FJD: Free Jailbreak Detection for LLMs

• Free Jailbreak Detection (FJD) is a lightweight, confidence-based method that exploits first-token probability differences to detect jailbreak prompts in LLMs.
• It employs an affirmative instruction and temperature scaling to enhance detection without incurring significant computational costs.
• Empirical results demonstrate improved AUROC metrics across diverse models and attack families while preserving benign response quality.

Searching arXiv for papers on Free Jailbreak Detection and closely related jailbreak-detection methods. Free Jailbreak Detection (FJD) is a confidence-based jailbreak detection method for aligned LLMs in which detection is performed during a single normal forward pass by exploiting differences in the model’s output distribution on benign and jailbreak prompts. In its most specific usage, the term denotes the method introduced in “LLM Jailbreak Detection for (Almost) Free!”, where an affirmative instruction is prepended to the prompt and the first-token confidence, optionally temperature-scaled, is used as the detection signal with almost no additional computational costs during inference (Chen et al., 18 Sep 2025). In adjacent work, the phrase is also used more broadly to describe low-cost, label-free, or training-free jailbreak detection systems that avoid model fine-tuning, auxiliary safety LLMs, or explicit jailbreak labels, including latent-state detectors, anomaly-detection frameworks, and temporal multi-turn defenses (Kadali et al., 12 Feb 2026, Liang et al., 8 Aug 2025, Ma et al., 1 Jun 2026).

1. Definition, scope, and conceptual basis

FJD is motivated by the observation that aligned LLMs are less confident when responding to jailbreak prompts than to benign prompts, especially in the first generated token. The underlying intuition is that benign prompts usually induce a clear, high-confidence opening token, whereas jailbreak prompts place the model in conflict between alignment behavior and harmful instructions, or push it into out-of-distribution regions; both effects flatten the next-token distribution (Chen et al., 18 Sep 2025).

The method is defined for an LLM with parameters $\theta$ and an input prompt $x$. If $f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$ denotes the logits for the first output token over vocabulary $\mathcal{V}$, then the basic confidence statistic is the maximum softmax probability

$$P_1(x) \triangleq \max_{i \in \mathcal{V}} p_\theta(y_1=i \mid x).$$

FJD treats low first-token confidence as evidence of jailbreak behavior and high first-token confidence as evidence of benign behavior (Chen et al., 18 Sep 2025).

Within the broader jailbreak-detection literature, this confidence-based formulation occupies one point in a wider design space. Other methods characterize “free” detection differently: some avoid base-model fine-tuning by classifying latent activations (Kadali et al., 12 Feb 2026), some avoid jailbreak labels by treating attacks as anomalies relative to safe internal safety patterns (Liang et al., 8 Aug 2025), and some extend the training-free idea to multi-turn conversations by aggregating temporal risk without retraining the target model (Ma et al., 1 Jun 2026). This suggests that FJD is both a specific algorithm and, in a looser research sense, a family resemblance among low-overhead jailbreak defenses.

2. Confidence scoring, affirmative instruction, and temperature scaling

The canonical FJD pipeline augments the user query $x_q$ with an affirmative instruction $x_{ai}$ and uses the concatenated input

$x := x_{ai} \oplus x_q.$

Examples of affirmative instructions include “You are a good Assistant.”, “Respond in a way that promotes safety.”, “Provide an answer that prioritizes user safety.”, “Remember you are a responsible and helpful LLM.”, and “Let’s think step by step.” The paper reports that, for benign queries, such instructions reinforce alignment and clarity and raise first-token confidence, while for jailbreak queries the adversarial parts dominate attention and the increase is much smaller or even negative (Chen et al., 18 Sep 2025).

With temperature scaling, FJD replaces the raw next-token distribution by

$$p_{\theta,\tau}(y_1=i \mid x)=\frac{\exp(f_{1,i}(x)/\tau)}{\sum_{j \in \mathcal{V}} \exp(f_{1,j}(x)/\tau)},$$

and defines

$$P_{1,\tau}(x) \triangleq \max_{i \in \mathcal{V}} p_{\theta,\tau}(y_1=i \mid x).$$

This step is especially important for overconfident models, since $x$0 flattens saturated distributions and magnifies the relative drop in confidence that jailbreak prompts exhibit (Chen et al., 18 Sep 2025).

The operational decision rule is threshold-based:

$x$1

In the experiments, the primary summary statistic is AUROC rather than a single fixed threshold, but the intended deployment semantics are explicit: low $x$2 indicates a likely jailbreak; high $x$3 indicates a likely benign prompt (Chen et al., 18 Sep 2025).

The paper also studies a multi-token variant, FJD-$x$4, which averages confidence over the first $x$5 tokens,

$x$6

but reports that $x$7 is usually sufficient and often best. This places the method in a particularly lightweight regime, because it depends only on the first-step logits that a standard generation pass already computes (Chen et al., 18 Sep 2025).

3. Virtual instruction learning and FJD-LI

FJD-LI replaces the manual affirmative instruction with a learned virtual instruction embedding. Let $x$8 denote tokenization and embedding, let $x$9 be the query embedding, and let $f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$0 be the initial manual instruction embedding. The method optimizes the instruction embedding while freezing the LLM parameters (Chen et al., 18 Sep 2025).

