A large language model jailbreaking prompt word detection method

Abstract

The application provides a novel jailbreak prompt detection framework, which realizes detection through two steps of activation and detection, and the core idea is to enhance the ability of the detector by using the inherent value defense mechanism of the large language model, so that the detector stands on the shoulders of the large language model. Specifically, in the activation stage, a special suffix is added to the input prompt to activate the inherent defense mechanism of the large language model, and the feature distribution difference between the jailbreak prompt and the benign prompt in the large language model is amplified. In the detection stage, a detection model based on CNN is designed to process the hidden features of the activated large language model layer to extract jailbreak and benign prototypes, thereby effectively detecting the candidate prompts. Through the application, the manufacturer of the large language model can detect whether the candidate prompt is a jailbreak prompt in only one inference time, greatly improving the efficiency and accuracy of the jailbreak detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of large language models, and particularly relates to a large language model jailbreak prompt word detection method. BACKGROUND

[0002] Large language models (LLMs) have achieved amazing results in many fields, however, a kind of attack named jailbreak attack can induce large language models to output harmful content through instruction prompts, and this attack can easily bypass the safety guardrails of large language models, causing a security threat to the application and development of large language models. Therefore, researchers detect jailbreak prompt words through the input of the model to effectively avoid the security hazards of large language models, and the jailbreak prompt word detection task plays a crucial role in ensuring the security and stability of large language models.

[0003] Existing detection methods for large language model jailbreak prompt words can be roughly divided into two categories: third-party discriminator-based methods and large language model feedback-based methods. The third-party discriminator-based method usually trains a classifier model using a jailbreak benchmark set, and uses the classifier model to make a security judgment on the given content, for example, using a fine-tuned API interface or a special Moderation LLM to detect input prompts. These methods usually classify the toxicity of the prompt or evaluate whether it is harmful or a jailbreak prompt word. For example, OpenAI Moderation APIs, as a special content safety review tool, fine-tune ChatGPT to detect harmful inputs. It classifies input text into 11 risk categories and provides a corresponding harm score. Similarly, Guard LLMs belong to a kind of discriminator model based on fine-tuning of large language models, such as Llama Guard fine-tuned from Llama model to judge the harmfulness of input content. However, these methods deviate from the value feedback of large language models during the fine-tuning process, only focusing on the toxicity of the input prompt itself, ignoring the interaction between the prompt word and the large language model, and thus leading to a decline in the accuracy of the detector's judgment. Due to the change of the original human value parameter based on reinforcement learning during the fine-tuning process, the value alignment deviation often leads to inaccurate judgment.

[0004] Meanwhile, the method based on the feedback of the large language model discriminates by using the values and reasoning mechanisms that the large language model has been trained to have, and judges and filters the feedback of the large language model to the given prompt. For example, the self-censoring ability of the large language model is utilized by performing prompt engineering on the large language model with zero or few samples, so that the large language model becomes a harmful content detector and evaluator. Some studies evaluate the responses generated by the large language model to obtain classification results. Similarly, GradeSafe compares the gradients of safe and unsafe prompts when the "Sure" label is used as the label. However, these methods are difficult to identify jailbreak attack prompt words that can bypass the defense mechanisms of the large language model, and the detection effect is not good for high-difficulty jailbreak prompt words. Moreover, these methods are inefficient in the reasoning process, because after confirming that the prompt is harmless, they need additional reasoning steps to provide feedback to the user, which causes unnecessary delay in processing benign requests. SUMMARY

[0005] To solve the above problems, the present application provides a novel detection method for jailbreak prompt words, which uses the inherent value defense mechanism of the large language model to enhance the ability of the detection model, so that the detection model stands on the shoulders of the large language model, including two steps of activation and detection. In the activation stage, a special suffix is added to the input prompt to activate the inherent defense mechanism of the large language model, and to amplify the feature distribution difference between the jailbreak prompt and the benign prompt in the large language model; in the detection stage, a CNN-based detector is designed to process the hidden features of the activated large language model layer to extract jailbreak and benign prototypes, thereby effectively detecting the candidate prompt words.

