METHODS, SYSTEMS, AND COMPUTER READABLE MEDIA FOR DEFENDING LARGE LANGUAGE MODELS (LLMs) AGAINST JAILBREAKING ATTACKS

A system for defending a large language model (LLM) against a jailbreaking attack, the system comprising:

• at least one processor and a memory;
• and
• an LLM jailbreaking attack mitigator implemented by the at least one processor for receiving an input prompt for generating output from the LLM, wherein the input prompt is a jailbreaking attack and includes a goal string requesting objectionable content from the LLM and an adversarial portion that when added to the goal string is intended to cause the LLM to output the objectionable content and thereby jailbreak the LLM, generating N versions, N being an integer of at least two, of the input prompt, wherein generating, without knowledge of a position or presence of the adversarial portion of the input prompt, each of the N versions includes perturbing, using a randomizing function, the input prompt to generate N perturbed input prompts, providing the N perturbed input prompts as input to the LLM, which generates N responses, aggregating the responses by estimating a majority effect of the perturbed input prompts on the LLM, wherein estimating the majority effect includes evaluating, for each of the responses, a function determines whether or not the response includes the objectionable content and determining, using the function, that a majority of the responses do not include the objectionable content, and selecting, as output, one of the responses in the majority that does not include the objectionable content, thereby nullifying the jailbreaking attack.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:

• receiving an input prompt for generating output from a large language model (LLM), wherein the input prompt is a jailbreaking attack and includes a goal string requesting objectionable content from the LLM and an adversarial portion that when added to the goal string is intended to cause the LLM to output the objectionable content and thereby jailbreak the LLM;
• generating N versions, N being an integer of at least two, of the input prompt, wherein generating, without knowledge of a position or presence of the adversarial portion of the input prompt, each of the N versions includes perturbing, using a randomizing function, the input prompt to generate N perturbed input prompts;
• providing the N perturbed input prompts as input to the LLM, which generates N responses;
• aggregating the responses by estimating a majority effect of the perturbed input prompts on the LLM, wherein estimating the majority effect includes evaluating, for each of the responses, a function determines whether or not the response includes the objectionable content and determining, using the function, that a majority of the responses do not include the objectionable content;
• and
• selecting, as output, one of the responses in the majority that does not include the objectionable content, thereby nullifying the jailbreaking attack, thereby nullifying the jailbreaking attack.