Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
SENTINEL is a plug-and-play generation-time defense for LLM jailbreaks that detects hidden malicious intent by matching semantically aligned regions between the prompt and the model’s partial output, then scoring the extracted intent-revealing spans for harmfulness and stopping generation when needed. The neat idea is to use the model’s own tendency to produce outputs aligned with the attacker’s true goal as a signal rather than just perturbing inputs or filtering final outputs, yielding strong reported HarmBench results with low over-refusal, though it likely adds inference-time overhead and its effectiveness depends on that input-output consistency assumption and the tested threat settings.
Abstract
Large language models (LLMs) remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle protection and excessive over-refusal. We propose SENTINEL, a plug-and-play, generation-time jailbreak defense that reframes mitigation as an intent extraction problem. Our key insight is that instruction-tuned LLMs exhibit strong input--output semantic consistency: regardless of jailbreak complexity, generated outputs tend to align with the attacker's true intent. SENTINEL exploits this property by matching semantically aligned input--output regions to extract intention-revealing subsequences, scores these subsequences using refusal-direction projections to estimate harmfulness, and halts generation when necessary. Experiments on HarmBench across multiple LLMs show that SENTINEL reduces jailbreak success rates to close to 5\% while maintaining low over-refusal. We further demonstrate robustness to adaptive attacks and provide a mechanistic interpretation: SENTINEL re-distributes jailbreak features from alignment blind spots to aligned regions.