[0006] The present application provides a large language model jailbreak prompt word detection method, comprising:

[0007] S1, adding an activation suffix to the prompt word, inputting the prompt word with the added suffix into the large language model, and obtaining the representation features of the prompt word inside the large language model;

[0008] S2, inputting the representation features of the prompt word into the detection model to obtain the classification of the prompt word; wherein the detection model comprises a neural network, a pooling layer and a multilayer perceptron connected in sequence;

[0009] Preferably, it further comprises S3: after the detection model detects the to-be-detected prompt word and obtains the classification, if it is a benign prompt, the large language model is inputted again for further reasoning to return a normal response; if it is a jailbreak prompt word, a response of refusing to answer is returned.

[0010] Further, in step S1, the activation suffix is added by a specific instruction format, which aims to trigger the inherent defense mechanism of the large language model and enhance the feature distribution difference between the jailbreak prompt word and the benign prompt word.

[0011] Further, the method of adding an activation suffix is a thinking chain method, which requires the base model to decompose the query into a sub-task list by designing a thinking chain prompt word, and gradually execute the slow thinking task to generate a response.

[0012] Further, the method of adding an activation suffix is a sorting method, which requires the large language model to sort the given input prompt word as a whole according to toxicity and output according to the sorting.

[0013] Further, the method of adding an activation suffix is a confirmation method, which requires the large language model to confirm the harmlessness of the input before generating a response.

[0014] Further, the method of adding an activation suffix is a repetition method, which requires the large language model to repeat the response to the given request without affecting the normal output.

[0015] Further, the method of adding an activation suffix is a similarity method, which requires the large language model to perform a similar transformation on the prompt word before generating a response.

[0016] Further, in S1, the method of obtaining the representation features of the prompt word inside the large language model includes: obtaining the layer hidden state corresponding to the input, and stacking all the hidden layer states into a hidden layer state matrix.

[0017] Further, in S2, the training method of the detection model includes:

[0018] Adding an activation suffix to the prompt word of the data in the training set;

[0019] Input the prompt word with the added activation suffix into the large language model and obtain the hidden layer state matrix;

[0020] Hyperparameter adjustment is performed on the neural network;

[0021] Input the hidden layer state matrix into the detection model to output the prompt word classification, and then adjust the hyperparameters of the detection model through the backpropagation algorithm;

[0022] The above process is repeated to obtain the final detection model.

[0023] Further, in the output prompt word classification process, the calculation method of the detection model loss function is:

[0024]

[0025] Where p k is the feature of the extracted prompt word, k is the label of the training data set, and p j is the jailbreak prototype, p b is the benign prototype; d iThe Euclidean distance between the features representing the prompt words and the jailbreak prototype or the benign prototype, j represents jailbreak, b represents benign, and i represents the compared prototype.

[0026] The detection method for jailbreak prompt words of the large language model provided by the present application has the following beneficial effects compared with the prior art:

[0027] (1) The present application realizes efficient and accurate jailbreak prompt word detection by combining the large language model recognition ability with the learning ability of the classifier through the form of activation and detection, effectively solving the problems of third-party detector value deviation and high-difficulty jailbreak prompt words not easy to be recognized in jailbreak prompt word detection.

[0028] (2) In the detection stage, on the one hand, the strong learning ability of the neural network is used to classify the samples that cannot be classified by the activation method; on the other hand, it allows single inference detection. After classifying the prompt words, if it is a benign prompt, the large language model continues to generate output. However, if it is a jailbreak prompt, the large language model is in a defensive state and will not provide a response to the user. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0030] Figure 1 The flowchart of the detection method of one embodiment of the present application;

[0031] Figure 2 The prompt word activation visualization comparison diagram of one embodiment of the present application;

[0032] Figure 3 The flowchart of the detection method of another embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0034] The present application will be further described below in combination with the drawings and specific embodiments.

