Elamur Research⌕
☰
home / papers / 2026 / TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

Paper · 2026 · Cheng Liu, Xiaolei Liu, Xingyu Li et al.

Summary

Most jailbreak defenses judge a prompt, an output, or a single internal state in isolation. This misses how risk builds up while a response is being generated. The authors compare prompt representations with decoding-time hidden states across several models. They find that jailbreak prompts stay mixed in with benign ones in latent space. As the model starts producing concrete instructions, however, its hidden states move steadily toward the harmful cluster, and this shift is visible early in decoding. TrajGuard uses this signal without any training. Its Streaming Geometric Surveillance (SGS) module projects critical-layer hidden states into a low-dimensional space and scores each token by its Mahalanobis distances to benign and malicious centroids. These scores are aggregated over a sliding window. When the windowed risk stays above a threshold, a semantic referee (PAIR-Judge) is called to decide whether to stop or restrict generation. Across 12 attacks and several open-source LLMs, TrajGuard blocks about 95% of jailbreaks with little overhead. This makes real-time defense possible without modifying the model.

Key points

  • Risk score: reference regions come only from benign and malicious instruction sets. The score is the benign-centroid distance minus the malicious-centroid distance, and a safety margin relative to a model-specific threshold γ marks the point where the defense collapses.
  • Headline results: about 95% average defense rate over 12 jailbreak attacks, 5.2 ms/token detection latency, and a false positive rate under 1.5%. Models include Vicuna-7B, Mistral-7B, Llama-2-7B and Llama-3.1-8B.
  • Sparse judge use (Vicuna-7B): PAIR-Judge is called 0.06 times per query on Alpaca and 0.47 on XSTest. Llama Guard 3 and Qwen3Guard always check once per input (1.00). On attacks, calls peak at about 1.37 per query.
  • Ablation:
    • Dropping PAIR-Judge raises the benign FPR by 18.4%.
    • Replacing SGS with a judge check every 40 tokens adds far more latency (+750.2 ms vs +189.9 ms for the full system).
    • Swapping in an adversarially fine-tuned Qwen3Guard-8B as judge further reduces ASR on obfuscated attacks such as Cipher and DeepInception.
  • Limitations:
    • Only works with open-weight models, since it needs access to hidden states.
    • May be evaded by adaptive white-box attackers.
    • Needs recalibration of the centroids for specialized domains or new attack types.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Cheng Liu, Xiaolei Liu, Xingyu Li, Bangzhou Xin and Kangyi Ding. 2026. TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.655

@inproceedings{liu2026trajguard,
  title = {{TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense}},
  author = {Cheng Liu, Xiaolei Liu, Xingyu Li, Bangzhou Xin and Kangyi Ding},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.655},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.655}
}

References

50 references, 26 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, and 12 others. 202… find
  2. Somnath Banerjee, Sayan Layek, Soham Tripathy, Shanu Kumar, Animesh Mukherjee, and Rima Hazra. 2024. Safeinfer: Context adaptive decoding time safety alignment for large language models. Preprint, arXiv:2406.12274. — [arXiv:2406.12274](https://arxiv.org/abs/2406.12274) find
  3. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, and 1 others. 2023. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419.
  4. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474.
  5. Pei Ding and 1 others. 2024. Generalized nested jailbreak prompts can fool large language models. In Proceedings of NAACL. find
  6. Ming Dong, Jinkui Zhang, Bolong Zheng, Xinhui Tu, Po Hu, and Tingting He. 2025. DSCD: Large language model detoxification with self-constrained decoding. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 3969–3984, Suzhou, China. Association for Computa… find
  7. Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Alvaro Velasquez, Ahmad Beirami, Furong Huang, Dinesh Manocha, and Amrit Singh Bedi. 2025. Immune: Improving safety against jailbreaks in multimodal llms via inference-time alignment. Preprint, arXiv:2411.18688. — [arXiv:2411.18688](https://arxiv.org/abs/2411.18688) find
  8. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  9. Xiaomeng Hu, Fei Huang, Chenhan Yuan, Junyang Lin, and Tsung-Yi Ho. 2025. Care: Decoding time safety alignment via rollback and introspection intervention. Preprint, arXiv:2509.06982. — [arXiv:2509.06982](https://arxiv.org/abs/2509.06982) find
  10. James Y. Huang, Sailik Sengupta, Daniele Bonadiman, Yi-An Lai, Arshit Gupta, Nikolaos Pappas, Saab Mansour, Katrin Kirchhoff, and Dan Roth. 2025. DeAL: Decoding-time alignment for large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volum…
  11. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. Preprint, arXiv:2312.06674.
  12. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… find
  13. Nathaniel Li, Ziwen Han, Ian Steneker, Willow Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. 2024. Llm defenses are not robust to multi-turn human jailbreaks yet. Preprint, arXiv:2408.15221. — [arXiv:2408.15221](https://arxiv.org/abs/2408.15221) find
  14. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023. Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint arXiv:2311.03191.
  15. Cheng Qian, Hainan Zhang, Lei Sha, and Zhiming Zheng. 2025. Hsf: Defending against jailbreak attacks with hidden state filtering. Preprint, arXiv:2409.03788. — [arXiv:2409.03788](https://arxiv.org/abs/2409.03788) find
  16. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451.
  17. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2024. Derail yourself: Multi-turn llm jailbreak attack through self-discovered clues. arXiv preprint arXiv:2410.10700. — [arXiv:2410.10700](https://arxiv.org/abs/2410.10700) find
  18. Weikai Lu, Ziqian Zeng, Jianwei Wang, Zhengdong Lu, Zelin Chen, Huiping Zhuang, and Cen Chen. 2024. Eraser: Jailbreaking defense in large language models via unlearning harmful knowledge. Preprint, arXiv:2404.05880. — [arXiv:2404.05880](https://arxiv.org/abs/2404.05880) find
  19. Antonio Mastropaolo, Luca Pascarella, Emanuela Guglielmi, Matteo Ciniselli, Simone Scalabrino, Rocco Oliveto, and Gabriele Bavota. 2023. On the robustness of code generation techniques: An empirical study on github copilot. Preprint, arXiv:2302.00438. — [arXiv:2302.00438](https://arxiv.org/abs/2302.00438) find
  20. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. Preprint, arXiv:2402.04249.
  21. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box llms automatically. Preprint, arXiv:2312.02119.
  22. Meta AI. 2024. Llama guard 3: Model card and prompt formats. https://www.llama.com/ docs/model-cards-and-prompt-formats/ llama-guard-3/. ↗
  23. Thu-Trang Nguyen, Thanh Trong Vu, Hieu Dinh Vo, and Son Nguyen. 2025. An empirical study on capability of large language models in understanding code semantics. Information and Software Technology, 185:107780. find
  24. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Train…
  25. Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. 2023. Instruction tuning with gpt-4. arXiv preprint arXiv:2304.03277.
  26. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693.
  27. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2025. LLMs know their vulnerabilities: Uncover safety gaps through natural distribution shifts. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics…
  28. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2025a. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. Preprint, arXiv:2404.01833. find
  29. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2025b. Great, now write an article about that: The crescendo {Multi-Turn}{LLM} jailbreak attack. In 34th USENIX Security Symposium (USENIX Security 25), pages 2421–2440. find
  30. Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. Preprint, arXiv:2308.01263.
  31. Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, Amanda Askell, Nathan Bailey, Joe Benton, Emma Bluemke, Samuel R. Bowman, Eric Christiansen, Hoagy Cunningham, Andy Dau, Anjali Gopal, and 24 others. 2025. Constitutional cl…
  32. Leheng Sheng, Changshuo Shen, Weixiang Zhao, Junfeng Fang, Xiaohao Liu, Zhenkai Liang, Xiang Wang, An Zhang, and Tat-Seng Chua. 2025. Alphasteer: Learning refusal steering with principled null-space constraint. arXiv preprint arXiv:2506.07022. — [arXiv:2506.07022](https://arxiv.org/abs/2506.07022) find
  33. Rohan Taori, Ishaan Gulrajani, and 1 others. 2023. Stanford alpaca: An instruction-following llm. GitHub. find
  34. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — Llama 2: Open Foundation and Fine-Tuned Chat Models
  35. Xuekang Wang, Shengyu Zhu, and Xueqi Cheng. 2025a. Speculative safety-aware decoding. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 12838–12852, Suzhou, China. Association for Computational Linguistics. find
  36. Xunguang Wang, Zhenlan Ji, Wenxuan Wang, Zongjie Li, Daoyuan Wu, and Shuai Wang. 2025b. Sok: Evaluating jailbreak guardrails for large language models. Preprint, arXiv:2506.10597. — [arXiv:2506.10597](https://arxiv.org/abs/2506.10597) find
  37. Zezhong Wang, Fangkai Yang, Lu Wang, Pu Zhao, Hongru Wang, Liang Chen, Qingwei Lin, and Kam-Fai Wong. 2024. Self-guard: Empower the llm to safeguard itself. In NAACL 2024. find
  38. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023a. Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems (NeurIPS).
  39. Zeming Wei and 1 others. 2023b. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387.
  40. Weixiang Zhao, Jiahe Guo, Yulin Hu, Yang Deng, An Zhang, Xingyu Sui, Xinyang Han, Yanyan Zhao, Bing Qin, Tat-Seng Chua, and Ting Liu. 2025b. AdaSteer: Your aligned LLM is inherently an adaptive jailbreak defender. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Process…
  41. Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2023. Autodan: Interpretable gradient-based adversarial attacks on large language models. Preprint, arXiv:2310.15140. find
  42. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023a. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.
  43. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023b. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.
  44. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. Preprint, arXiv:2402.08983.
  45. Zitao Xuan, Xiaofeng Mao, Da Chen, Xin Zhang, Yuhan Dong, and Jun Zhou. 2025. ShieldHead: Decoding-time safeguard for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 18129–18143, Vienna, Austria. Association for Computational Linguistics. find
  46. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253.
  47. Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. 2024. Don’t listen to me: Understanding and exploring jailbreak prompts of large language models. In Proceedings of the 33rd USENIX Security Symposium. find
  48. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher. arXiv preprint arXiv:2308.06463.
  49. Z. Zhang and 1 others. 2024. Defending large language models against jailbreaking attacks through goal prioritization. In ACL 2024.
  50. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, Baosong Yang, Chen Cheng, Jialong Tang, Jiandong Jiang, Jianwei Zhang, Jijie Xu, Ming Yan, Minmin Sun, Pei Zhang, and 24 others. 2025a. Qwen3guard technical report. Preprint…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-trajguard-streaming-hidden-state-trajectory/