A new defense method teaches AI models to catch jailbreak attempts by reading the probabilities it ignores when picking its first word.
Researchers describe LADE, a technique that mines the full output probability distribution for a model's first token, not just the word it actually picks. That distribution holds what the paper calls dark knowledge: tokens whose probabilities move sharply depending on whether a prompt is harmful or benign. LADE isolates those discriminative tokens, maps them across different tokenizers so the same signal works on different model families, and then flags incoming queries with a k-nearest-neighbors search against that mapped signal. The researchers tested it across multiple LLMs and a range of jailbreak attacks.
That architecture-independence is the real pitch. Earlier decoding-stage defenses dig into a model's hidden states, which ties them to specific architectures and forces a trade-off: crank up safety and the model starts refusing harmless requests too. A signal that transfers across tokenizers could, in theory, be bolted onto a new model family without retraining or reverse-engineering its internals.
The paper claims lower attack success rates with a safety-utility balance that holds up, but the abstract keeps those results qualitative. Jailbreak defenses have a short half-life once attackers get a look at them, so the real test is whether LADE's cross-model signal still holds after the next round of adversarial prompts.