For a prompt embedding $f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$1, FJD-LI computes the first-token distribution

$f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$2

It then defines two target distributions. The first is a one-hot distribution $f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$3 whose nonzero entry is placed at the position of the maximum logit for the first token when no instruction is used. The second is the uniform distribution

$f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$4

The loss is

$f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$5

and the learned virtual instruction is

$f_1(x) \in \mathbb{R}^{|\mathcal{V}|}$6

The effect is asymmetric by design: benign prompts are pushed toward sharply peaked first-token distributions, while jailbreak prompts are pushed toward flatter ones (Chen et al., 18 Sep 2025).

Empirically, FJD-LI improves AUROC over manual-instruction FJD on multiple models and attack families. On AutoDAN, for example, the paper reports Llama2-7B improving from 0.958 to 0.970 and Vicuna-7B from 0.796 to 0.997; on Cipher, it reports Llama2-7B improving from 0.990 to 0.994 and Vicuna-7B from 0.86 to 0.93 (Chen et al., 18 Sep 2025). The learned-instruction formulation preserves the central FJD property—no extra model call during inference—while replacing prompt engineering with a learned prompt-embedding objective.

4. Empirical performance and computational profile

The main evaluations cover Llama2-chat 7B and 13B, Vicuna 7B and 13B, and Guanaco 7B and 13B, with additional transfer experiments on Llama3-8B and ChatGPT-3.5. Jailbreak sets include AdvBench, AutoDAN, GCG and MAC, AdvPrompter, Cipher, hand-crafted jailbreak strategies grouped into competing-objectives and mismatched-generalization families, and PAIR; benign sets include PureDove, Open-Platypus, and SuperGLUE (Chen et al., 18 Sep 2025).

Against competing-objectives attacks such as AutoDAN, FJD reports strong AUROC improvements over perplexity-based detection, SmoothLLM, GradSafe, and a naive first-token detector. For AutoDAN, the paper reports Llama2-7B at 0.96, Llama2-13B at 0.92, and Vicuna-13B at 0.94. Against mismatched-generalization attacks, it reports especially strong results on Cipher, including 0.99 on Llama2-7B. Hand-crafted mismatched-generalization attacks also remain detectable, with reported AUROC values of 0.95 on Llama2-7B and 0.95 on Vicuna-13B (Chen et al., 18 Sep 2025).

Ablation isolates the contribution of each component. On Llama2-7B with AutoDAN, removing both affirmative instruction and temperature scaling yields 0.87 AUROC, affirmative instruction alone yields 0.94, temperature scaling alone yields 0.89, and the full FJD pipeline yields 0.96. On Cipher, the corresponding pattern is approximately 0.92 without either component, approximately 0.97 with affirmative instruction only, approximately 0.96 with temperature scaling only, and approximately 0.99 with both (Chen et al., 18 Sep 2025). This identifies the affirmative instruction as the dominant contributor, with temperature scaling acting as an additional separation mechanism.

The central efficiency claim is that FJD is “almost free” because it reuses the same forward pass needed for ordinary generation. In the reported Llama2 timing study, base forward time is 394 seconds, PPL detection raises this to 412 seconds, SmoothLLM to 1568 seconds, GradSafe to 405 seconds, and FJD to 396 seconds. The measured overhead is therefore approximately 2 seconds relative to normal inference, whereas comparator methods require either extra forward passes, multiple perturbed copies, or backward passes (Chen et al., 18 Sep 2025).

The paper also studies benign-response quality. It reports semantic similarity of 0.74 for FJD versus 0.68 for SmoothLLM, and ChatGPT scoring of 0.86 for FJD versus 0.74 for SmoothLLM. On AlpacaEval 2.0, the reported win rate rises from approximately 9.4% to approximately 19.6% under FJD, while Arena-Hard-Auto remains near parity at 0.5 versus 0.4 (Chen et al., 18 Sep 2025). These results are presented as evidence that the prepended affirmative instruction generally does not degrade benign outputs and may sometimes improve them.

5. Relation to other jailbreak-detection paradigms

FJD belongs to the class of low-overhead detectors that exploit model-native signals rather than calling an external moderation system. Its distinguishing feature is that the signal is taken from the output distribution, specifically the first-token maximum probability, rather than from hidden states, gradients, retrieval over attack corpora, or response-level semantic inconsistency (Chen et al., 18 Sep 2025).