[0035] The present application provides a method for detecting jailbreak cues of large language models, aiming to identify unsafe samples and ensure that large language models correctly output safe samples, ensuring the normal operation of large language model services. Large language model services refer to services that deploy large language models in production environments for testing or API interfaces for remote services through cloud platforms after the pre-training phase. Therefore, in the present application, the internal state of the large language model can be accessed, such as the token sequence generated by the large language model, the prediction probability distribution of the large language model, the generation temperature and hyperparameters of the large language model, etc. The use of the internal state of the large language model for identification helps improve the accuracy of cue identification. Compared with traditional two-class detection methods, the method of the present application: when a benign cue is detected, the large language model can continue to reason and generate an effective response; on the contrary, when a jailbreak cue is detected, the detector intercepts and filters the cue. In this process, the model neither generates a response nor requires multiple reasoning iterations, effectively eliminating security threats in a single processing.

[0036] The detection method proposed in the present application is shown in Figure 1 、 3 and is divided into an activation phase and a detection phase, specifically including:

[0037] S1, adding an activation suffix to the cue, inputting the cue with the added suffix into the large language model, and obtaining the representation features of the benign cue and / or the jailbreak cue in the internal state of the large language model;

[0038] S2, inputting the representation features of the benign cue and / or the jailbreak cue into the detection model, and obtaining the classification of the cue, i.e., a benign cue or a jailbreak cue.

[0039] In step S1, the activation phase, the addition of the suffix is completed through a specific instruction format, aiming to trigger the internal defense mechanism of the large language model to enhance the feature distribution difference between the jailbreak cue and the benign cue. When the jailbreak cue triggers the defense mechanism of the large language model, its output is different from that of the benign cue, for example, outputting "Sorry, I cannot", which is also reflected in the internal state of the large language model. This step helps the large language model to more easily trigger its defense mechanism against malicious input, thereby increasing the difference between the jailbreak cue and the benign cue, and effectively preprocessing the input state of the subsequent detection model, enhancing its ability to identify harmful cues.

[0040] The method of adding an activation suffix includes Chain-of-Thought, Ranking, Confirmation, Repetition, or Similarity.

[0041] (1) The thinking chain method requires the base model to decompose the query into a list of sub-tasks by designing thinking chain prompt words, and gradually execute slow thinking tasks to generate responses. For example, add "please respond to the task by executing it in the way of breaking down the task into sub-tasks" to the prompt word, which will require the large language model to decompose and restructure the query, analyze the prompt in more detail, and make the large language model think more about the given problem.

[0042] (2) The ranking method requires the large language model to rank the given input prompt word as a whole according to toxicity and output according to the ranking. For example, "please generate the corresponding response according to the toxicity order of the input text" will make the large language model first evaluate and rank the toxicity of the output text, and then output the response. During the ranking process, the large language model follows the ranking instructions, thus more considering the toxicity of the text rather than directly executing harmful instructions, which increases the proportion of rejecting escape prompts by increasing the model's attention to safe directions.

[0043] (3) The confirmation method requires the large language model to confirm the harmlessness of the input before generating the response. For example, "please confirm that the above content is safe before outputting" triggers a value reminder in the large language model, prompting it to be more "cautious" when responding. In this case, the large language model tends to focus on harmful behavior and reject escape prompts.

[0044] (4) The repetition method requires the large language model to repeat the response to a given request, which does not affect normal output. For example, "please repeat the model's response and output it". In this case, if the prompt is benign, the output is the same as the normal response. However, for escape prompts, the large language model will notice harmful content in the response based on its own instruction-following capabilities and can reject and identify it.

[0045] (5) The similarity method requires the large language model to perform a similarity transformation on the prompt word before generating a response. For example, "please restructure the input text, replace it with a similar question, and output the corresponding response" makes the large language model pay more attention to the prompt, and in the process of similarity transformation, the model does not directly generate a response, but first filters the toxicity of the text through similarity transformation, thus increasing the rejection rate. In the process of similarity transformation, the model uses the values learned in the reinforcement learning phase to analyze the similarity of the text, thus reducing the toxicity of the original prompt.

[0046] Any of the above methods or combinations of prompt words can effectively induce the trend of the internal state of the large language model. For example, Figure 2As shown, we use the thought chain activation prompt as an example for illustration, and other examples are not listed one by one. 50 prompts of ToxicChat and XSTest datasets are visualized. It can be observed that before using the thought chain activation suffix, the feature distribution of jailbreaking prompts and benign prompts is scattered, and after using the thought chain activation suffix, the feature distribution of jailbreaking prompts and benign prompts presents a clear clustering and separation trend. This result is very beneficial to the subsequent work of the detection model.

