Erase-and-Check

Provides a formal mathematical guarantee that no adversarial suffix of a specified length can cause harmful output. Unlike empirical defenses that can be bypassed by novel attacks, Erase-and-Check offers provable safety within its threat model. The certification states that if the defense passes an input, no suffix up to a certain token length can make it harmful.

Systematically erases tokens from the input sequence and checks all possible subsequences for harmful content using a safety filter. Key process:

• Iteratively removes contiguous token spans
• Evaluates each resulting subsequence independently
• Flags input as harmful if any subsequence triggers the safety classifier
• Guarantees no adversarial suffix escapes detection within the certified length bound

Specifically designed to counter GCG-style attacks and other gradient-based suffix generation methods. Adversarial suffixes exploit model gradients to append nonsensical tokens that maximize harmful output probability. Erase-and-Check defeats these by:

• Checking the prompt without the suffix appended
• Verifying that the core harmful instruction is detected regardless of suffix presence
• Rendering suffix optimization ineffective against the defense

Leverages an external harmfulness classifier as the checking mechanism for each subsequence. The defense is agnostic to the specific filter implementation, allowing integration with:

• Fine-tuned safety language models
• Perplexity-based anomaly detectors
• Rule-based content policy engines
• Ensemble classifiers combining multiple detection methods This modularity enables defense strength to scale with filter improvements.

The exhaustive checking of all subsequences introduces O(n²) computational overhead where n is the input token length. Mitigation strategies include:

• Limiting the certified suffix length to bound the search space
• Parallelizing subsequence evaluations across multiple inference instances
• Caching intermediate safety filter results for overlapping subsequences
• Applying the defense selectively to high-risk inputs identified by lightweight pre-filters

Often deployed alongside SmoothLLM as part of a defense-in-depth strategy. While SmoothLLM uses input perturbation and response aggregation to detect anomalies, Erase-and-Check provides the formal certification layer. Together they address:

• SmoothLLM: Runtime anomaly detection through output variance analysis
• Erase-and-Check: Pre-execution certification against known suffix attack patterns
• Combined: Both empirical and provable safety guarantees in production systems

A seemingly nonsensical string of characters appended to a malicious prompt that exploits model gradients to maximize the probability of an affirmative and harmful response. Erase-and-Check is specifically designed to provide a mathematical guarantee against this class of attack by systematically evaluating all subsequences. These suffixes are typically generated via white-box optimization methods like the GCG Attack and are often unreadable to humans but highly effective at overriding safety alignment.

A complementary defense algorithm that perturbs multiple copies of an input prompt and aggregates the model's responses to detect and neutralize adversarial suffixes. Unlike Erase-and-Check, which provides a certified guarantee through exhaustive subsequence verification, SmoothLLM uses a randomized smoothing approach to identify anomalous output variance. Both techniques represent the frontier of adversarial robustness but operate on fundamentally different principles—one deterministic and exhaustive, the other statistical and perturbation-based.

The Greedy Coordinate Gradient attack is a white-box optimization method that computes a universal adversarial suffix by iteratively selecting token substitutions that maximize the likelihood of a target harmful string. Erase-and-Check was developed as a direct countermeasure to this class of gradient-based attacks. The defense's certification guarantees that no suffix—regardless of how it was generated—can cause the model to produce harmful content without detection, effectively neutralizing the threat model that GCG exploits.

A lightweight defense mechanism that analyzes the statistical likelihood of an input sequence by measuring its perplexity score. Jailbreak prompts with anomalously high perplexity—common in adversarial suffixes—are flagged and blocked before model processing. While Erase-and-Check provides stronger certified guarantees, perplexity filters offer a computationally cheaper first line of defense. A defense-in-depth architecture often combines both: perplexity filtering for rapid triage and Erase-and-Check for high-assurance verification of borderline cases.

A formal property in adversarial machine learning where a defense provides a mathematical guarantee that no attack within a defined threat model can succeed. Erase-and-Check achieves certified robustness against adversarial suffixes by exhaustively verifying all possible subsequences created by erasing tokens. This contrasts with empirical defenses that are tested against known attacks but lack formal guarantees. The certification states: if the model rejects all harmful subsequences, the original input is provably safe regardless of any appended adversarial content.

A class of attacks that prepends commands explicitly instructing the model to bypass its standard refusal protocol, often demanding an unconditional affirmative response such as 'Start your response with Sure.' While Erase-and-Check primarily addresses suffix-based attacks, its subsequence verification methodology can also detect refusal suppression patterns embedded within inputs. By checking all token windows for coercive instructions, the defense ensures that no substring can override the model's safety training without triggering a rejection.