GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models

Md Jueal Mia; Joaquin Molto; Yanzhao Wu; M. Hadi Amini

cs.CRMar 28, 2026

GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models

Authors: Md Jueal Mia, Joaquin Molto, Yanzhao Wu, M. Hadi Amini

Organizations: Knight Foundation School of Computing and Information Sciences Florida International University Miami, FL, USA · Security, Optimization, and Learning for InterDependent networks laboratory (solid lab) Florida International University Miami, FL, USA

Abstract

Small Language Models (SLMs) are emerging as efficient and economically viable alternatives to Large Language Models (LLMs), offering competitive performance with significantly lower computational costs and latency. These advantages make SLMs suitable for resource-constrained and efficient deployment on edge devices. However, existing jailbreak defenses show limited robustness against heterogeneous attacks, largely due to an incomplete understanding of the internal representations across different layers of language models that facilitate jailbreak behaviors. In this paper, we conduct a comprehensive empirical study on 9 jailbreak attacks across 7 SLMs and 3 LLMs. Our analysis shows that SLMs remain highly vulnerable to malicious prompts that bypass safety alignment. We analyze hidden-layer activations across different layers and model architectures, revealing that different input types form distinguishable patterns in the internal representation space. Based on this observation, we propose GUARD-SLM, a lightweight token activation-based method that operates in the representation space to filter malicious prompts during inference while preserving benign ones. Our findings highlight robustness limitations across layers of language models and provide a practical direction for secure small language model deployment.

Figures & tables

Figure 1: Jailbreak attack on aligned vs non-aligned SLMs.

Figure 2: Overview of proposed GUARD-SLM framework.

Panel of Table 1 — Table 1: Attack Success Rate (ASR) across jailbreak attacks on SLMs. Models: LLaMA-2 (meta-llama/Llama-2-7b-chat-hf), Vicuna (lmsys/vicuna-7b-v1.5), Mistral (mistralai/Mistral-7B-Instruct-v0.2), Yi (01-ai/Yi-6B-Chat), Qwen (Qwen/Qwen1.5-7B-Chat), Gemma (google/gemma-7b-it), OpenChat (openchat/openchat-3.5-0106). Dataset:AdvBench Evaluator: GPT-4o-mini

Panel of Table 2 — Table 2: Attack Success Rate (ASR) across jailbreak attacks on LLMs. Models: LLaMA-2-13B, Vicuna-13B, Qwen-1.5-14B. Dataset: AdvBench. Evaluator: GPT-4o-mini

Panel of Figure 3 — Figure 3: t-SNE visualization of LLaMA-7B activations showing early, middle, and late layer representations.

Figure 4: Attack detection accuracy in the representation space using GUARD-SLM across early layers (0–10), Dataset: HarmBench, model: meta- llama/Llama-2-7b-chat-hf

Panel of Table 3 — Table 3: ASR(%) comparison of different defense methods against different jailbreak attacks, model: meta-llama/Llama-2-7b-chat-hf, dataset: HarmBench, judge model: gpt-4o

Defense	Additional Tokens (In/Out)	Avg. Inf. Time
SelfEval	+51	8.24s
SelfReminder	+44	1.12s
RobustAlign	$(n-1)q$	12.45s
SmoothLLM	$(n-1)q$	38.07s
ICD	+805	1.13s
Aligner	+42	4.90s

Table 4: Efficiency comparison of different defense methods.

n

denotes the number of queries for single forward pass and

q

denotes the number of tokens per query.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

GPU Model	No. of GPUs	GPU Memory
NVIDIA H100	Multiple Nodes	80 GB HBM3
NVIDIA RTX A6000	2	48 GB
NVIDIA A100 PCIe	4	80 GB
NVIDIA A100 PCIe	8	40 GB

Appendix

Table 5: Hardware configuration used in the experiments

Category	Count
Benign	52,000
Direct Malicious	32,490
AutoDAN	1,370
Cipher	2,080
CodeChameleon	520
DeepInception	520

Appendix

Table 6: Data distribution of benign, malicious, and optimized jailbreak samples used for activation analysis.

