Security Assessment and Mitigation Strategies for Large Language Models: A Comprehensive Defensive Framework

Taiwo Onitiju; Iman Vakilinia

cs.CRMar 17, 2026

Security Assessment and Mitigation Strategies for Large Language Models: A Comprehensive Defensive Framework

Authors: Taiwo Onitiju, Iman Vakilinia

Organizations: School of Computing, University of North Florida

Abstract

Large Language Models increasingly power critical infrastructure from healthcare to finance, yet their vulnerability to adversarial manipulation threatens system integrity and user safety. Despite growing deployment, no comprehensive comparative security assessment exists across major LLM architectures, leaving organizations unable to quantify risk or select appropriately secure LLMs for sensitive applications. This research addresses this gap by establishing a standardized vulnerability assessment framework and developing a multi-layered defensive system to protect against identified threats. We systematically evaluate five widely-deployed LLM families GPT-4, GPT-3.5 Turbo, Claude-3 Haiku, LLaMA-2-70B, and Gemini-2.5-pro against 10,000 adversarial prompts spanning six attack categories. Our assessment reveals critical security disparities, with vulnerability rates ranging from 11.9% to 29.8%, demonstrating that LLM capability does not correlate with security robustness. To mitigate these risks, we develop a production-ready defensive framework achieving 83% average detection accuracy with only 5% false positives. These results demonstrate that systematic security assessment combined with external defensive measures provides a viable path toward safer LLM deployment in production environments.

Figures & tables

Strategy	Protection Mechanism	Key Advantages
Input Sanitization [ 15 ]	Prevents malicious patterns from reaching LLM	Minimal latency overhead
Semantic Analysis [ 14 ]	Detects intent-based manipulation	Robust against obfuscation
Output Validation [ 16 ]	Ensures safe responses	Last-line defense
Ensemble Defense [ 10 ]	Multiple validation layers	Comprehensive protection

TABLE I : Defensive Strategy Categories

Fig. 1 : Jailbreak Prompts Taxonomy Tree showing six major categories and fifteen subcategories.

LLM	Provider	Key Characteristics
GPT-4	OpenAI	Advanced reasoning, strong safety training
GPT-3.5 Turbo	OpenAI	Cost-optimized, moderate safety measures
Claude-3 Haiku	Anthropic	Constitutional AI, safety-focused
LLaMA-2-70B	Meta	Open-source, research-oriented
Gemini-2.5-pro	Google	Multimodal, enterprise-focused

TABLE II : Evaluated LLMs

Fig. 2 : Multi-layer defensive framework architecture showing sequential processing through pattern-based screening, semantic analysis, behavioral classification, and active learning integration. Each layer provides progressively deeper analysis while maintaining low latency for production deployment.

Feature	Definition
$R$	Role Impersonation: Measures similarity to malicious personas
$H$	Hypothetical Language: Quantifies scenario fabrication indicators
$O$	Obfuscation: Counts syntactic evasion attempts
$PE$	Privilege Escalation: Detects system-level exploitation
$MA$	Multi-Agent: Identifies collaborative attack structures
$SB$	Semantic Bypass: Measures justification and framing attempts

TABLE III : Feature Notation and Definitions

Category	R	H	O	PE	MA	SB	U	EV
Role Impersonation	0.70	0	0	0	0	0	0	0.30
Logic Subversion	0	0.50	0	0	0.20	0.30	0	0
Obfuscation	0	0	1.0	0	0	0	0	0
Privilege Escalation	0	0	0	1.0	0	0	0	0
Social Engineering	0	0	0	0	0	0	1.0	0

TABLE IV : Optimized Feature Weight Matrix by Attack Category

Attack Category	Threshold ( $\tau_{C}$ )
Role Impersonation	0.65
Logic Subversion	0.45
Obfuscation	0.30
Privilege Escalation	0.25
Social Engineering	0.20

TABLE V : Category-Specific Detection Thresholds

LLM	Vulnerability Rate	Refusal Rate	Avg Response Length	True Positives
Gemini-2.5-pro	29.8%	44.5%	2,592	596
GPT-3.5 Turbo	24.8%	43.0%	562	495
GPT-4	23.4%	55.6%	656	468
Claude-3 Haiku	21.5%	60.2%	844	430
LLaMA-2-70B	11.9%	56.2%	894	237

TABLE VI : Cross-LLM Vulnerability Assessment (n=2,000 per LLM)

Fig. 3 : Stacked bar chart comparing jailbreak success rates (vulnerability) and refusal rates across the five evaluated LLM architectures. LLMs like LLaMA-2-70B achieve low vulnerability through balanced refusal policies, while GPT-4 demonstrates effective discrimination between adversarial and legitimate queries.

Technique	GPT-4	GPT-3.5	Claude	LLaMA	Gemini
Privilege Escalation	25.0%	100.0%	25.0%	0.0%	75.0%
Logic Subversion	50.0%	50.0%	0.0%	0.0%	25.0%
Obfuscation	20.9%	22.9%	19.0%	11.1%	29.1%
Role Impersonation	6.9%	20.7%	6.9%	6.9%	37.9%
Social Engineering	33.3%	16.7%	33.3%	16.7%	33.3%

TABLE VII : Attack Technique Effectiveness by LLM

Fig. 4 : Heatmap visualizing the effectiveness of different jailbreak techniques against each LLM architecture. Warmer colors indicate higher success rates, clearly showing Gemini-2.5-pro’s broader susceptibility across multiple attack categories.

