SmoothLLM: Robust Defense for LLMs

• SmoothLLM is a defense framework that uses randomized input perturbations to disrupt brittle adversarial prompts targeting LLMs.
• It employs a perturb–classify–aggregate loop to accurately detect and mitigate jailbreak attacks while maintaining acceptable performance on benign tasks.
• Empirical results show dramatic reductions in adversarial success rates with minimal impact on clean task accuracy, despite potential adaptation by advanced attackers.

SmoothLLM is a randomized input perturbation and output aggregation framework devised to enhance the robustness of LLMs against jailbreaking attacks. Jailbreaking attacks are adversarial prompt manipulations—typically in the form of appended suffixes or semantic in-context examples—that induce an otherwise aligned LLM to output prohibited or harmful content. SmoothLLM exploits the empirical observation that adversarial prompts tend to be brittle: small, random perturbations to such prompts reliably disrupt their ability to elicit an unsafe model response. This method operates by generating multiple perturbed copies of a given prompt, querying the LLM on each, and aggregating the results to detect adversarial intent before emitting or refusing a response (Robey et al., 2023).

1. Threat Model and Motivation

The central threat addressed by SmoothLLM is adversarial prompting, particularly black-box attacks that manipulate inputs at the character or token level. The canonical case is the suffix-based jailbreak, where an adversary seeks an input suffix $S$ that, when appended to a forbidden request $G$, causes the LLM to produce a specified harmful output $T$. Optimal attacks (e.g., Greedy Coordinate Gradient, or GCG) require extensive API queries—up to $2.5 \times 10^5$ per prompt—and produce suffixes that are functionally effective but syntactically fragile. Semantic jailbreaks (PAIR-style, prompt-engineered demonstrations) are less reliant on exact character layouts but still depend on precise textual templates (Robey et al., 2023, Zheng et al., 2024). The motivation behind SmoothLLM is to break the dependency on brittle text structures by randomly perturbing the prompt, hypothesizing that successful jailbreaks rely on forms not robust to even minor corruption.

2. Algorithmic Framework

SmoothLLM implements a perturb–classify–aggregate loop. Given a prompt $P$ of length $m$, an alphabet $\mathcal{A}$ of size $v$, a perturbation rate $q \in [0, 0.2]$, and a sample size $N$, the defense operates as follows:

1. Perturbation Generation: For $G$0, sample perturbed prompts $G$1, where $G$2 is a perturbation operator—insert, swap, or patch—affecting $G$3 positions.
   • Insert: Insert random characters at $G$4 random positions.
   • Swap: Replace $G$5 characters with uniform samples from $G$6.
   • Patch: Replace a contiguous block of $G$7 characters with random samples.
2. Classification: For each $G$8, query the LLM for a response $G$9, and apply a binary jailbreak test $T$0 indicating “safe” or “jailbreak”.
3. Aggregation: Compute $T$1 (default threshold $T$2). Release one randomly chosen $T$3 from the batch whose $T$4. If $T$5, refuse or abstain depending on deployment policy (Robey et al., 2023).

This perturbation–aggregation architecture is model-agnostic and deploys as a pre-inference wrapper, requiring neither retraining nor modification of the underlying LLM. An optional perplexity filter may be combined to further screen low-probability prompts (Zheng et al., 2024).

3. Certification Guarantees and Probabilistic Analysis

SmoothLLM's robustness guarantee originates in the $T$6-unstable property of adversarial prompts: a suffix $T$7 is $T$8-unstable if perturbing $T$9 or more locations deterministically prevents jailbreak. Formally, robustness is certified by a binomial probability tail: if the probability that a random $2.5 \times 10^5$0 disables the jailbreak is $2.5 \times 10^5$1, then the Defense Success Probability (DSP) for $2.5 \times 10^5$2 samples is

$2.5 \times 10^5$3

However, adversarial success rates (ASR) empirically decay smoothly rather than abruptly with perturbation magnitude. This motivated a more realistic probabilistic certificate—the $2.5 \times 10^5$4-unstable framework—where, conditioned on $2.5 \times 10^5$5 or more perturbations, the attack succeeds with probability at most $2.5 \times 10^5$6. The resulting analytic lower bound for defense success incorporates empirical ASR fits of the form $2.5 \times 10^5$7, enabling data-driven calibration of certification parameters $2.5 \times 10^5$8 for specific models and attack classes (Kumarappan et al., 24 Nov 2025).

