Proposes SpecGuard, a training-free framework that monitors multi-turn LLM dialogues against LTL safety specifications compiled into automata, outperforming open guard models with auditable witnesses.
Proposes a clinician-authored, formally verified rule base as a runtime guardrail for mental-health chatbot outputs, compared against an LLM judge, reporting disagreements and measured over-refusal costs.
Screwtape edits real agent transcripts with an LLM attacker so harmful actions evade action-only monitors, finding six attacks that also fool a frontier developer's held-out monitor.
Shows that prompt harmfulness and response-level safety often disagree across seven LLMs, and that classifiers reading only partial responses can detect harmful outputs early, enabling safer generation-time guardrails.
Shows that trigger-tag misuse detection mechanisms for open-weight LLMs, both token-level and weight-level, can be rendered ineffective by adversarial attacks in phishing case studies.
Shows that appending a classification-format suffix after the user turn improves out-of-distribution activation-probe detection of jailbreaks and prompt injection, with gains from format rather than criterion content.
Proposes sequence-aware biosecurity monitors using protein embeddings to flag dual-use agent tasks, reporting fewer refusals than frontier safeguards and better robustness to paraphrasing and fragmentation attacks.
Builds a synthetic labelled dataset of adversarial LLM user sessions and a gradient-boosted detector for jailbreaks and abuse, finding that noisy operational labels badly understate detector performance.
Proposes an energy-landscape account of jailbreaks in diffusion LLMs and three training-free detection signals that monitor initial safety disposition and denoising kinetic energy to catch attacks.
Proposes InGuard, an inside-pipeline guardrail for text-to-image models that grades prompts, edits risky embeddings, and halts generation via latent detection, reducing NSFW output and compute cost.}
Red-teams production blocking monitors (Auto Mode, Guardian) against a persistently misaligned coding agent, finding injection and multi-context attacks succeed often and proposing monitor improvements.
Evaluates 40 LLM attack mechanisms and builds MechAudit, a white-box runtime auditor using hidden-state representations that detects held-out attacks at low false-positive rates and generalises to unseen mechanisms.
Shows safety monitors miss harmful requests the target model answers, because they track explicitness of wording rather than intent, and fine-tuning on rewrites across explicitness levels recovers recall.}
Presents SingProbe, an open framework where lightweight probes on LLM hidden states flag unsafe content, query intent and hallucination risk during decoding, with guard models for 29 base models.
Repurposes an LLM's speculative-decoding module with a trained soft prompt as a near-free sequence classifier, matching specialized safety guard models on multilingual prompt safety.
TRACE is a benchmark for evaluating guardrail models on unsafe content across prompts, reasoning traces and final responses of large reasoning models, finding trace judgment and evidence extraction especially hard.
GuardPaint monitors intermediate images in text-to-image diffusion, inpaints unsafe regions, and reduces jailbreak attack success and harmful generations across several models with little quality loss.
Proposes LeakGauge, which detects system-prompt and context leakage attacks on LLMs from prefill token probabilities of a verbalized probe suffix, reporting high AUROC on unseen attacks across 11 models.
Introduces MTAG-Bench and MTAG-Probe, a model that localizes which user turns and spans drive multi-turn conversations toward unsafe LLM responses, improving turn-level attribution and flipping Llama Guard decisions when evidence is removed.
Proposes a streaming guardrail that checks LLM output before each chunk is released, proves it matches an absorbing cumulative oracle for its policy grammar, and reports zero mismatches across large test campaigns.
Introduces AMS, an activation-space scanner that detects whether safety training in language models has been removed or modified, such as by abliteration, with a four-class taxonomy of modifications.}
Shows frontier text-to-image models readily generate multi-turn hateful visual stories that existing moderation misses, and proposes an interaction-aware monitor that catches most of them.
Systematizes multi-turn LLM jailbreaks by adversarial intent structure, finding effectiveness depends on how intent is organized across turns and that detection must operate at session or cross-session level.
Proposes a proactive multi-agent defense that paces responses, misleads attackers and analyses logs, reducing attack success on multi-turn jailbreaks by 69% on average.
Proposes ResponseGuard, a fast reasoning-free vision-language guard that flags harmful responses in one forward pass, outperforming a 3B reasoning guard at about 150 times lower cost.
Shows that adversarial persuasion can make chain-of-thought monitors approve policy-violating actions, and that a fact-checker from a different model family substantially reduces this.</parameter>
Proposes a real-time LLM safety monitor that thresholds an external verifier's signal, with risk-controlled calibration, and finds it competitive with sequential hypothesis testing monitors on math and red-teaming data.
Proposes Cognitive Firewall, a multi-gate runtime oversight model that screens multi-turn conversations for intent, false authority, escalation and harmful outputs, substantially reducing jailbreak success rates on benchmarks.
Systematically compares inference-time LLM defenses, showing prompt-time activation steering is blind to prefilling attacks and proposing a response-time linear probe with halt that blocks them with zero benign false positives.
Proposes an output-aware guardrail that predicts from hidden states whether an MLLM's response will be unsafe, cutting over-refusal while matching existing safety performance.
Studies online detection of distribution shift and adversarial evasion in deployed LLM safety classifiers, using score-disagreement canaries that catch many GCG attacks and conformal adaptation fixes.
Proposes PsychoPass, which uses geometric features of conversation trajectories in embedding space to detect multi-turn jailbreak attempts early, before harmful content appears, for online monitoring.
Introduces HarmAmp, a multi-turn benchmark for LLM harm amplification, and TrajSafe, a proactive trajectory monitor that intervenes to reduce harmful outcomes while keeping over-refusal low.
Introduces GuardZoo, a 32k-sample benchmark across 15 unsafe categories, and RouteGuard, a router that dispatches conversations to specialized guardrail experts, improving threat detection and out-of-domain generalization for LLMs.
Proposes TRIAD, a survival-analysis-based runtime defense that tracks multi-turn multimodal conversation trajectories to detect progressive jailbreak attacks on MLLMs and agents.
Introduces FragBench, a benchmark of cross-session attacks where malicious goals are split into benign-looking fragments, showing a single-turn safety judge fails while graph-based user-level detectors reach F1 of 0.88-0.96.
Introduces turn-level supervision and the MTID dataset to train TurnGate, a monitor that learns when to intervene against multi-turn malicious intent in LLM dialogues, improving safety-utility trade-offs.
Measures how well Opus 4.5 as an attacker can evade prompted and fine-tuned monitors detecting data exfiltration or untrusted code execution in BashBench, finding low success against the best classifiers.
Proposes TwinGate, a stateful dual-encoder monitor that detects decompositional jailbreaks in anonymized LLM traffic using asymmetric contrastive learning, with low latency and false positives.
Proposes LCF, a tuning-free runtime monitor using layerwise hidden-state trajectories to detect backdoors, jailbreaks and prompt injections in LLMs, with low attack success and modest false positives.