Phase	Hyperparameter	Value
Activation extraction	Maximum input tokens	512
	Hidden representation used	Last-token activation from all transformer layers
	Layer grouping	Early: first 40% layers, Middle: 40%–70%, Late: remaining layers
	Precision	FP16 on GPU, FP32 on CPU
t-SNE visualization	Selected classes	benign, malicious, autodan, cipher, codechamelon, deepinception, gcg, ica, jailbroken, pair, tap
	PCA before t-SNE	128 dimensions

Appendix

Table 7: Hyperparameters used for GUARD-SLM.

Panel of Table 8 — Table 8: Attack Success Rate (ASR) across jailbreak attacks on SLMs. Models: LLaMA-2 (meta-llama/Llama-2-7b-chat-hf), Vicuna (lmsys/vicuna-7b-v1.5), Mistral (mistralai/Mistral-7B-Instruct-v0.2), Dataset: HarmBench, Evaluator: GPT-4o-mini

Panel of Figure 5 — Figure 5: t-SNE visualization of last-token activations across all layers (Layer 0 to Layer 31) of LLaMA-7B.

Panel of Figure 6 — Figure 6: t-SNE visualization across layers 0–31 of Vicuna-7B

Panel of Figure 7 — Figure 7: t-SNE visualization across layers 0–31 of Mistral-7B

Figure 8: Attack detection accuracy in the representation space using GUARD-SLM across early layers (0–10), Dataset: HarmBench , model: meta- llama/Llama-2-7b-chat-hf

Figure 9: Attack detection accuracy in the representation space using GUARD-SLM across middle layers (11–21), Dataset: HarmBench, model: meta- llama/Llama-2-7b-chat-hf

Figure 10: Attack detection accuracy in the representation space using GUARD-SLM across late layers (22–31), Dataset: HarmBench, model: meta- llama/Llama-2-7b-chat-hf

	Acc(%) on HarmBench			Acc(%) on AutoDAN
Layers	LLaMA-7B	Vicuna-7B	Mistral-7B	LLaMA-7B	Vicuna-7B	Mistral-7B
0	53.00%	50.00%	52.52%	100.0%	100.0%	100.0%
1	52.50%	53.50%	58.50%	100.0%	100.0%	100.0%
2	62.00%	62.50%	68.50%	100.0%	100.0%	100.0%
3	66.50%	69.50%	71.50%	100.0%	100.0%	100.0%
4	75.50%	76.00%	77.50%	100.0%	100.0%	100.0%

Appendix

Table 9: Layer-wise jailbreak detection accuracy using GUARD-SLM across LLaMA-7B, Vicuna-7B, and Mistral-7B models.

	Acc(%) on PAIR			Acc(%) on TAP
Layers	LLaMA-7B	Vicuna-7B	Mistral-7B	LLaMA-7B	Vicuna-7B	Mistral-7B
0	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
1	100.0%	99.50%	100.0%	100.0%	100.0%	100.0%
2	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
3	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
4	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%

Appendix

Table 10: Layer-wise jailbreak detection accuracy using GUARD-SLM across LLaMA-7B, Vicuna-7B, and Mistral-7B models.

	Acc(%) on GCG			Acc(%) on Cipher
Layers	LLaMA-7B	Vicuna-7B	Mistral-7B	LLaMA-7B	Vicuna-7B	Mistral-7B
0	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
1	100.0%	100.0%	99.50%	100.0%	100.0%	100.0%
2	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
3	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
4	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%

Appendix

Table 11: Layer-wise jailbreak detection accuracy using GUARD-SLM across LLaMA-7B, Vicuna-7B, and Mistral-7B models.