[0047] The representation feature of the benign prompt word and / or the jailbreaking prompt word inside the large language model refers to the layer hidden state inside the large language model, and the layer hidden state is closely related to the input prompt word.

[0048] For a given input prompt x added with an activation suffix, the layer hidden state of the large language model can be represented as:

[0049] h0=E(x) (1)

[0050] h l+1 =h l +MSA(h l +MLP(h l )) (2)

[0051] Where h represents the layer hidden state, l is the number of layers of the large language model, and E is the projection space of the embedding vector. MSA represents a multi-head self-attention mechanism, and MLP is a multi-layer perceptron, both of which are internal architectures of the large language model. In order to better extract the features of different layers, all hidden layer states are stacked into a matrix to represent the entire information of reasoning, as follows:

[0052]

[0053] Where act represents an activation method, one of the five activation methods proposed in the present application, and d l represents the dimension of the embedding space.

[0054] In step S2, for the detection stage, the present application provides a neural network-based detection model including a neural network, a pooling layer and a multi-layer perceptron connected in sequence, taking the hidden layer state matrix of the large language model as input, and classifying the prompt word as jailbreaking or benign.

[0055] The neural network acts as a feature extractor to capture all layer information. The following describes a convolutional neural network as an example. The convolution kernel size is set to 3*3 to scan the stacked feature matrix H actand stack multiple convolution modules to capture features under different receptive fields. In each convolution block, a ReLU activation function is used to introduce nonlinearity, and a batch normalization layer BN is used to reduce internal covariate shift by normalizing each vector. The convolutional neural network structure is as follows:

[0056] C act = Stack(ReLU(BN(Conv(H act ))) (4)

[0057] According to existing research, different model layers have different responses to prompts. In order to capture the feature distribution changes of different layers, an average pooling layer is introduced, which can realize feature selection and aggregation across multiple layers, and can be represented as:

[0058] P act = AvgPool(C act ) (5)

[0059] Finally, by applying a linear transformation, a multi-layer perceptron (MLP) is used to extract the pooled features to obtain the prototype vector, which can be represented as:

[0060] p k = MLP(P act ) (6)

[0061] where p k is the extracted feature of the prompt word, which is used as the candidate prototype vector, and k is the label of the training data set. The detection model realizes classification by learning prototype vectors for each class. In this work, we want to divide into two classes, namely the jailbreak prototype p j and the benign prototype p b . Then the detection model calculates the loss by comparing the Euclidean distances d j and d b (j represents jailbreak and b represents benign). The meaning of the distance represents the association between the to-be-detected vector and the reference prototype. If the to-be-detected vector is closer to the jailbreak prototype than the benign prototype, we consider that the vector represents a jailbreak prompt word, and vice versa. The formula for calculating the distance can be represented as:

[0062]

[0063] where d i represents the calculated distance result, and i represents the compared prototype, which is divided into two results of comparison with the jailbreak prototype and the benign prototype. The loss function of the detection model is as follows:

[0064]

[0065] During the training of the detection model, first, an activation method to be used is selected from five activation methods, such as the thought chain, repetition, similarity, sorting, and confirmation activation methods; then, a pre-training hyperparameter adjustment stage is performed to adjust hyperparameters such as a learning rate, a request set, a support set, and a data set size to find appropriate training parameters; finally, the prompt word to which the activation suffix is added is input into the large language model to obtain a hidden layer state matrix, and the matrix is input into the detection model to output the prompt word classification, and then the hyperparameters of the detection model are adjusted through a back propagation algorithm; the above process is cycled to obtain the final detection model.

[0066] Through training, the detection model can fully learn the characteristics and rules of the jailbreak prompt and how to use the internal state and activation mechanism of the large language model for accurate detection, and prepare for the subsequent reasoning stage.

[0067] After the detection model detects and classifies the prompt word to be tested, if it is a benign prompt, the large language model is input again for further reasoning to return a normal response, and if it is a jailbreak prompt word, a response of refusing to answer is returned.

