TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

Cheng Liu; Xiaolei Liu; Xingyu Li; Bangzhou Xin; Kangyi Ding

cs.CRApr 9, 2026

TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

Authors: Cheng Liu, Xiaolei Liu, Xingyu Li, Bangzhou Xin, Kangyi Ding

Organizations: National Interdisciplinary Research Center of Engineering Physics

Abstract

Existing jailbreak defense paradigms primarily rely on static detection of prompts, outputs, or internal states, often neglecting the dynamic evolution of risk during decoding. This oversight leaves risk signals embedded in decoding trajectories underutilized, constituting a critical blind spot in current defense systems. In this work, we empirically demonstrate that hidden states in critical layers during the decoding phase carry stronger and more stable risk signals than input jailbreak prompts. Specifically, the hidden representations of tokens generated during jailbreak attempts progressively approach high-risk regions in the latent space. Based on this observation, we propose TrajGuard, a training-free, decoding-time defense framework. TrajGuard aggregates hidden-state trajectories via a sliding window to quantify risk in real time, triggering a lightweight semantic adjudication only when risk within a local window persistently exceeds a threshold. This mechanism enables the immediate interruption or constraint of subsequent decoding. Extensive experiments across 12 jailbreak attacks and various open-source LLMs show that TrajGuard achieves an average defense rate of 95%. Furthermore, it reduces detection latency to 5.2 ms/token while maintaining a false positive rate below 1.5%. These results confirm that hidden-state trajectories during decoding can effectively support real-time jailbreak detection, highlighting a promising direction for defenses without model modification.

Figures & tables

Figure 1: Static masking and dynamic unmasking of jailbreak risk in hidden space. A masked jailbreak prompt is embedded near benign prompts but leads the reply prefixes to gradually move from the benign region into the harmful region.

Figure 2: Comparative jailbreak dynamics across models. The curves show the average geometric score

s_{t}

over decoding steps

t

. The grey dashed line is the benign baseline, while the colored solid curves correspond to jailbreak trajectories on three models. The shaded bands indicate the benign region and the harmful region.

Figure 3: Overview. TrajGuard monitors hidden-state trajectories in real time via the SGS module and triggers the semantic PAIR-Judge for interception only when a sustained risk drift is detected.

Target Model	Defense Method	Attack Success Rate ( $\downarrow$ )
Target Model	Defense Method	GCG	AutoDAN	AIM	Cipher	Jailbroken	PAIR	ReneLLM	ICA	GPTFuzz	Multi.	DeepInc.	Actor	AVG
Llama-2-7B -chat-hf	No Defense	0.96	0.68	0.01	0.16	0.30	0.59	0.71	0.34	0.83	0.38	0.62	0.68	0.52
	Llama Guard 3	0.02	0.01	0.00	0.16	0.23	0.22	0.25	0.00	0.69	0.08	0.56	0.22	0.20
	Self-Guard	0.24	0.36	0.01	0.15	0.14	0.12	0.26	0.00	0.13	0.32	0.29	0.18	0.18
	Goal Prioritization	0.00	0.07	0.01	0.16	0.10	0.06	0.31	0.00	0.00	0.03	0.06	0.09	0.07
	Qwen3Guard	0.00	0.00	0.00	0.13	0.06	0.00	0.10	0.00	0.00	0.00	0.31	0.19	0.07

Table 1: Attack Success Rates (ASR) of different defenses under various jailbreak attacks. The best results are bolded in blue and the second-best results are underlined.

Defense Method	FPR (%) $\downarrow$		Efficiency $\downarrow$
Defense Method	Alpaca	XSTest	Latency
No Defense	0.00	37.0	0.0
Llama Guard 3	0.00	+ 8.40	+ 38.5
Self-Guard	7.50	+ 14.80	+ 24.6
Goal Prioritization	13.00	+ 20.40	$<$ 0.1
Qwen3Guard	0.00	+ 12.40	+ 42.8

Table 2: Efficiency (Vicuna-7B). FPR on Alpaca and XSTest. Latency overhead (ms/token).

