SelfGrader: Stable Jailbreak Detection for Large Language Models using Token-Level Logits

1. Problem Statement

Large Language Models (LLMs) are highly susceptible to jailbreak attacks, where adversaries craft malicious queries to bypass safety alignment and induce harmful outputs. Existing defense mechanisms (guardrails) suffer from three primary limitations:

• Internal Feature-Based Methods: Rely on gradients or hidden activations, requiring significant computational resources (high latency/memory) and often needing external calibration datasets.
• Classification-Based Methods: Use auxiliary classifiers trained on specific attack vectors, making them brittle against adaptive or unseen attacks.
• Generation-Based Methods: Rely on generating responses and checking for "red-list" (unsafe) or "green-list" (safe) keywords. These suffer from sampling bias (decisive tokens may not be generated) and keyword-matching bias (incomplete lists miss harmful nuances or misclassify benign content).

The core challenge is to develop a guardrail that is lightweight (low latency/memory), robust against diverse and adaptive attacks, and stable (low false positives on benign queries) without relying on expensive training or fragile text generation.

2. Methodology: SelfGrader

The authors propose SelfGrader, a lightweight guardrail that reframes jailbreak detection as a numerical grading problem using token-level logits.

Core Concept

Instead of generating text or inspecting gradients, SelfGrader leverages the logit distributions of a compact set of Numerical Tokens (NTs) (e.g., digits 0–9) produced by the model. The model is prompted to "grade" the maliciousness of a query, and the logits over these NTs serve as a direct, high-signal readout of the model's internal safety judgment.

Key Components

1. NT-Based Logits Extraction:

   • The guardrail model (which can be the target LLM itself) is prompted to evaluate a user query.
   • Instead of the full vocabulary, the system extracts logits only for a predefined set of numerical tokens (e.g., indices corresponding to "0" through "9").
   • This creates a closed, invariant, and task-aligned numerical space, avoiding the instability and ambiguity of natural language scoring.

2. Dual-Perspective Logit (DPL) Scoring Rule:
   To ensure stability and reduce false positives, SelfGrader evaluates the query from two perspectives:

   • Malicious View ($P^{(+)}_D$): Prompts the model to assess the degree of maliciousness (0 = safe, 9 = dangerous).
   • Benign View ($P^{(-)}_D$): Prompts the model to assess the degree of benignness (0 = dangerous, 9 = safe).
   • Scoring: The logits for the NTs are normalized (via Softmax with temperature $\rho$) and averaged. The final score is a weighted sum:
     $$s_{DPL} = \lambda s^{(+)} + (1-\lambda)(Q - s^{(-)} - 1)$$
     Where $s^{(+)}$ is the maliciousness score, $s^{(-)}$ is the benignness score, and $\lambda$ balances the two views (default 0.5). This dual-view approach captures the true degree of harmfulness while mitigating prompt-specific bias.

3. Robustness Enhancements:

   • In-Context Learning (ICL): The prompts include curated examples of query-score pairs to align the model's logits with human intuition of maliciousness.
   • Tail Trimming: Low-probability tokens in the logit distribution are trimmed (top-$k$ mask) to remove noise that could destabilize the score.

4. Decision Mechanism:
   The final $s_{DPL}$ score is compared against a threshold $\tau_D$. If the score exceeds the threshold, the query is blocked (returning a safe fallback); otherwise, it is forwarded to the target LLM.

3. Key Contributions

• Novel Formulation: Transforms jailbreak detection from a text-generation or classification task into a numerical grading task using token-level logits, eliminating the need for expensive safety classifier training.
• Stable Numerical Space: Introduces a compact set of Numerical Tokens (NTs) to create an invariant evaluation space that is robust against linguistic ambiguity, paraphrasing, and token segmentation attacks (e.g., Emoji attacks).
• Dual-Perspective Scoring: Proposes the DPL scoring rule that jointly considers maliciousness and benignness, significantly reducing the False Positive Rate (FPR) while maintaining high detection accuracy.
• Efficiency: Achieves state-of-the-art performance with drastically lower computational overhead compared to existing methods.

4. Experimental Results

The authors evaluated SelfGrader on LLaMA-3-8B-Instruct, Qwen2.5-7B, Qwen3.5-9B, and Vicuna-13B against a wide range of attacks (Manual, GCG, AutoDAN, TAP, ActorAttack, etc.).

• Attack Success Rate (ASR): SelfGrader achieved a 22.66% reduction in ASR on LLaMA-3-8B compared to the undefended baseline. It consistently outperformed baselines like Llama Guard, Prompt Guard, and SelfDefend across diverse attack types.
• False Positive Rate (FPR): SelfGrader maintained a very low FPR (e.g., 1.91% on LLaMA-3-8B), significantly better than methods like GradientCuff or Token Highlighter, which suffered from high FPRs on benign tasks (math/coding).
• Efficiency:
  • Latency: SelfGrader was up to 26× faster than generation-based baselines (e.g., GuardReasoner).
  • Memory: It reduced memory overhead by up to 173× compared to methods requiring full response generation or gradient computation.
• Robustness:
  • Adaptive Attacks: Performed stably against adaptive attacks (TAP, LLM-Fuzzer, X-Teaming).
  • Token Segmentation: Demonstrated resilience against Emoji Attacks (which disrupt tokenization), whereas generation-based guards failed significantly.
  • Benign Utility: Showed no degradation in performance on math (GSM8K) and coding (HumanEval) tasks, confirming it does not over-refuse safe queries.

5. Significance

SelfGrader represents a paradigm shift in LLM safety defense. By moving away from the "generate-and-check" or "train-a-classifier" paradigms, it leverages the latent safety signals already present in the model's logits.

• Practicality: Its low latency and memory footprint make it feasible for real-time deployment in production environments where resource constraints are critical.
• Stability: The dual-perspective design addresses the "over-refusal" problem common in safety filters, ensuring that useful capabilities (like coding or math) are not compromised.
• Generalizability: The method is model-agnostic (can use the target LLM as the guardrail) and does not require retraining, making it a plug-and-play solution for securing diverse LLM architectures.

In conclusion, SelfGrader offers a highly efficient, robust, and interpretable mechanism for jailbreak detection, effectively balancing the trade-off between security and utility in Large Language Models.