AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks

AlcaTRAz proposes a prompt-level rule tree defense method that prevents jailbreak attacks on large language models without modifying the model. This method relies solely on the input text to automatically learn transferable conversion rules to insert character-level perturbations, disrupting the structural patterns exploited by attackers while maintaining the model’s effectiveness on benign queries. The study compared AlcaTRAz with three baseline methods, including Llama Guard and RA-LLM, on 33 open-source models, 22 types of jailbreak attacks, and short single-round benign problem benchmarks. Results showed that AlcaTRAz achieved the best overall security and functionality score in 73.4% of model-attack combinations; the response mode for malicious requests decreased from 10 to 2 (close to rejection), while the average score for benign problems remained at 8.35 (the undefended benchmark was 8.62). Although this method significantly reduced the success rate of jailbreak attempts, high-severity attacks still existed and adaptive attackers were not considered, so it should be viewed as an additional layer in a layered defense strategy rather than an independent guarantee.