Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models
The paper empirically studies how depth-based dynamic inference in LLMs—where generation can exit from intermediate layers to save compute—changes susceptibility to jailbreak attacks. Its interesting takeaway is that earlier exits seem consistently harder to jailbreak while deeper exits make adversarial suffix optimization easier, suggesting robustness could be a controllable inference-time tradeoff, though the conclusions appear mainly empirical and likely bounded by the specific models, exit mechanisms, and jailbreak attacks tested.
Abstract
Large Language Models (LLMs) have been shown to be computationally expensive and vulnerable to jailbreak attacks, in which adversarial prompts bypass safety alignment and induce harmful responses. To address this inefficiency, a range of techniques have been proposed to enable efficient LLM inference. Depth-based dynamic inference has demonstrated promising results by enabling outputs to be generated from intermediate layers. It offers the flexibility to adjust model behavior based on the available resource budget. However, how this flexibility affects the robustness of LLMs against jailbreak attacks remains unexplored. In this paper, we address this gap via a comprehensive investigation into the impact of depth-based dynamic inference on the robustness of LLMs against jailbreak attacks. Specifically, we make the following key observations: 1) Shallow exits are consistently more robust to jailbreak attacks than deeper ones; 2) Exit depth affects how easily the adversarial suffix can be optimized, with deeper exits reaching lower attack loss; and 3) Adversarial suffixes affect utility uniformly across exit depths. These insights can help design dynamic inference methodologies that are more robust to jailbreak attacks. Code is available at https://github.com/LassNajmuldeen/balcony-jailbreaking