Figure 4: Comparison of average detection steps (blue bars, left axis) and PAIR-judge calls (red line, right axis) per sample across 12 attack methods. Lower values indicate superior efficiency for both metrics.

Defense Method	Trigger Frequency (Calls / Query) $\downarrow$
Defense Method	Alpaca (Benign)	XSTest (Safety)
Llama Guard 3	1.00	1.00
Qwen3Guard	1.00	1.00
TrajGuard (Ours)	0.06	0.47

Table 3: Sparsity Analysis (Vicuna-7B). The average Trigger Frequency on benign datasets.

Configuration	FPR $\downarrow$	Latency(per-sample) $\downarrow$
w/o PAIR-Judge	+ 18.4%	+ 0.8 ms
w/o SGS	+ 1.0%	+ 750.2 ms
TrajGuard (Full)	+ 1.0%	+ 189.9 ms

Table 4: Ablation results of TrajGuard on Vicuna-7B, reporting FPR on XSTest and Alpaca, and end-to-end average latency (max_new_tokens=128).

Attack Method	ASR
Attack Method	Llama-2-7B	Llama-3.1-8B	Mistral-7B	Vicuna-7B
Cipher	0.04	0.06	0.10	0.07
DeepInception	0.02	0.02	0.06	0.00

Table 5: Attack Success Rate (ASR) of TrajGuard when employing Qwen3Guard-8B as the PAIR-Judge.

Figure 5: ASR versus average Trigger Frequency (TF) when sweeping the TrajGuard threshold $\gamma$ , evaluated against the GCG jailbreak attack on Vicuna-7B.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 6 — Figure 6: Hidden-state Mahalanobis-distance patterns for Llama-2-7B-chat and Llama-3.1-8B-Instruct. The upper two rows correspond to Llama-2-7B and the lower two rows to Llama-3.1-8B. Within each model block, the top row shows, for benign prompts, explicitly malicious prompts, and prompts from multiple jailbreak methods, the distributions of Mahalanobis distances at selected critical layers with respect to a benign reference distribution. The bottom row shows the corresponding Mahalanobis-distance trajectories along decoding steps for successful jailbreak generations, including both full responses and sliced prefixes.

Panel of Figure 7 — Figure 7: Hidden-state Mahalanobis-distance patterns for Mistral-7B and Vicuna-7B. The upper subfigure corresponds to Mistral-7B and the lower subfigure to Vicuna-7B. For each model, the top row reports Mahalanobis-distance distributions at selected critical layers for benign prompts, explicitly malicious prompts, and prompts produced by representative jailbreak methods, measured against a benign reference distribution. The bottom row plots the streaming Mahalanobis-distance trajectories over decoding steps for successful jailbreak responses, including full generations and sliced prefixes.

Parameter	Value	Description
$R$ / $k$	$64$ / $3$	PCA dimension / Context averaging length.
$K$	$8$	Number of monitored (critical) layers.
$R_{H}$ quantile	$0.9$	Malicious-boundary quantile (for MVD/analysis).
$w$	$8$	Sliding window size in SGS aggregation.
$\lambda$	$0.8$	EWMA factor in code; corresponds to $\alpha=1-\lambda$ in the paper form.
$m$	$3$	Consecutive steps for persistence trigger.

Appendix

Table 6: Hyperparameter settings for reproducibility (SGS-consistent).

Target Model	Defense Method	GCG	AutoDAN	AIM	Cipher	Jailbroken	PAIR	ReneLLM	ICA	GPTFuzz	Multi.	DeepInc.	Actor	AVG
Qwen3-32B	TrajGuard (Ours)	0.00	0.01	0.00	0.18	0.07	0.02	0.08	0.00	0.00	0.06	0.11	0.10	0.05

Appendix

Table 7: Attack Success Rate (ASR) of defenses on Qwen3-32B.

Param	Value	ASR (%) $\downarrow$	FPR (%) $\downarrow$
$w$	4	0.07	+ 2.4
	8 (default)	0.05	+ 1.5
	12	0.03	+ 1.3
$m$	1	0.02	+ 8.9
	3 (default)	0.05	+ 1.5
	5	0.10	+ 0.8

Appendix

Table 8: Hyperparameter sensitivity analysis on Vicuna-7B. Each parameter is swept independently while others remain at defaults (

w{=}8

\lambda{=}0.8

m{=}3

). Shaded rows indicate defaults.