	Acc(%) on DeepInception			Acc(%) on CodeChameleon
Layers	LLaMA-7B	Vicuna-7B	Mistral-7B	LLaMA-7B	Vicuna-7B	Mistral-7B
0	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
1	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
2	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
3	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%
4	100.0%	100.0%	100.0%	100.0%	100.0%	100.0%

Appendix

Table 12: Layer-wise jailbreak detection accuracy using GUARD-SLM on DeepInception and CodeChameleon attacks across LLaMA-7B, Vicuna-7B, and Mistral-7B models.

	Acc(%) on ICA			Acc(%) on Jailbroken
Layers	LLaMA-7B	Vicuna-7B	Mistral-7B	LLaMA-7B	Vicuna-7B	Mistral-7B
0	100.0%	100.0%	100.0%	86.36%	87.64%	86.50%
1	100.0%	100.0%	100.0%	88.57%	85.33%	88.02%
2	100.0%	100.0%	100.0%	86.97%	86.03%	80.60%
3	100.0%	100.0%	100.0%	84.78%	85.50%	86.66%
4	100.0%	100.0%	100.0%	86.14%	87.03%	93.21%

Appendix

Table 13: Layer-wise jailbreak detection accuracy using GUARD-SLM on ICA and Jailbroken attacks across LLaMA-7B, Vicuna-7B, and Mistral-7B models.

Jailbreak Defense

Jailbreak defense studies how to stop adversarial prompts from eliciting harmful outputs while preserving helpful behavior.

See all 60 papers

Exploring and Developing a Pre-Model Safeguard with Draft Models
May 19, 2026Hongyu Cai, Arjun Arunasalam, Yiming Liang +2LLM Guardrails Safety Filtering
Purdue University West Lafayette, Indiana, USA · Florida International University Miami, Florida, USA
Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing
May 11, 2026Zheng Lin, Zhenxing Niu, Haoxuan Ji +1Randomized Smoothing Jailbreak Robustness
Xidian University · Xi’an Jiaotong University
Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads
Mar 6, 2026Jinman Wu, Yi Xie, Shiqian Zhao +1Adversarial Attacks on LLMs LLM Jailbreak Attacks
Xidian University, Xi’an, China · Tsinghua University, Shenzhen, China · Nanyang Technological University, Singapore

May 19, 2026J/K move · Enter open · S save

Exploring and Developing a Pre-Model Safeguard with Draft Models

Hongyu Cai, Arjun Arunasalam, Yiming Liang, Antonio Bianchi+1

Purdue University West Lafayette, Indiana, USA · Florida International University Miami, Florida, USA

LLM Guardrails Safety Filtering LLM Jailbreak Attacks Jailbreak Detection Jailbreak Defense LLM Safety Monitoring

Open paper AskPDF arXiv

Large Language Model (LLM) alignment remains vulnerable to jailbreak attacks that elicit unsafe responses, motivating pre-model and post-model guards. Pre-model guards audit the safety of prompts before invoking target models. However, relying solely on the prompt often leads to high false-negative rates (i.e., jailbreak attacks go undetected). Post-model guards address this issue by auditing both the user prompt and the target model's response. However, they incur a high computational cost, including increased token usage and processing time, because they operate after target model inference. In this paper, we introduce a safeguard design that leverages the transferability of jailbreak attacks to enforce prompt safety before target model inference. We first conduct a systematic study of jailbreak transferability, particularly from LLMs to small language models (SLMs). Through these experiments, we identify key factors influencing transferability. Building on these insights, we observe that responses from smaller draft models reflect the safety implications of those from large target models; \ie given a jailbreak prompt constructed for an LLM, an SLM is likely to be triggered to generate an unaligned response. Based on this observation, our safeguard design leverages speculative inference with SLMs to generate a set of draft responses. It then feeds the original prompt and these drafts into existing guards to predict their safety. We demonstrate that this design reduces the false-negative rate of pre-model guards and offers a low \Efficiency alternative to post-model guards. \textcolor{red}{\bf Notice: This paper contains examples of harmful language.}

Abstract

Jailbreak Defense

Explore similar work

Exploring and Developing a Pre-Model Safeguard with Draft Models

Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing

Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads