DYNASHIELD: Randomizing AI Model Behavior to Block Jailbreak Attacks Without Retraining

A new defense technique called DYNASHIELD protects large language models from jailbreak attacks by randomizing how the models generate responses, without requiring access to their internal weights or expensive retraining.

The Problem: Jailbreaks Still Work Against LLMs#

Despite ongoing safety improvements, LLMs deployed through public APIs remain vulnerable to jailbreak attacks—adversarial prompts carefully crafted to bypass safety guardrails and produce harmful content. Existing defenses often demand either direct access to model internals or additional training, making them impractical for commercial API deployments where only input-output interfaces are exposed.

How DYNASHIELD Works#

DYNASHIELD operates as a moving target defense that works entirely through runtime controls already exposed by most API providers. The approach unfolds in two stages:

• Identify safe configurations: The system tests different combinations of decoding parameters (like temperature and sampling strategy) and system prompts to find which ones reduce the likelihood of attack success.
• Randomize at inference time: Rather than using fixed settings, DYNASHIELD probabilistically selects from a weighted pool of protective configurations each time a user makes a request, introducing controlled unpredictability.

This variation makes it harder for attackers to fine-tune their jailbreaks to work reliably against the target model.

Testing and Results#

Researchers evaluated DYNASHIELD across seven open-source LLMs under four state-of-the-art jailbreak attack methods, using adversarial prompts from AdvBench. The results showed substantial reductions in attack success rates compared to seven baseline defenses. Importantly, the defense maintained response quality and imposed only minimal computational overhead at inference time.

Why It Matters#

By working purely through exposed runtime controls, DYNASHIELD sidesteps the need for model retraining or internal access—a significant practical advantage for cloud-hosted LLM services. The findings suggest that safety-aware dynamic decoding could become a lightweight, deployable defense mechanism for production systems.