New defense system uses retrieval and examples to stop jailbreak attacks on AI models

Researchers have developed a new approach to protect large language models from jailbreak attacks—adversarial prompts designed to trick AI systems into producing harmful content. The method, called Retrieval-Augmented Defense (RAD), works by drawing on a collection of known attack examples to spot and neutralize malicious queries before they can cause damage.

The Problem with Current Defenses#

Jailbreak attacks continue to pose a significant threat to deployed language models. Two key obstacles make defending against them difficult: first, emerging attack strategies require constant retraining of defense systems, which is expensive and time-consuming; second, safety mechanisms often reject legitimate user requests along with harmful ones, reducing the system's overall usefulness.

How RAD Works#

RAD combines retrieval-augmented generation—a technique that pulls relevant information from a database—with jailbreak detection. When a user sends a query, the system retrieves examples of similar attacks from its knowledge base and uses them to infer what the underlying malicious intent or attack strategy might be. This enables detection without needing to retrain the model on new attack variations.

The approach offers a controllable trade-off between safety and utility. Rather than applying a one-size-fits-all rejection policy, RAD can be tuned to operate at different sensitivity levels depending on deployment needs.

Experimental Results#

Testing on StrongREJECT, a jailbreak evaluation benchmark, showed that RAD significantly reduced the success rate of sophisticated attacks such as PAP and PAIR while keeping false-positive rejection rates low for ordinary user inputs. The researchers also introduced a new evaluation framework to measure this safety-utility balance across multiple operating points.

Why It Matters#

By enabling training-free updates for newly discovered attacks, RAD offers a more practical defense pathway for organizations deploying large language models. The controllable nature of the approach makes it adaptable to different security and usability requirements.