用递归语言模型检测越狱攻击，提升工具型智能体安全性
Recursive language models for jailbreak detection: a procedural defense for tool-augmented agents
- 通过递归架构分步解析输入，动态拆解和筛查可疑内容
- 在三类大模型上检测率92.5%-98.0%，误报率仅0.0%-2.0%
- 适合高安全需求的自动化代理系统防御场景
越狱提示是大型语言模型（特别是执行工具的智能体系统）面临的现实且不断演变的威胁。许多攻击利用长上下文隐藏、语义伪装和轻量混淆手段，可绕过单次检测的防护机制。本文提出基于递归语言模型（RLMs）的端到端越狱检测框架RLM-JB：由主模型协调一个有界分析程序，对输入进行规范化与去混淆，分块处理以减少上下文稀释并确保覆盖，平行筛查各段落，并整合跨块信号以恢复被拆分的恶意载荷。在AutoDAN风格对抗样本上，RLM-JB在三种大模型后端均实现92.5%-98.0%的检测准确率（ASR/Recall），同时保持98.99%-100%的高精确率和0.0%-2.0%的低误报率，揭示了检测灵敏度与特异性间的实用权衡关系。
原文摘要 · Abstract (English)
Jailbreak prompts are a practical and evolving threat to large language models (LLMs), particularly in agentic systems that execute tools over untrusted content. Many attacks exploit long-context hiding, semantic camouflage, and lightweight obfuscations that can evade single-pass guardrails. We present RLM-JB, an end-to-end jailbreak detection framework built on Recursive Language Models (RLMs), in which a root model orchestrates a bounded analysis program that transforms the input, queries worker models over covered segments, and aggregates evidence into an auditable decision. RLM-JB treats detection as a procedure rather than a one-shot classification: it normalizes and de-obfuscates suspicious inputs, chunks text to reduce context dilution and guarantee coverage, performs parallel chunk screening, and composes cross-chunk signals to recover split-payload attacks. On AutoDAN-style adversarial inputs, RLM-JB achieves high detection effectiveness across three LLM backends (ASR/Recall 92.5-98.0%) while maintaining very high precision (98.99-100%) and low false positive rates (0.0-2.0%), highlighting a practical sensitivity-specificity trade-off as the screening backend changes.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。