Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching

2026-10-03

AI Summary

This study addresses the vulnerability of large language models to jailbreak attacks and the excessive over-refusal exhibited by existing defenses by proposing the SENTINEL framework. This method reformulates defense as an intent extraction problem, leveraging input-output semantic consistency to extract and score intent subsequences for real-time interception of harmful content during generation. By redistributing jailbreak features into aligned regions, SENTINEL achieves precise protection and incorporates a refusal direction projection technique to enable plug-and-play deployment. Experimental results demonstrate that SENTINEL reduces the jailbreak success rate to below 5% on the HarmBench benchmark while maintaining a low over-refusal rate, further exhibiting strong robustness against adaptive attacks.

Abstract

Large language models (LLMs) remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle protection and excessive over-refusal. We propose SENTINEL, a plug-and-play, generation-time jailbreak defense that reframes mitigation as an intent extraction problem. Our key insight is that instruction-tuned LLMs exhibit strong input--output semantic consistency: regardless of jailbreak complexity, generated outputs tend to align with the attacker's true intent. SENTINEL exploits this property by matching semantically aligned input--output regions to extract intention-revealing subsequences, scores these subsequences using refusal-direction projections to estimate harmfulness, and halts generation when necessary. Experiments on HarmBench across multiple LLMs show that SENTINEL reduces jailbreak success rates to close to 5\% while maintaining low over-refusal. We further demonstrate robustness to adaptive attacks and provide a mechanistic interpretation: SENTINEL re-distributes jailbreak features from alignment blind spots to aligned regions.

Problem

• jailbreak attacks
• large language models
• over-refusal
• malicious intent
• adversarial prompts

Innovation

• Jailbreak Defense
• Intent Extraction
• Input-Output Matching
• Refusal-Direction Projections
• Alignment Reactivation