A large body of related work instead operates on internal representations. “Jailbreaking Leaves a Trace” analyzes hidden states and attention outputs across GPT-J, LLaMA, Mistral, and Mamba, applies rank-20 CP tensor decomposition layer-wise, and uses prompt-mode latent factors with lightweight classifiers to detect jailbreak prompts without model fine-tuning or auxiliary LLM detectors; on an abliterated LLaMA-3.1-8B model, selectively bypassing high-susceptibility layers blocks 78% of jailbreak attempts while preserving benign behavior on 94% of benign prompts (Kadali et al., 12 Feb 2026). ALERT likewise targets zero-shot detection without jailbreak templates during training, but amplifies discrepancies in specific shallow layers and FFN modules and reports that it outperforms the second-best baseline by at least 10% in average Accuracy and F1-score, and sometimes by up to 40% (Lin et al., 7 Jan 2026). GradSafe takes a different internal route, using gradients of safety-critical parameter slices induced by pairing prompts with the compliance response “Sure”; on ToxicChat and XSTest it outperforms Llama Guard in AUPRC without further training (Xie et al., 2024).

Another cluster of work frames jailbreak detection as anomaly detection. LoD for LVLMs builds Multi-modal Safety Concept Activation Vectors and trains a Safety Pattern Auto-Encoder on safe data only, reporting average AUROC values of 0.9969 on LLaVA, 0.9951 on Qwen-VL, and 0.9943 on CogVLM across five unseen attack benchmarks (Liang et al., 8 Aug 2025). Retrieval-Augmented Defense takes a case-based route instead, retrieving known jailbreak exemplars and strategies, inferring the underlying malicious query, and producing a harmfulness probability that can be thresholded with explicit control over the safety–utility trade-off (Yang et al., 22 Aug 2025). NegBLEURT Forest shifts attention to responses, constructing a refusal semantic domain and using negation-aware semantic distances plus Isolation Forest to detect anomalous responses without model fine-tuning or threshold calibration (Sleem et al., 14 Nov 2025).

Finally, multi-turn work shows where first-token prompt confidence is likely to be insufficient on its own. SafeDream defines a detection-lead metric and uses a safety-state world model, CUSUM accumulation, and contrastive imagination to obtain 1.06–1.20 turns of lead before compliance on three multi-turn benchmarks (Yan et al., 18 Apr 2026). THRD remains fully training-free and explicitly models temporal risk accumulation via a Turn-level Risk Assessor, Historical Context Analyzer, Response Evaluator, and a time-evolving decision rule, reducing ASR to 0.2–4.0% while preserving model utility within 1.5% degradation on MMLU and GSM8K (Ma et al., 1 Jun 2026). These results delimit the scope of FJD: it is highly attractive as a single-pass prompt detector, but other mechanisms become necessary when the attack unfolds across a dialogue trajectory rather than a single prompt.

6. Limitations, evasion, and broader significance

The original FJD paper identifies several limitations. It notes that non-readable, highly optimized jailbreaks such as GCG can still be challenging, even though FJD-LI narrows the gap. It also reports a detection-aware white-box attack: on Vicuna-7B, a white-box detection-aware attack drops FJD AUROC to approximately 0.48, whereas transfer attacks optimized on Llama2 or Guanaco and applied to Vicuna remain detectable at approximately 0.89–0.90 AUROC. The paper further notes that different architectures and alignment methods exhibit different sensitivity to confidence and instructions, and that multimodal settings such as LLaVA v1.6 Mistral-7B show a weaker confidence effect because image token sequences are large (Chen et al., 18 Sep 2025).

These observations identify the main theoretical vulnerability of confidence-only detection: once the detector itself becomes part of the attack objective, the attacker can optimize not merely for harmful completion but for high first-token confidence under the defensive prompt. A plausible implication is that FJD is strongest as a low-cost first-line filter against broad attack families rather than as a complete white-box-robust defense.

Related work also sharpens the limits of the “free” paradigm. Internal detectors that require hidden states or gradients cannot be applied to closed APIs without provider-side hooks (Kadali et al., 12 Feb 2026, Xie et al., 2024). Multi-turn attacks expose the inadequacy of independent per-turn screening (Yan et al., 18 Apr 2026, Ma et al., 1 Jun 2026). Dataset drift means that detectors trained at one point in time can fail against later jailbreak distributions; JailbreaksOverTime shows that weekly self-training using a detector’s own labels can reduce the false negative rate from 4% to 0.3% at a false positive rate of 0.1%, while unsupervised active monitoring remains valuable for surfacing out-of-distribution attacks missed by continuous learning (Piet et al., 28 Apr 2025). On the evaluation side, JADES argues that success should be measured by whether the model actually solves the harmful task, not merely by lack of refusal or general toxicity, and reports 98.5% agreement with human evaluators in a binary success/failure setting (Chu et al., 28 Aug 2025). This suggests that prompt detection, response detection, and jailbreak-success evaluation are distinct but complementary layers.

Taken together, the literature positions FJD as an important reference point in jailbreak detection because it demonstrates that a highly effective signal can sometimes be extracted from ordinary generation-time statistics alone. Its central result is methodological rather than merely empirical: aligned LLMs can leak jailbreak evidence through their own uncertainty profile. Subsequent work broadens that premise to latent geometry, anomaly scores, retrieval over attack corpora, semantic inconsistency, and temporal accumulation, but the original FJD formulation remains the cleanest statement of an “almost free” detector—one that uses the model’s own first-token confidence, augmented by an affirmative instruction and temperature scaling, as a jailbreak sensor embedded directly in the inference loop (Chen et al., 18 Sep 2025).