4. Empirical Performance and Limitations

Experimental evaluation demonstrates:

• For GCG attacks, SmoothLLM (Vicuna, $2.5 \times 10^5$9, $P$0): ASR drops from $P$1 (undefended) to $P$2. For Llama2, ASR similarly falls from $P$3 to $P$4.
• Semantic PAIR attacks: Baseline ASR of $P$5 is reduced to $P$6 ($P$7, $P$8), with SmoothLLM the first to provide nontrivial defense against this class (Robey et al., 2023).
• On benign tasks (e.g., PIQA, OpenBookQA, ToxiGen), accuracy drop is $P$9 percentage points for $m$0, $m$1.
• Query and latency cost: $m$2 LLM invocations per prompt, yielding a $m$3s latency per prompt on a single GPU (for $m$4).
• Compatibility: SmoothLLM is architecture-agnostic and black-box deployable.
• Tradeoffs: Increasing $m$5 or $m$6 strengthens defense but can reduce model utility, particularly for benign input (Robey et al., 2023, Hu et al., 6 Jul 2025).

A summary of empirical defense performance (selected from (Robey et al., 2023, Hu et al., 6 Jul 2025)):

Attack/Benchmark	Undefended ASR	SmoothLLM ASR ($m$7, $m$8)	Clean Task Drop
GCG (Vicuna)	98%	<1%	< 5 points
GCG (Llama2)	51%	<1%	< 5 points
PAIR (Semantic)	92%	≈50%	< 5 points

5. Interaction with Jailbreak Methods and Adaptive Attacks

SmoothLLM's randomized perturbation reliably nullifies classic suffix-based and vanilla few-shot jailbreaks. Empirically, these attacks exhibit near-zero ASR for $m$9. However, advanced few-shot jailbreaks (I-FSJ) circumvent SmoothLLM by:

• Delimiter token injection: Inserting system-delimiter tokens (e.g., [/INST]) throughout demonstrations, ensuring some delimiters persist under perturbations.
• Demo-level randomized search: Optimizing the set and composition of demonstrations against the SmoothLLM perturbation distribution, akin to adversarial training at the prompt level.

I-FSJ achieves $\mathcal{A}$0–$\mathcal{A}$1 ASR on Llama2-7B and Llama-3-8B under $\mathcal{A}$2 perturbations, with similar results across insert, swap, and patch variants. This circumvention requires knowledge of the LLM’s prompt template and the defense’s perturbation kernel (Zheng et al., 2024). These findings illustrate a fundamental limitation: if the adversary can adapt prompts to the perturbation distribution, the strength of the smoothing defense is diminished.

6. Mechanistic Perspective: Attention Slipping and Defensive Action

Jailbreak attacks manipulate the LLM’s attention weights—a phenomenon termed Attention Slipping—where the model’s focus shifts away from unsafe-intent tokens during generation, circumventing built-in safety detectors. SmoothLLM indirectly counters this by introducing random corruption, which disrupts the adversarial suppression of attention on the unsafe prototype, leading to elevated attention rates on harmful instruction tokens and reduced ASR. Experimental evidence shows ASR correlates inversely with average attention rate on the unsafe prototype under perturbation (Hu et al., 6 Jul 2025).

Compared to alternative defenses, such as Token Highlighter and direct Attention Sharpening (temperature scaling of the attention distribution), SmoothLLM demonstrates lower ASR but at a higher cost to benign-task Win Rate (a drop from $\mathcal{A}$3 to $\mathcal{A}$4 at $\mathcal{A}$5, $\mathcal{A}$6). Computationally, the method multiplies inference time roughly by $\mathcal{A}$7, presenting a practical challenge for real-time applications (Hu et al., 6 Jul 2025).

7. Practical Deployment, Extensions, and Open Challenges

Key practical features of SmoothLLM include:

• Deployment Agnosticism: Works as a black-box wrapper for any LLM, compatible with both open- and closed-source models.
• No Fine-Tuning Required: Operates pre-inference with no model modification.
• Hyperparameters: Typical settings—perturbation rate $\mathcal{A}$8–$\mathcal{A}$9, ensemble size $v$0–$v$1—offer robust defense with modest utility cost.
• Overhead: Linear increase in latency and compute with $v$2; higher $v$3 improves security at the expense of input fidelity.
• Extensions: Combine with other input filters (e.g. perplexity) or design semantically-aware smoothing kernels.

Ongoing research addresses adaptive attack resistance, defense certification under $v$4-unstability, and mitigating utility loss on benign tasks. Open challenges include constructing smoothing kernels or aggregation schemes robust to adaptive demo-level attacks, as well as integrating smoothing with in-model interventions (e.g., attention sharpening) for more principled safety–utility trade-offs (Kumarappan et al., 24 Nov 2025, Zheng et al., 2024, Hu et al., 6 Jul 2025).