Revisiting JBShield: Breaking and Reconstructing Representation-Level Jailbreak Defenses

Researchers propose an adaptive attack, JB-GCG, which achieves an average attack success rate of 46.2% against the jailbreak defense JBShield on Llama-3-8B, and propose a reconstruction defense, RTV. JBShield relies on two concept signals, toxicity and jailbreak, to detect malicious prompts, and in some settings the attack success rate is 0%; JB-GCG modifies GCG's optimization objective to simultaneously suppress the cosine similarity of the refusal direction and regularize JBShield's own toxicity concept score, achieving a maximum success rate of 53.4% across five configurations, up to 30.7% against JBShield-M, and remains effective after multiple recalibrations of JBShield, with the authors calling the vulnerability structural. The authors further propose a new defense, Representation Trajectory Verification (RTV), based on Mahalanobis outlier detection of multi-layer refusal direction fingerprints, achieving an AUROC of 0.99 against this attack; under full white-box knowledge, the best adaptive attack against RTV achieves only a 7% success rate, at 13 times the computational cost.