Existing jailbreak classifiers for large language models (LLMs) often fail to distinguish truly harmful responses from benign paraphrases, resulting in high error rates. We reframe jailbreak detection as a strict instruction-following verification task rather than holistic semantic matching. To achieve this, we propose Sub-Query Decomposition (SQD), a framework that breaks complex adversarial prompts into atomic, actionable sub-intents. SQD transforms opaque safety assessment into a parameterizable adjudication protocol, allowing practitioners to quantitatively adjust safety boundaries via explicit mathematical aggregation rules for highly interpretable evaluation. To operationalize SQD at scale, we introduce three foundational pillars: (1) Efficient Deployment via distilled lightweight models, featuring SQD-Phi-4 for single-pass end-to-end verification and SQD-Decomposer, optimized with an entropy-aware loss to mathematically prevent the omission of rare constraints; (2) Evaluation Foundation through SQD-Bench, a rigorously human-annotated dataset; and (3) LLM-independent Judge via E(mbedding)-TFIDF to eliminate inference-time reasoning bias. Extensive experiments demonstrate that our unified framework provides a transparent, low-cost, and policy-aligned standard for reliable jailbreak evaluation.

Safety alignment is critical in pre-trained large language models (LLMs) to generate responses aligned with human values and refuse harmful queries. Unlike LLM, the current safety alignment of VLMs is often achieved with post-hoc safety fine-tuning. However, these methods are less effective to white-box attacks. To address this, we propose Adversary-aware DPO (ADPO), a novel training framework that explicitly considers adversary. Adversary-aware DPO (ADPO) integrates adversarial training into DPO to enhance the safety alignment of VLMs under worst-case adversarial perturbations. ADPO introduces two key components: (1) an adversarial-trained reference model that generates human-preferred responses under worst-case perturbations, and (2) an adversary-aware DPO loss that generates winner-loser pairs accounting for adversarial distortions. By combining these innovations, ADPO ensures that VLMs remain robust and reliable even in the presence of sophisticated jailbreak attacks. Extensive experiments demonstrate that ADPO outperforms baselines in terms of both safety alignment and general utility of VLMs.

Large Language Models (LLMs) are widely applied in decision making, but their deployment is threatened by jailbreak attacks, where adversarial users manipulate model behavior to bypass safety measures. Existing defense mechanisms, such as safety fine-tuning and model editing, either require extensive parameter modifications or lack precision, leading to performance degradation on general tasks, which is unsuitable to post-deployment safety alignment. To address these challenges, we propose DELMAN (Dynamic Editing for LLMs JAilbreak DefeNse), a novel approach leveraging direct model editing for precise, dynamic protection against jailbreak attacks. DELMAN directly updates a minimal set of relevant parameters to neutralize harmful behaviors while preserving the model’s utility. To avoid triggering a safe response in benign context, we incorporate KL-divergence regularization to ensure the updated model remains consistent with the original model when processing benign queries. Experimental results demonstrate that DELMAN outperforms baseline methods in mitigating jailbreak attacks while preserving the model’s utility, and adapts seamlessly to new attack instances, providing a practical and efficient solution for post-deployment model protection.