Attack Category	Detection Rate	False Positive Rate	Protection Score
Role Impersonation	94%	3%	0.91
Privilege Escalation	91%	4%	0.88
Obfuscation	85%	7%	0.81
Logic Subversion	82%	5%	0.80
Data Exfiltration	79%	5%	0.76
Social Engineering	68%	6%	0.70

TABLE VIII : Defensive Detection Performance by Attack Type

Fig. 5 : Scatter plot showing relationship between LLM response length and jailbreak success rate. Gemini-2.5-pro’s verbose responses (averaging 2,592 characters) correlate with higher vulnerability, suggesting that response length does not indicate better safety alignment.

Fig. 6 : Box plot distribution of response lengths across evaluated LLMs, showing Gemini-2.5-pro’s significantly higher median and variance compared to other architectures.

Panel of Figure 15 — Fig. 7 : Confusion matrices comparing detection performance across five major LLM architectures. Each matrix shows true positive, false positive, true negative, and false negative rates for jailbreak classification, providing detailed insight into the defensive framework’s performance per LLM.

Processing Component	Average Latency (ms)	Percentage of Total
Input Sanitization	2.3	15%
Pattern Recognition	3.1	20%
Feature Extraction	5.8	38%
Semantic Analysis	3.7	24%
Classification Decision	0.5	3%
Total Processing Time	15.4	100%

TABLE IX : System Performance Metrics

Legitimate Use Case	Sample Size	False Positive Rate
Technical Documentation	100	3%
Educational Content	90	4%
Creative Writing	80	7%
Role-Playing Games	50	12%
Hypothetical Discussions	40	9%
Code Generation	40	2%

TABLE X : False Positive Rates by Legitimate Use Case (n=400 benign)

Defense Method	Detection Rate	False Positive Rate	Processing Time
Commercial Moderation APIs	67-71%	11-15%	180-220ms
PromptShield [ 11 ]	78%	8%	20ms
Open-Source Detoxify	64%	9%	45ms
SecurityLingua [ 25 ]	80%	7%	12ms
Our Framework	83%	5%	15ms

TABLE XI : Comparison with Existing Defense Approaches

Explore similar work

Where Do LLM-based Systems Break? A System-Level Security Framework for Risk Assessment and Treatment
Mar 8, 2026Neha Nagaraja, Hayretdin BahsiLLM Security Cybersecurity
School of Informatics, Computing, and Cyber Systems, Northern Arizona University, Flagstaff, USA · Department of Software Science, Tallinn University of Technology, Tallinn, Estonia
A Red Teaming Framework for Large Language Models: A Case Study on Faithfulness Evaluation
Jun 24, 2026Abrar Alotaibi, Raed Mughus, Moataz AhmedMultilingual Language Model Evaluation LLM Evaluation
Information and Computer Science Department, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia. · College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, Dammam, 31441, Saudi Arabia. · SDAIA-KFUPM Joint Research Center for Artificial Intelligence, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia.
Data Security in Large Language Models: Risks, Defense, and Directions
Aug 4, 2025Kang Chen, Xiuze Zhou, Yuanhui Yu +4Adversarial Attacks on LLMs LLM Security
School of Computer Engineering, Jimei University, Xiamen, 361021, China · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, 511453, China · School of Informatics, Xiamen University, Xiamen, 361102, China +1

Mar 8, 2026J/K move · Enter open · S save

Where Do LLM-based Systems Break? A System-Level Security Framework for Risk Assessment and Treatment

Neha Nagaraja, Hayretdin Bahsi

School of Informatics, Computing, and Cyber Systems, Northern Arizona University, Flagstaff, USA · Department of Software Science, Tallinn University of Technology, Tallinn, Estonia

LLM Security Cybersecurity

Open paper AskPDF arXiv

Large Language Models (LLMs) are increasingly integrated into safety-critical workflows, yet existing security analyses remain fragmented and often isolate model behavior from the broader system context. This work introduces a goal-driven risk assessment framework for LLM-powered systems that combines system modeling with Attack-Defense Trees (ADTrees) and Common Vulnerability Scoring System (CVSS)-based exploitability scoring to support structured, comparable analysis. We demonstrate the framework through a healthcare case study, modeling multi-step attack paths targeting intervention in medical procedures, leakage of electronic health record (EHR) data, and disruption of service availability. Our analysis indicates that threats spanning (i) conventional cyber, (ii) adversarial ML, and (iii) conversational attacks that manipulate prompts or context often consolidate into a small number of dominant paths and shared system choke points, enabling targeted defenses to yield meaningful reductions in path exploitability. By systematically comparing defense portfolios, we align these risks with established vulnerability management practices and provide a domain-agnostic workflow applicable to other LLM-enabled critical systems.

Abstract

Explore similar work

Where Do LLM-based Systems Break? A System-Level Security Framework for Risk Assessment and Treatment

A Red Teaming Framework for Large Language Models: A Case Study on Faithfulness Evaluation

Data Security in Large Language Models: Risks, Defense, and Directions