Elamur Research⌕
☰
home / papers / 2026 / Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models

Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models

Paper · 2026 · Guangyu Yang, Jinghong Chen, Jingbiao Mei et al.

Summary

Jailbreak attacks keep evolving. Defenders therefore need systems that can absorb new attack styles without retraining and that let operators decide how much benign traffic they are willing to refuse. The authors, from Cambridge, propose Retrieval-Augmented Defense (RAD), a training-free jailbreak detector built on RAG. Offline, an LLM annotates a database of known attack prompts with two things: an inferred jailbreak strategy and guidance for recovering the hidden harmful query. Online, RAD processes an incoming prompt in five steps:

  1. Retrieve similar entries.
  2. Rerank them, for example with PMI scoring, plus a "no strategy" option.
  3. Extract the probable underlying request.
  4. Classify it.
  5. Vote across an ensemble to estimate P(harmful).

A tunable threshold on this probability decides whether the prompt is blocked or passed to the target model. RAD only detects attacks and does not alter the model's generation. On StrongREJECT, RAD strongly weakens attacks such as PAP and PAIR while keeping benign refusals low. Adding newer attacks to the database improves defense against them without hurting performance on older ones. The authors also introduce an evaluation based on operating curves against a False Refusal Rate budget.

Key points

  • Benchmarks: StrongREJECT for attacks; a synthetic benign set derived from StrongREJECT, AlpacaEval 2.0, and MMLU for utility and false refusals.
  • Baselines: Self-reminder, Llama Guard 3, and Intention Analysis (IA). Related RAG defenses (RePD, EDDF, SCR) are discussed. Unlike RePD and SCR, RAD does not intervene in generation.
  • Target models: Llama-3.1-8B-Instruct, Qwen-2.5-14B-Instruct, and GPT-4o-mini.
  • Safety-utility evaluation: Defense score is plotted against FRR budget. Most Pareto-frontier points are RAD configurations, whereas baselines give only single fixed points. Llama-3.1-8B-Instruct shows a minimum FRR of at least 2.5% for all systems, attributed to its stricter built-in alignment.
  • Limitations and release: The work covers text-only attacks and follows StrongREJECT's definition of harmfulness. Code is on GitHub (BruceYg/Retrieval-Augmented-Defense), and access to the attack database is restricted.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of CambridgeCambridge · United Kingdom256 works · 123,373 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 3Research subjects and languages the work is about.Language models & pretraining · 3,894 worksInformation retrieval & search · 552 worksBias, fairness & safety · 587 works

Cite

Cite as Guangyu Yang, Jinghong Chen, Jingbiao Mei, Weizhe Lin and Bill Byrne. 2026. Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1895

@inproceedings{yang2026retrieval,
  title = {{Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models}},
  author = {Guangyu Yang, Jinghong Chen, Jingbiao Mei, Weizhe Lin and Bill Byrne},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1895},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1895}
}

