Perplexity Filter

Perplexity measures how surprised a language model is by a sequence of tokens. Legitimate user inputs follow predictable linguistic patterns with low perplexity scores, while jailbreak prompts—especially those with adversarial suffixes—exhibit high perplexity due to nonsensical token combinations. The filter computes the exponential of the average negative log-likelihood across the input sequence, flagging anything above a calibrated threshold.

• Normal text: "Explain the theory of relativity" → Low perplexity (10-50)
• Adversarial suffix: "describing." + \n=\n.\ntableView markdown" → High perplexity (1000+)
• Thresholds are tuned per deployment to balance false positives against detection rates

The filter operates by passing the input through a smaller, auxiliary language model (not the primary deployed model) to compute token-by-token probabilities. Each token receives a conditional probability given its preceding context. The geometric mean of these probabilities yields the perplexity score.

• Uses a GPT-2 or similar lightweight model for efficiency
• Computes log-likelihood per token in a single forward pass
• Detects token smuggling where forbidden words are split across unnatural token boundaries
• Identifies Base64-encoded payloads that produce high-entropy token distributions

Advanced perplexity filters employ a sliding window approach to detect adversarial content embedded within otherwise benign text. Rather than computing a single score for the entire prompt, the filter analyzes overlapping subsequences to catch localized anomalies.

• Window sizes typically range from 10-50 tokens
• Detects payload splitting attacks where malicious fragments are separated by benign filler
• Flags inputs where any subsequence exceeds the perplexity threshold
• Prevents attackers from hiding adversarial suffixes within long, normal-looking prompts

Perplexity filters are never deployed in isolation but as part of a layered security architecture. They act as a pre-inference gate that blocks anomalous inputs before they reach the primary model, conserving compute and preventing exposure to adversarial content.

• Positioned upstream of the main LLM inference pipeline
• Complements instruction hierarchy and system message hardening
• Feeds flagged inputs to secondary classifiers for deeper analysis
• Logs high-perplexity inputs for automated red teaming dataset curation
• Works alongside Erase-and-Check for certified guarantees against adversarial suffixes

Perplexity filters face specific blind spots that sophisticated attackers exploit. Many-shot jailbreaking uses hundreds of natural-language dialogue turns that maintain low perplexity while gradually eroding safety guardrails. Low-resource language exploits translate malicious prompts into languages where the auxiliary model has poor probability estimation.

• Crescendo attacks use benign, low-perplexity escalation sequences
• CipherChat instructions produce systematic but unnatural token patterns that may evade simple thresholds
• Context distraction floods the window with legitimate content to mask a small adversarial payload
• Mitigation requires ensemble approaches combining perplexity with semantic safety classifiers

SmoothLLM extends perplexity filtering by generating multiple character-level perturbations of the input and analyzing the variance in model responses. Adversarial suffixes are brittle—small perturbations destroy their effectiveness—while natural language is robust to minor changes.

• Creates 10-20 perturbed copies via random character swaps, insertions, or deletions
• Passes each copy through the target model and measures output disagreement
• High variance across perturbed copies indicates an adversarial input
• Provides certified robustness guarantees when combined with statistical testing
• Complements perplexity filters by catching attacks that maintain low perplexity