# Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinement

**Authors:** Heegyu Kim, Sehyun Yuk, Hyunsouk Cho  
**arXiv:** [2402.15180](https://arxiv.org/abs/2402.15180)  
**Date:** 2024-02-23  
**Summary page:** https://www.summarizepaper.com/en/paper/2402.15180v2/

## Key points

- Authors address vulnerability of language models (LMs) to jailbreak attacks
- Propose self-refinement method to enhance safety in non-safety-aligned LMs
- Introduce formatting method to streamline self-refinement process and reduce attack success rates
- Non-safety-aligned LMs outperform safety-aligned LMs in safety tasks, providing more helpful and safe responses
- Table 1 showcases tuning methods and MT Bench scores, showing non-safety-aligned LMs outperforming safety-aligned ones in vulnerability to jailbreak attacks
- Emphasize considering performance metrics and safety capabilities when evaluating LM defenses
- Curated dataset of 619 jailbreaking prompts, employed advanced search techniques to assess LM responses
- Implemented strategies like presenting responses alone to mitigate challenges with cost models misclassifying safe responses as harmful

## Summary

In their paper titled "Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinement," authors Heegyu Kim, Sehyun Yuk, and Hyunsouk Cho address the vulnerability of language models (LMs) to adversarial misuse in jailbreak attacks. They propose a self-refinement method that enhances safety even in non-safety-aligned LMs and demonstrate its effectiveness through evaluation against various defense baselines. The authors also introduce a formatting method that streamlines the self-refinement process and reduces attack success rates in fewer iterations. Surprisingly, they find that non-safety-aligned LMs outperform safety-aligned LMs in safety tasks by providing more helpful and safe responses. This observation highlights the potential benefits of leveraging non-safety LMs for real-world applications. Table 1 showcases the tuning methods and MT Bench scores of selected LMs, revealing that while some safety-aligned LMs have been fine-tuned for safety alignment, their performance lags behind non-safety-aligned counterparts like Zephyr-7b-beta and Starling-LM-7b-alpha in terms of vulnerability to jailbreak attacks. The authors emphasize considering both performance metrics and safety capabilities when evaluating LM defenses. Additionally, they curated a dataset of 619 jailbreaking prompts from various sources and employed advanced search techniques to assess LM responses to these prompts. Despite challenges with cost models misclassifying safe responses as harmful under certain conditions, the authors implemented strategies such as presenting responses alone to mitigate these issues. Overall, this study provides valuable insights into enhancing LM defenses against jailbreak attacks through self-refinement techniques.