TrapSuffix: Proactive Defense Against Jailbreak Adversarial Suffixes

The researchers propose TrapSuffix, a proactive defense fine-tuning method against jailbreak adversarial suffixes, which reduces the average attack success rate to below 0.01% across multiple suffix-based jailbreak settings. Its idea is to force the attacker into a dilemma: either fall into the optimization trap designed by the defender and fail to generate an effective suffix, or generate a suffix carrying a traceable fingerprint, with an average tracking success rate of 87.9%. This method does not change the inference process and has no inference-time overhead, requiring on average only 15.87 MB of extra memory, whereas mainstream LLM-based detection-style defenses typically have memory overhead on the order of 1e4 MB, and it can naturally be stacked with existing filtering-style defenses.