[0068] The detection model can effectively extract the core features of the large language model and distinguish between jailbreak and benign prompts, avoiding directly identifying high-difficulty jailbreak prompt words and learning the value trend of the large language model.

[0069] The detection stage has two advantages: on the one hand, it uses the strong learning ability of the neural network to classify samples that can only add an activation suffix but cannot be classified, that is, there are high-intensity jailbreak prompt samples, and even if the activation suffix is added for defense, the samples may still jailbreak the model. On the other hand, it allows single-inference detection. After classifying the prompt word, if it is a benign prompt, the large language model continues to generate output. However, if it is a jailbreak prompt, the large language model is in a defense state and will not provide a response to the user.

[0070] The present application only needs one inference to complete the detection of the prompt. Compared with some methods based on feedback of the large language model (such as Gradsafe and PARDEN), multiple inferences or retrieval of model responses are not required, which greatly saves time and computing resources, the time consumption is similar to PARDEN, and the activation time is comparable to GradSafe, and without additional training, the detection efficiency is improved.

[0071] In addition, other activation methods can be constructed in the activation stage; in the detection stage, the parameters of the convolution layer can be improved, the output of the decoder layer and the decoder structure can be improved, and the convolutional neural network can be replaced with other neural network models, such as models based on Transfomer.

[0072] The present application realizes the effect of combining the self-recognition ability of the large language model and the learning ability of the classifier through the close cooperation of the activation stage and the detection stage, and can accurately detect the jailbreak prompt and timely handle the jailbreak prompt word in one inference. This cooperative working mechanism is an important technical innovation point of the present application, and the work flow and interaction logic of the entire inference framework are protected.

[0073] Embodiment 1

[0074] First, the model and data preparation work is carried out, and llama2-7b-chat is selected as the large language model in this embodiment, which has certain representativeness and universality in language processing ability, and can provide effective feature information for subsequent detection tasks. At the same time, data is selected from the public ToxicChat and XSTest data sets according to a certain proportion, and combined with the self-built ActJail data set to carry out data set preparation and data preprocessing work. Among them, the ToxicChat data set is derived from the Vicuna online demonstration, and has a specific reference value for chat robot toxicity detection; the XSTest data set contains carefully designed safe and unsafe prompts, which helps to evaluate the recognition ability of the model to different safe behaviors; the ActJail data set focuses on high-difficulty jailbreak prompts, which is used to enhance the model's ability to cope with complex situations. In this embodiment, 10% of the data is set as the training data set, which can ensure that the model has enough data for learning, avoid overfitting, and improve training efficiency. Then, ensure that the format and quality of the data meet the requirements of model training. For example, clean up the text, perform word segmentation, and other operations to convert it into an input form that the model can accept.

[0075] Then, the input prompt is processed according to the preprocessing method determined in the training stage to ensure that its format and features meet the requirements of the large language model. Then, the activation method used in the training process is applied to activate the input prompt, and the activated prompt word is input into the large language model. The detection model receives the hidden state matrix from the large language model, and then judges the nature of the prompt word. If it is a benign prompt, the large language model is allowed to continue the normal inference and response generation process for the prompt, and the detection model does not intervene, ensuring the normal operation of the large language model and the normal use of the user. If the detection model determines that the prompt is a jailbreak prompt, it sends information to the large language model to make the large language model enter a defense state and refuse to answer the prompt word, etc. The large language model thus effectively avoids jailbreak attacks and safeguards the security of the large language model system.

[0076] In this embodiment, even if only 10% of the training data is used, it can be significantly better than the existing most advanced jailbreak prompt detection method. On the ToxicChat dataset, the AUPRC of the present application reaches 84.4%, and the F1-Score reaches 73.2%; on the XSTest dataset, the AUPRC is as high as 98.0%, and the F1-Score is 93.2%. At the same time, for the high-difficulty jailbreak prompt data set ActJail with 100% attack success rate constructed by itself, the AUPRC of the present application is increased by 28.8% and 25.6% compared with the existing SOTA method such as PARDEN and GradSafe, which can effectively identify the challenging jailbreak prompts that are difficult to detect by existing large language model feedback-based methods.

