Defensive Prompt Patch: A Robust and Generalizable Defense of Large Language Models against Jailbreak Attacks

1. The effectiveness of DPP compared to other defense methods remains largely unexplored. While there are explanations for the defensive patches generated in Section U, they only cover 2 examples. Although the perplexity of the defense prompts is mentioned as a potential reason for preserving utility, it cannot explain why the defense performance is enhanced. For instance, both GoalPrioritization and Self-Reminder produce defense prompts of similar meanings with DPP, but I cannot understand why their defense performance is not as good as DPP’s;

2. The DPP algorithm highly relies on the selection of prototype, which are chosen in an ad hoc manner. It seems unlikely that only the prototype prompt is well-designed while the algorithm's iterations lack significant improvement on the prompt. To better assess the effectiveness of DPP, a fair prompt initialization across various defense methods should be tested;

3. While this paper discusses various types of attacks, it lacks sufficient comparison with other state-of-the-art defense methods for LLMs. Both prompt-based defenses and other model-based approaches can effectively address LLM attacks, and including these comparisons would strengthen the analysis.

1. The experiments are conducted only on Llama-2 and Mistral-7B. The generalizability of DPP to other prominent LLMs like GPT-4 has not been fully explored.

2. The HGA used for optimizing the defensive prompts has no insight.

3. Additionally, based on our experimental results with AutoDAN, we believe that HGA is very time-consuming. Therefore, I think it would be beneficial to explain the time cost of your method compared to the advantages of other methods.

1. Unclear Motivation: It’s not clear why the defense prompts need to maintain human readability, as emphasized in Table 1. Unlike attack methods, which may require readability to evade perplexity-based (PPL) detection, defense methods don't necessarily need to be understandable by humans. This is a critical point because the paper subsequently uses the HGA to optimize the defense prompts. If human readability isn’t essential, why not consider token-wise methods like RPO did?
2. Unclear Contribution: The paper’s main methodological contribution seems to be a straightforward loss function aimed at preserving benign performance in the LLM. The design and algorithm choice lack novelty: the paper directly applies the HGA, a genetic algorithm proposed in AutoDAN, with no modifications. This raises several questions. First, with the additional loss function, the optimization process likely becomes more complex, potentially making convergence harder for algorithms like HGA in this challenging optimization setting. Second, a critical factor in HGA is initializing the prompt set based on a manual selection. It makes sense for AutoDAN as there already exists many human-designed jailbreak prompts to serve as initial prompts. However, in the context of defense, the paper does not discuss the choice of initial defense prompts. More importantly, why do the authors believe HGA is the most suitable approach for this optimization goal? I’m concerned that the algorithm design borrows heavily from existing methods without sufficient analysis of the unique challenges in this paper’s context, leading to unclear and likely insufficient contributions.

Writing: I find the paper’s clarity quite lacking. Starting from Figure 1 and continuing through the entire text, the paper is not written as clearly as it could be, and requires additional effort from the reader to understand the details.

Table 1 says DPP includes “Gradient-Based Search”. I do not understand where in Algorithm 1 the gradients come in.

The LaTeX in the appendix is really off at times; see Algorithm 4 (and multiple typos, e.g. “segements”, “offsrpings”); the appendix in general does not seem ready for submission. The formatting is not great in the main body either: the central Algorithm 1 is somewhat difficult to parse.

I find the paper very unclear on adaptive attacks. On line 364 in the main body, it says:

By "adaptive," we refer to the attacker’s ability to target an LLM equipped with a DPP without prior knowledge of the specific DPP being utilized (i.e., DPP is part of the post-query system prompt used by a closed-sourced LLM service provider to improve safety).

... but I do not think this is what is actually done in Appendix I. The writing in Appendix I is also not great; for example, regarding the paper’s version of adaptive GCG, I can’t make out what the “modifiable subset I” is and whether it includes the DPP tokens.

Methodology: The issue with the defense is that it seems like it just adds a lot of complexity, for a final product that is just an appended prompt. Taking a look at Appendix H, I wonder whether just appending some prompts like these (unrelated to DPP) would be competitive with the method. There's a lack of ablation studies or comparisons to show the necessity of each component in the DPP algorithm.

The second issue is that only two models are evaluated, both 7B, both released in March 2024 or earlier.
This does not represent the current state-of-the-art. On one of these, the utility degradation does not outperform other defense methods. To see whether the method works in general, I would like to see a wider and more up-to-date set of models tested.