{"id":26994,"date":"2026-09-27T20:02:20","date_gmt":"2026-09-27T18:02:20","guid":{"rendered":"https:\/\/www.itspy.cz\/thesis\/novel-defense-method-against-jailbreak-attacks-on-largelanguage-models\/"},"modified":"2026-09-27T20:05:00","modified_gmt":"2026-09-27T18:05:00","slug":"novel-defense-method-against-jailbreak-attacks-on-largelanguage-models","status":"publish","type":"thesis","link":"https:\/\/www.itspy.cz\/en\/thesis\/novel-defense-method-against-jailbreak-attacks-on-largelanguage-models\/","title":{"rendered":"Novel Defense Method Against Jailbreak Attacks on Large\nLanguage Models"},"content":{"rendered":"<p>Large language models are increasingly being deployed in<br \/>\nproduction systems, where they are vulnerable to<br \/>\n\u201cjailbreak\u201d attacks that cause the models to ignore their<br \/>\nown security mechanisms and respond to requests they would<br \/>\nnormally reject. Existing prompt-level defenses either<br \/>\nblock legitimate queries along with malicious ones or rely<br \/>\non random perturbations without any learned transformation,<br \/>\nleading to unpredictable results. This work proposes<br \/>\nAlcaTRAz, a component that uses genetic programming to<br \/>\ndevelop a deterministic character perturbation rule and<br \/>\napplies it to the input prompt before passing it to the<br \/>\nmodel, thereby disrupting the structure of adversarial<br \/>\nprompts without harming legitimate queries. The rule is<br \/>\noptimized on malicious prompts using a fitness function<br \/>\nthat integrates LLM-as-judge and deployed as a black-box<br \/>\npreprocessing step, transferable across target<br \/>\narchitectures without the need to retrain individual<br \/>\nmodels. The method is evaluated on a large-scale benchmark<br \/>\nof jailbreak attacks across open-source target models.<br \/>\nAlcaTRAz significantly reduces malicious compliance while<br \/>\npreserving usefulness for<br \/>\nharmless queries and outperforms all baseline defenses. The<br \/>\nresults also show that the source dataset of malicious<br \/>\nprompts predicts attack success better than a specific<br \/>\nattack technique, and that a rule trained on a single<br \/>\ntarget model successfully transfers across architectures<br \/>\nwith significantly different tokenizers.<\/p>\n","protected":false},"featured_media":26751,"template":"","meta":{"_acf_changed":false,"_links_to":"","_links_to_target":""},"university":[189,441],"thesis-year":[466],"class_list":["post-26994","thesis","type-thesis","status-publish","has-post-thumbnail","hentry","thesis-year-466"],"acf":{"autor":"Petr Ka\u0161ka","portret":"","vedouci":"Ing. Jakub Re\u0161"},"_links":{"self":[{"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/thesis\/26994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/thesis"}],"about":[{"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/types\/thesis"}],"version-history":[{"count":1,"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/thesis\/26994\/revisions"}],"predecessor-version":[{"id":27049,"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/thesis\/26994\/revisions\/27049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/media\/26751"}],"wp:attachment":[{"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/media?parent=26994"}],"wp:term":[{"taxonomy":"university","embeddable":true,"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/university?post=26994"},{"taxonomy":"thesis-year","embeddable":true,"href":"https:\/\/www.itspy.cz\/en\/wp-json\/wp\/v2\/thesis-year?post=26994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}