SmoothLLM

The core defense mechanism generates N perturbed copies of the original input prompt by randomly inserting, deleting, swapping, or replacing characters at controlled rates. This perturbation process disrupts the precise token alignment that adversarial suffixes rely on, effectively neutralizing the optimized attack string without requiring knowledge of the specific attack method. The perturbation rate is calibrated to degrade adversarial sequences while preserving semantic meaning for legitimate queries.

After generating responses for all perturbed copies, SmoothLLM analyzes the semantic variance across the output distribution. Benign prompts produce consistent, semantically similar responses regardless of minor character perturbations. In contrast, adversarial suffixes exhibit high output variance because the perturbation disrupts the fragile token sequence that coerces the model into harmful behavior. A statistical threshold on this variance score determines whether the input is blocked or allowed to proceed.

SmoothLLM provides provable robustness guarantees derived from randomized smoothing theory. The defense certifies that for any adversarial suffix within a defined perturbation radius, the model's output distribution remains statistically indistinguishable from its behavior on clean inputs. This certification is attack-agnostic—it holds against GCG attacks, AutoDAN, PAIR, and other optimization-based jailbreak methods without requiring retraining or attack-specific countermeasures.

Unlike safety alignment methods such as RLHF or Constitutional AI, SmoothLLM operates entirely at inference time with no model modification required. The defense wraps around any existing language model as a stateless input-output filter, making it immediately deployable on production systems. This design preserves the model's underlying capabilities and avoids the safety alignment tax that often degrades performance on benign tasks.

SmoothLLM functions as a critical component within a defense-in-depth architecture. It complements input-side defenses like perplexity filters and Erase-and-Check by operating at the semantic level rather than relying on token-level heuristics. When combined with system message hardening and output-side content filters, SmoothLLM provides a statistically grounded detection layer that catches attacks which evade simpler pattern-matching defenses.

The defense exposes tunable parameters that allow security teams to balance latency overhead against detection sensitivity. Increasing the number of perturbed copies (N) improves the statistical power of variance detection but multiplies inference costs linearly. Production deployments typically use N=10 with optimized batching to maintain acceptable response times. The perturbation rate can also be adjusted based on the threat model—higher rates provide stronger guarantees against longer adversarial suffixes.