Michael Brenndoerfer | Data & AI, Private Equity, Technology

Michael Brenndoerfer

Jailbreaking › Visualization: Defense Effectiveness Comparison

Michael BrenndoerferJanuary 13, 20263 min read

Language AI HandbookAll chapters

Part 60 of 67Safety and Security

Chapter 459Jailbreaking › Visualization: Defense Effectiveness Comparison

Reading section 10 of 18 · Visualization: Defense Effectiveness Comparison · 3 minSection 10 of 18 · 3 min

Section 10 of 18 · 3 min read

Jailbreaking › Visualization: Defense Effectiveness ComparisonOne section · Sections in this chapter10 / 18 ↓

Sections in this chapter18

Reading tools Definitions & inline links

Choose your expertise level to adjust how many terms are explained. Beginners see more tooltips, experts see fewer to maintain reading flow. Hover over underlined terms for instant definitions.

Article links

Make inline references clickable

Different defenses have different trade-offs between effectiveness against specific attack types and false positive rates on benign queries.

In[12]:

Code

# Defense trade-off data
# Each defense: (attack_block_rate, false_positive_rate)
# Data represents approximate values from published evaluations

defenses = [
    "No Defense",
    "Input Filtering",
    "Perplexity Filter",
    "Output Filtering",
    "Adversarial Fine-tuning",
    "CAI / RLAIF",
    "Randomized Smoothing",
    "Prompt Hardening",
]

# Format: (% attacks blocked, % benign queries incorrectly refused)
# Higher block rate is better; lower false positive rate is better
block_rate = [0.0, 55.0, 70.0, 72.0, 65.0, 78.0, 45.0, 40.0]
false_pos = [0.0, 8.0, 12.0, 6.0, 4.0, 5.0, 18.0, 3.0]

Out[13]:

Visualization

Scatter plot showing attack block rate vs false positive rate for 8 defense strategies, with ideal region in upper-left. — Defense trade-off scatter plot of attack block rate versus false positive rate on benign queries. Defenses in the upper-left are ideal, blocking many attacks while incorrectly refusing few legitimate requests. Constitutional AI and output filtering offer the best overall trade-off. Randomized smoothing has high false positives because noisy input perturbations produce spurious refusals on legitimate queries.

The ideal defense sits in the upper-left of this plot: high attack block rate, low false positive rate. In practice, all current defenses involve trade-offs. Perplexity filtering is effective against GCG-style attacks but flags many unusual-but-benign queries. Output filtering blocks harmful outputs regardless of technique but adds latency. Adversarial fine-tuning improves on the clean-data baseline with minimal false positives but requires ongoing retraining as new attack techniques emerge. No single defense dominates across all dimensions, which motivates the defense-in-depth approach.