Panel of Figure 8 — Figure 8: Case study of real-time interception against a Jailbreak attack. (a) The stream of decoded content, illustrating how the attack masks malicious intent within a benign framing. (b) The corresponding trajectory of the Safety ( $P_{t}$ ). The trajectory clearly demonstrates the revealing effect, reaching a threshold (trigger) after step 16, at which point SGS triggers PAIR-Judge to stop generating.

Panel of Figure 9 — Figure 9: Case Study 2: Benign Interaction. (a) The user asks a standard historical question, and the model generates a detailed response. (b) The streaming safety score ( $P_{t}$ , orange line) fluctuates but remains consistently below the trigger threshold (dotted lines). TrajGuard correctly identifies this as low-risk, allowing the generation to proceed uninterrupted, demonstrating the system’s low false-positive rate.

Figure 10: Visualization of activation boundaries on Llama-2-7B-chat. We plot the Mahalanobis distances to benign ( $d_{B}$ ) and harmful ( $d_{H}$ ) centers. Colors denote Benign (Green), Malicious (Red), and Attacks (Blue). Inset histograms of the margin ( $m=d_{B}-d_{H}$ ) demonstrate clear separability between safe and unsafe representations.

Jailbreak Detection

Jailbreak detection identifies prompts and conversational strategies that try to bypass language models’ safety safeguards.

See all 36 papers

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning
Apr 30, 2026Bowen Sun, Chaozhuo Li, Yaodong Yang +2Jailbreak Attacks LLM Security
Johns Hopkins University · Microsoft Research Asia · Peking University +1
SafeDream: Safety World Model for Proactive Early Jailbreak Detection
Apr 18, 2026Bo Yan, Weikai Lin, Yada Zhu +1Language Model Safety Evaluation World Models
University of Central Florida · University of Rochester · IBM Research
DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization
Dec 10, 2024Xiaoqun Liu, Weiming Qi, Qiben YanAdversarial Robustness of Language Models LLM Jailbreak Attacks
Michigan State University, East Lansing, MI 48824, USA

Apr 30, 2026J/K move · Enter open · S save

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

Bowen Sun, Chaozhuo Li, Yaodong Yang, Yiwei Wang+1

Johns Hopkins University · Microsoft Research Asia · Peking University+1

Jailbreak Attacks LLM Security LLM Jailbreak Attacks Jailbreak Detection Jailbreak Defense

Open paper AskPDF arXiv

Decompositional jailbreaks pose a critical threat to large language models (LLMs) by allowing adversaries to fragment a malicious objective into a sequence of individually benign queries that collectively reconstruct prohibited content. In real-world deployments, LLMs face a continuous, untraceable stream of fully anonymized and arbitrarily interleaved requests, infiltrated by covertly distributed adversarial queries. Under this rigorous threat model, state-of-the-art defensive strategies exhibit fundamental limitations. In the absence of trustworthy user metadata, they are incapable of tracking global historical contexts, while their deployment of generative models for real-time monitoring introduces computationally prohibitive overhead. To address this, we present TwinGate, a stateful dual-encoder defense framework. TwinGate employs Asymmetric Contrastive Learning (ACL) to cluster semantically disparate but intent-matched malicious fragments in a shared latent space, while a parallel frozen encoder suppresses false positives arising from benign topical overlap. Each request requires only a single lightweight forward pass, enabling the defense to execute in parallel with the target model's prefill phase at negligible latency overhead. To evaluate our approach and advance future research, we construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents. Evaluated on this large-scale corpus under a strictly causal protocol, TwinGate achieves high malicious intent recall at a remarkably low false positive rate while remaining highly robust against adaptive attacks. Furthermore, our proposal substantially outperforms stateful and stateless baselines, delivering superior throughput and reduced latency.

Abstract

Jailbreak Detection

Explore similar work

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

SafeDream: Safety World Model for Proactive Early Jailbreak Detection

DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization