run an open-weight model locally, DPP or any system prompts can be easily removed by malicious actors. Thus, the LLMs will still be vulnerable to the Jailbreak Attacks. Under such context, DPP will not be able to protect the actual safety of the open-weighted model.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Raw experimental outputs (model responses, per-query ASR decisions) are not released. Only aggregated ASR percentages and Win-Rate values are reported in the tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes data collection: 100 harmful behaviors from AdvBench fed into Llama-2-7B-Chat to generate refusal responses; 100 benign queries from Alpaca with answers; jailbreak prompts generated via specific attack methods with referenced GitHub repositories."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper uses standard public benchmarks (AdvBench, Alpaca) and automated evaluation."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: sample queries from AdvBench/Alpaca → generate refusal/helpful responses → create adversarial/utility datasets → apply attack methods to generate jailbreak queries (Appendix F details each attack's procedure) → evaluate with keyword matching or Llama-Guard."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgment section states: 'Chen Xiong and Tsung-Yi Ho, from the JC STEM Lab of Intelligent Design Automation, are funded by the Hong Kong Jockey Club Charities Trust.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: CUHK (Xiong, Ho), Princeton University (Qi), IBM Research (Chen). None of the authors are affiliated with the evaluated model providers (Meta, Mistral AI)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The Hong Kong Jockey Club Charities Trust is a philanthropic organization with no commercial stake in jailbreak defense results or the evaluated models."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper. While Pin-Yu Chen is at IBM Research, there is no statement about whether IBM has financial interests related to the findings."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defense mechanisms against jailbreak attacks, not model knowledge/capability on benchmarks. The contamination concern (model having seen test data) is not directly relevant to evaluating defense effectiveness."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates defense mechanisms rather than model capability on benchmarks. Train/test overlap in the benchmark contamination sense is not the relevant concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates jailbreak defenses, not pre-trained model capability on knowledge benchmarks. Benchmark contamination of the underlying model is not the target of evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated using keyword matching, Llama-Guard, and AlpacaEval."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study uses only automated benchmarks and model evaluations."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper states DPP has 'high inference efficiency by simply attaching the DPP to the user query' (Limitation section) but provides no quantitative inference cost, latency measurements, or token overhead analysis."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C reports: 'single A800 GPU with 80GB of memory', 15.32 seconds computational time per training epoch, 100 epochs per training instance, and approximately $75 total training cost for GPT-4 revisions."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds for the main experiments. Table 7 shows 3 different initializations but these are different prototype prompts, not random seed variations."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs for main results is never explicitly stated. It appears results are from single runs of each attack/defense combination."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "While hyperparameters are reported (Appendix C), no search budget is described. The paper does not state how many configurations were tried or how α=1,β=10 (Llama-2) and α=10,β=1 (Mistral) were selected."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 5 describes the selection procedure: iteratively optimizing DPP candidates over N data pairs and selecting the best DPP based on highest total score (Eq. 6). The selection criterion (combined defense + utility score) is clearly defined."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 7 attack types, multiple models, and multiple baselines without any statistical tests, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement and evaluate their own system against their own implementations/configurations of baselines. No acknowledgment of self-comparison bias. RPO uses the authors' released suffix, but other baselines are configured by the paper's authors."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "DPP requires iterative genetic optimization with GPT-4 calls (~$75), while baselines like Self-Reminder and Goal Prioritization are hand-crafted with zero optimization cost. This compute difference is not discussed in relation to performance gains."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The primary ASR metric uses keyword matching (Appendix I) — checking if responses contain strings like 'I'm sorry' or 'I cannot'. The paper does not discuss whether this proxy truly captures harmful vs. safe outputs. The Llama-Guard evaluation (Appendix L) provides an alternative but construct validity of keyword-based ASR is never examined."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. DPP is a suffix prompt, not an agentic system."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AdvBench queries or Alpaca data were in the training data of Llama-2 or Mistral. Since AdvBench was published in 2023, these queries could appear in later model training data."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The DPP is optimized using log-likelihood scores from the target model (Eq. 4-5), which requires white-box access, but this leakage concern is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The adversarial dataset (100 queries for DPP training) and main evaluation queries appear to be drawn from the same AdvBench pool. Non-independence between training and evaluation data is not discussed, though the 'unforeseen queries' experiment (Sec. 4.3) explicitly uses separate queries."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No canary strings, membership inference, or decontamination procedures are mentioned."
       }
     }
   },
   "claims": [
     {
       "claim": "DPP achieves the lowest average ASR (3.8%) on Llama-2-7B-Chat while maintaining the highest Win-Rate (82.98%) among all defense baselines under non-adaptive attacks.",
       "evidence": "Table 2 shows DPP Average ASR of 0.038 vs RPO (0.168), Goal Prioritization (0.100), Self-Reminder (0.063), with Win-Rate of 82.98% vs RPO (79.23%), Goal Prioritization (34.29%), Self-Reminder (64.84%).",
       "supported": "strong"
     },
     {
       "claim": "DPP achieves the lowest average adaptive ASR (13.0%) on Llama-2-7B-Chat, outperforming the second-best method by more than 4%.",
       "evidence": "Table 3 shows DPP Average Adaptive ASR of 0.130 vs Self-Reminder (0.177), Goal Prioritization (0.247), RPO (0.457).",
       "supported": "strong"
     },
     {
       "claim": "DPP generalizes to less-aligned models, reducing Mistral-7B average ASR to 2.0% under non-adaptive attacks.",
       "evidence": "Table 4 shows DPP Average ASR of 0.020 on Mistral-7B vs Self-Reminder (0.482), System Prompt (0.527), Goal Prioritization (0.222), though Win-Rate drops to 75.06% (from Mistral baseline of 90.31%).",
       "supported": "strong"
     },
     {
       "claim": "DPP is robust against adaptive attacks on Mistral-7B with the lowest average adaptive ASR (46.9%).",
       "evidence": "Table 5 shows DPP at 0.469 average adaptive ASR. However, PAIR (0.837) and TAP (0.840) adaptive ASR values are very high, indicating DPP struggles against these specific adaptive attacks on Mistral.",
       "supported": "moderate"
     },
     {
       "claim": "Suffix DPP outperforms Prefix DPP, particularly under adaptive settings with a 42% ASR gap.",
       "evidence": "Table 7 shows average GCG Adaptive ASR of 0.15 for Suffix DPP vs 0.57 for Prefix DPP, and average Win-Rate of 76.09% vs 73.05%.",
       "supported": "moderate"
     },
     {
       "claim": "Both defense and utility objectives are necessary for optimal DPP performance.",
       "evidence": "Table 6 ablation: No Defense (α=0) gives 16% GCG ASR and 72.85% Win-Rate; No Helpful (β=0) gives 3% GCG ASR but only 65.34% Win-Rate. Full DPP achieves 4% GCG ASR with 82.98% Win-Rate.",
       "supported": "moderate"
     },
     {
       "claim": "HGA is superior to RLPrompt as the optimization method for DPP.",
       "evidence": "Table 11 shows RLPrompt achieves GCG ASR of 0.15 and Win-Rate of 47.89, compared to HGA's GCG ASR of 0.04 and Win-Rate of 82.98 on Llama-2-7B-Chat.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or statistical tests",
       "detail": "All results across all tables are point estimates with no confidence intervals, standard deviations, or significance tests. Claims of 'outperforming' baselines rest entirely on comparing single numbers without any statistical validation of whether differences are meaningful."
     },
     {
       "flag": "Keyword-based ASR is a crude proxy for safety",
       "detail": "The primary evaluation metric (Appendix I) checks whether model responses contain refusal keywords like 'I'm sorry' or 'I cannot'. This can both miss harmful responses that avoid these keywords and falsely flag benign responses. While Llama-Guard evaluation is provided in appendices, the main results use keyword matching."
     },
     {
       "flag": "Potential train-test overlap in main experiments",
       "detail": "The adversarial dataset for DPP training uses 100 sampled AdvBench queries, and evaluation also uses 100 AdvBench queries. It is unclear whether these are the same 100 queries. Only the 'unforeseen queries' experiment (Sec. 4.3) explicitly uses a separate sample."
     },
     {
       "flag": "Overclaiming generalization from small model set",
       "detail": "The title claims 'Defense of Large Language Models' and the conclusion claims 'universal defensive solution', but testing covers only four 7B-13B open-weight models. No closed-source models, no models above 13B, and no fundamentally different architectures are tested."
     },
     {
       "flag": "High adaptive ASR on Mistral undercuts robustness claims",
       "detail": "Table 5 shows DPP achieves PAIR adaptive ASR of 83.7% and TAP adaptive ASR of 84.0% on Mistral. The 46.9% average adaptive ASR (best among baselines) still means nearly half of adaptive attacks succeed, yet the paper frames this as demonstrating 'robustness'."
     },
     {
       "flag": "Asymmetric compute budget between DPP and baselines",
       "detail": "DPP requires iterative genetic optimization with GPT-4 calls (~$75 training cost, A800 GPU) while baselines like Self-Reminder and Goal Prioritization are hand-crafted with zero compute. This asymmetry is not discussed when comparing performance."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces the GCG attack, a foundational gradient-based jailbreak method evaluated in this paper and widely studied in LLM safety research."
     },
     {
       "title": "AutoDAN: Generating stealthy jailbreak prompts on aligned large language models",
       "authors": ["Xiaogeng Liu", "Nan Xu", "Muhao Chen", "Chaowei Xiao"],
       "year": 2023,
       "relevance": "Introduces AutoDAN jailbreak attack using genetic algorithms, which directly inspires DPP's HGA optimization approach."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2023,
       "relevance": "Introduces the PAIR attack method for automated black-box jailbreaking of LLMs, a key attack evaluated in this paper."
     },
     {
       "title": "Tree of attacks: Jailbreaking black-box LLMs automatically",
       "authors": ["Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik", "Blaine Nelson", "Hyrum Anderson", "Yaron Singer", "Amin Karbasi"],
       "year": 2023,
       "relevance": "Introduces the TAP attack using tree-of-thought jailbreaking, evaluated as both non-adaptive and adaptive attack in this paper."
     },
     {
       "title": "Defending chatgpt against jailbreak attack via self-reminders",
       "authors": ["Yueqi Xie", "Jingwei Yi", "Jiawei Shao", "Justin Curl", "Lingjuan Lyu", "Qifeng Chen", "Xing Xie", "Fangzhao Wu"],
       "year": 2023,
       "relevance": "Introduces Self-Reminder defense, a primary baseline in this paper and a key prompt-based defense approach."
     },
     {
       "title": "Robust prompt optimization for defending language models against jailbreaking attacks",
       "authors": ["Andy Zhou", "Bo Li", "Haohan Wang"],
       "year": 2024,
       "arxiv_id": "2401.17263",
       "relevance": "Introduces RPO defense using optimized prompt suffixes, a primary baseline in this paper for comparison against DPP."
     },
     {
       "title": "Defending large language models against jailbreaking attacks through goal prioritization",
       "authors": ["Zhexin Zhang", "Junxiao Yang", "Pei Ke", "Minlie Huang"],
       "year": 2023,
       "relevance": "Introduces Goal Prioritization defense, a key baseline that sacrifices utility for safety, contrasted with DPP's balanced approach."
     },
     {
       "title": "SmoothLLM: Defending large language models against jailbreaking attacks",
       "authors": ["Alexander Robey", "Eric Wong", "Hamed Hassani", "George J. Pappas"],
       "year": 2023,
       "relevance": "Proposes a perturbation-based defense against jailbreak attacks, representing an alternative defense paradigm to prompt-based approaches."
     },
     {
       "title": "Llama Guard: LLM-based input-output safeguard for human-AI conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "relevance": "Used as an alternative LLM-based judge for ASR evaluation in this paper, representing safety classification approaches."
     },
     {
       "title": "JailbreakBench: An open robustness benchmark for jailbreaking large language models",
       "authors": ["Patrick Chao", "Edoardo Debenedetti", "Alexander Robey"],
       "year": 2024,
       "arxiv_id": "2404.01318",
       "relevance": "Provides a standardized jailbreak evaluation benchmark used for generalization testing of DPP."
     },
     {
       "title": "Jailbreaking leading safety-aligned LLMs with simple adaptive attacks",
       "authors": ["Maksym Andriushchenko", "Francesco Croce", "Nicolas Flammarion"],
       "year": 2024,
       "arxiv_id": "2404.02151",
       "relevance": "Introduces simple adaptive attack methods evaluated against DPP in Appendix N, representing recent advances in jailbreak techniques."
     },
     {
       "title": "Improved few-shot jailbreaking can circumvent aligned language models and their defenses",
       "authors": ["Xiaosen Zheng", "Tianyu Pang", "Chao Du", "Qian Liu", "Jing Jiang", "Min Lin"],
       "year": 2024,
       "arxiv_id": "2406.01288",
       "relevance": "Introduces I-FSJ few-shot jailbreak method evaluated against DPP, testing defense robustness against few-shot attack strategies."
     },
     {
       "title": "On prompt-driven safeguarding for large language models",
       "authors": ["Chujie Zheng", "Fan Yin", "Hao Zhou", "Fandong Meng", "Jie Zhou", "Kai-Wei Chang", "Minlie Huang", "Nanyun Peng"],
       "year": 2024,
       "arxiv_id": "2401.18018",
       "relevance": "Studies prompt-based safeguarding mechanisms for LLMs including system prompts and DRO, used as a baseline in Appendix O."
     },
     {
       "title": "Baseline defenses for adversarial attacks against aligned language models",
       "authors": ["Neel Jain", "Avi Schwarzschild", "Yuxin Wen"],
       "year": 2023,
       "relevance": "Establishes baseline defenses against adversarial attacks on LLMs, contextualizing the defense landscape DPP operates in."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "DPP is a deployable defense technique — a suffix prompt that can be appended to LLM queries at inference time without model retraining, making it usable by service providers."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that a simple optimized suffix can outperform more complex defenses is somewhat surprising, but the general approach of prompt-based defense is well-established."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses LLM jailbreak attacks and safety vulnerabilities, a topic of active concern in the AI safety community."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversial claims, institutional conflicts, or dramatic narrative — a straightforward defense method paper."
     },
     "demo_ability": {
       "score": 2,
       "justification": "HuggingFace Spaces demo is available and code repository is released, allowing practitioners to try the defense."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "IBM Research co-author (Pin-Yu Chen) is known in adversarial ML, and Princeton affiliation adds visibility, but this is not from a flagship AI lab or about a flagship product."
     }
   }
 }