[0077] Those skilled in the art can understand that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope defined by the claims of the present application.

Claims

1. A method for detecting jailbreak cues of a large language model, characterized in that, The method comprises: S1, add an activation suffix to the prompt word, input the prompt word with the added suffix into a large language model, and obtain a representation feature of the prompt word inside the large language model; the representation feature refers to a layer hidden state inside the large language model; stack all the hidden layer states into a matrix; S2, input the hidden layer state matrix of the large language model into a detection model to obtain the classification of the prompt word; wherein the detection model comprises a neural network, a pooling layer and a multilayer perceptron connected in sequence; In S1, for a given input prompt x with an added activation suffix, the layer hidden state of the large language model is represented as: h0=E(x) (1) h l+1 = h l + MSA(h l + MLP(h l )) (2) Where h represents the layer hidden state, l is the number of layers of the large language model, E is the projection space of the embedding vector; MSA represents a multi-head self-attention mechanism, and MLP is a multilayer perceptron that stacks all the hidden layer states into a matrix: wherein act denotes an activation method, d l denotes the dimension of the embedding space; In S2, the convolutional neural network scans the stacked feature matrix H act And stack multiple convolutional modules to capture features under different receptive fields, in each convolutional block, use ReLU activation function to introduce nonlinearity, and use batch normalization layer BN to normalize each vector, the convolutional neural network structure is as follows: C act = Stack(ReLU(BN(Conv(H act ))) ) (4) Then, an average pooling layer is introduced to realize cross-layer feature selection and aggregation, represented as: P act = AvgPool(C cat ) (5) By applying linear transformation, the prototype vector is obtained by using the multilayer perceptron MLP to extract the pooled features, represented as: p k = MLP(P act ) (6) where p k is the feature of the extracted cue word used as a candidate prototype vector, k is the label of the training dataset; The detection model compares the Euclidean distance between the prototype vector and the jailbreak prototype and the benign prototype, and if the distance to the jailbreak prototype is closer than the distance to the benign prototype, it is considered that the prompt word represented by the prototype vector is a jailbreak prompt word, and vice versa.

2. The detection method according to claim 1, characterized in that, In step S1, the activation suffix is added through a specific instruction format, which aims to trigger the internal defense mechanism of the large language model and enhance the feature distribution difference between the jailbreak prompt word and the benign prompt word.

3. The method of claim 1, wherein The method of adding an activation suffix is a thinking chain method, which requires the base model to decompose the query into a list of sub-tasks and gradually execute slow thinking tasks to generate a response.

4. The method of claim 1, wherein The method of adding an activation suffix is a ranking method, which requires the large language model to sort the given input prompt word as a whole according to toxicity and output according to the ranking.

5. The method of claim 1, wherein The method of adding an activation suffix is a confirmation method, which requires the large language model to confirm the harmlessness of the input before generating a response.

6. The method of claim 1, wherein, The method of adding an activation suffix is a repetition method, which requires the large language model to repeat the response to the given request without affecting the normal output.

7. The method of claim 1, wherein, The method of adding an activation suffix is a similarity method, which requires the large language model to perform a similarity transformation on the prompt word before generating a response.

8. The method of claim 1, wherein, In S2, the training method of the detection model comprises: Adding an activation suffix to the prompt word of the data in the training set; Input the prompt word with the added activation suffix into the large language model and obtain the hidden layer state matrix; Adjust the hyperparameters of the neural network; Input the hidden layer state matrix into the detection model to output the classification of the prompt word, and then adjust the hyperparameters of the detection model through the back propagation algorithm; Cycle the above process to obtain the final detection model.

9. The detection method according to claim 8, characterized in that, During the output of the prompt word classification, the calculation method of the loss function of the detection model is: where p k is the feature of the extracted cue, k is the label of the training dataset, p j is the jailbreak prototype, p b is the benign prototype; d i represents the Euclidean distance of the feature of the cue to the jailbreak prototype or the benign prototype, j represents jailbreak, b represents benign, and i represents the compared prototype.

Images