References

38 references, 17 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. Preprint, arXiv:2310.08419.
  2. Taiye Chen, Zeming Wei, Ang Li, and Yisen Wang. 2025. Scalable defense against in-the-wild jailbreaking attacks with safety context retrieval. In Proceedings of the 2nd Workshop on Test-Time Adaptation: Putting Updates to the Test! (PUT) at the 42nd International Conference on Machine Learning (ICML… find
  3. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computationa…
  4. Xiaoning Dong, Wenbo Hu, Wei Xu, and Tianxing He. 2025. SATA: A paradigm for LLM jailbreak via simple assistive task linkage. In Findings of the Association for Computational Linguistics: ACL 2025, pages 1952–1987, Vienna, Austria. Association for Computational Linguistics. find
  5. Yann Dubois, Balázs Galambosi, Percy Liang, and Tatsunori B Hashimoto. 2024. Length-controlled alpacaeval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404.04475. find
  6. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  7. Melody Y. Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, Hyung Won Chung, Sam Toyer, Johannes Heidecke, Alex Beutel, and Amelia Glaese. 2025. Deliberative alignment: Reasoning enables safer language models. Preprint, arXi…
  8. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR).
  9. Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. 2021. Unsupervised dense information retrieval with contrastive learning.
  10. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… find
  11. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. 2024. Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. Preprint, arXiv:2406.18510.
  12. Jeff Johnson, Matthijs Douze, and Hervé Jégou. 2021. Billion-scale similarity search with gpus. IEEE Transactions on Big Data, 7(3):535–547. find
  13. Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. 2020. Dense passage retrieval for open-domain question answering. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6769–6781, Onli…
  14. Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles.
  15. Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Alpacaeval: An automatic evaluator of instruction-following models. https://github.com/tatsu-lab/alpaca_eval. ↗
  16. Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. 2024a. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms. Preprint, arXiv:2410.05295. — [arXiv:2410.05295](https://arxiv.org/abs/2410.05295) find
  17. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024b. Autodan: Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations.
  18. Yue Liu, Hongcheng Gao, Shengfang Zhai, Xia Jun, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. 2025. Guardreasoner: Towards reasoning-based llm safeguards. arXiv preprint arXiv:2501.18492. — [arXiv:2501.18492](https://arxiv.org/abs/2501.18492) find
  19. K. Lu, C. Ma, C. Hori, and D. Romeres. 2025. KitchenVLA: Iterative vision-language corrections for robotic execution of human tasks. In Proceedings of the IEEE International Conference on Robotics and Automation Workshop on Safely Leveraging Vision-Language Foundation Models in Robotics (SafeLVMs@IC… find
  20. Chenyang Ma, Kai Lu, Ta-Ying Cheng, Niki Trigoni, and Andrew Markham. 2024. Spatialpin: Enhancing spatial reasoning capabilities of vision-language models through prompting and interacting 3d priors. In Proceedings of the Conference on Neural Information Processing Systems (NeurIPS). find
  21. Chenyang Ma, Kai Lu, Ruta Desai, Xavier Puig, Andrew Markham, and Niki Trigoni. 2025. Coopera: Continual open-ended human-robot assistance. In Proceedings of the Conference on Neural Information Processing Systems (NeurIPS). find
  22. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.
  23. Julien Piet, Xiao Huang, Dennis Jacob, Annabella Chow, Maha Alrashed, Geng Zhao, Zhanhao Hu, Chawin Sitawarin, Basel Alomair, and David Wagner. 2025. Jailbreaksovertime: Detecting jailbreak attacks under distribution shift. Preprint, arXiv:2504.19440. — [arXiv:2504.19440](https://arxiv.org/abs/2504.19440) find
  24. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024. Safety alignment should be made more than just a few tokens deep. Preprint, arXiv:2406.05946.
  25. Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, Amanda Askell, Nathan Bailey, Joe Benton, Emma Bluemke, Samuel R. Bowman, Eric Christiansen, Hoagy Cunningham, Andy Dau, Anjali Gopal, and 24 others. 2025. Constitutional cl…
  26. Guobin Shen, Dongcheng Zhao, Yiting Dong, Xiang He, and Yi Zeng. 2025. Jailbreak antidote: Runtime safety-utility balance via sparse representation adjustment in large language models. Preprint, arXiv:2410.02298. — [arXiv:2410.02298](https://arxiv.org/abs/2410.02298) find
  27. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. In ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM.
  28. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A strongREJECT for empty jailbreaks. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. find
  29. Qwen Team. 2024. Qwen2.5: A party of foundation models. find
  30. Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. 2024. The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness. In Findings of the Association for Computational Linguistics: ACL 2024, pages 13111–13128, Bangkok, Thailand. Ass… find
  31. Peiran Wang, Xiaogeng Liu, and Chaowei Xiao. 2025. RePD: Defending jailbreak attack through a retrieval-based prompt decomposition process. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 283–294, Albuquerque, New Mexico. Association for Computational Linguistics. find
  32. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? Preprint, arXiv:2307.02483.
  33. Shiyu Xiang, Ansen Zhang, Yanfei Cao, Fan Yang, and Ronghao Chen. 2025. Beyond surface-level patterns: An essence-driven defense framework against jailbreak attacks in LLMs. In Findings of the Association for Computational Linguistics: ACL 2025, pages 14727–14742, Vienna, Austria. Association for Co… find
  34. Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12):1486–1496. find
  35. Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A comprehensive study of jailbreak attack versus defense for large language models. Preprint, arXiv:2402.13457. find
  36. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, and 41 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  37. Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. 2024. Jailbreak vision language models via bi-modal adversarial prompt. Preprint, arXiv:2406.04031. — [arXiv:2406.04031](https://arxiv.org/abs/2406.04031) find
  38. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024a. How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lo…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yang-2026-retrieval-augmented-defense-adaptive-controllable/