Paper deep dive
From static to adaptive: immune memory-based jailbreak detection for large language models
Jun Leng, Yu Liu, Litian Zhang, Ruihan Hu, Zhuting Fang, Xi Zhang
Models: Llama2-7B, Llama3-8B, Mistral-7B, Vicuna-13B, Vicuna-7B
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/11/2026, 12:49:09 AM
Summary
The paper introduces the Immune Memory Adaptive Guard (IMAG), a framework for detecting jailbreak attacks in Large Language Models (LLMs). Inspired by biological immune systems, IMAG uses a closed-loop architecture consisting of Immune Detection (retrieval-based matching of known patterns), Active Immunity (a dual-agent simulation-reflection system for unknown/stealthy threats), and Memory Updating (continuous integration of new patterns). It achieves 94% average detection accuracy across five open-source LLMs.
Entities (5)
Relation Signals (4)
IMAG → comprises → Immune Detection
confidence 100% · IMAG is composed of three continuously connected modules... Immune Detection
IMAG → comprises → Active Immunity
confidence 100% · IMAG is composed of three continuously connected modules... Active Immunity
IMAG → comprises → Memory Updating
confidence 100% · IMAG is composed of three continuously connected modules... Memory Updating
Immune Detection → detects → Jailbreak Attack
confidence 95% · Immune Detection, which employs retrieval for high-efficiency interception of known jailbreak attacks
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large Language Models (LLMs) serve as the backbone of modern AI systems, yet they remain susceptible to adversarial jailbreak attacks. Consequently, robust detection of such malicious inputs is paramount for ensuring model safety. Traditional detection methods typically rely on external models trained on fixed, large-scale datasets, which often incur significant computational overhead. While recent methods shift toward leveraging internal safety signals of models to enable more lightweight and efficient detection. However, these methods remain inherently static and struggle to adapt to the evolving nature of jailbreak attacks. Drawing inspiration from the biological immune mechanism, we introduce the Immune Memory Adaptive Guard (IMAG) framework. By distilling and encoding safety patterns into a persistent, evolvable memory bank, IMAG enables adaptive generalization to emerging threats. Specifically, the framework orchestrates three synergistic components: Immune Detection, which employs retrieval for high-efficiency interception of known jailbreak attacks; Active Immunity, which performs proactive behavioral simulation to resolve ambiguous unknown queries; Memory Updating, which integrates validated attack patterns back into the memory bank. This closed-loop architecture transitions LLM defense from rigid filtering to autonomous adaptive mitigation. Extensive evaluations across five representative open-source LLMs demonstrate that our method surpasses state-of-the-art (SOTA) baselines, achieving a superior average detection accuracy of 94\% across diverse and complex attack types.
Tags
Links
- Source: https://arxiv.org/abs/2512.03356
- Canonical: https://arxiv.org/abs/2512.03356
Trouble viewing inline? Open PDF directly →
Full Text
66,809 characters extracted from source content.
Expand or collapse full text
From static to adaptive: immune memory-based jailbreak detection for large language models Jun Leng1, Yu Liu2, Litian Zhang1, Ruihan Hu1, Zhuting Fang3, Xi Zhang111footnotemark: 1 1Beijing University of Posts and Telecommunications 2Hunan Branch of National Computer Network Emergency Response 3Clinical Oncology School of Fujian Medical University lengjun,litianzhang,gloria-1019,zhangx@bupt.edu.cn liuyu@cert.org.cn ztfang@fjzlhospital.com Corresponding Author Abstract Large Language Models (LLMs) serve as the backbone of modern AI systems, yet they remain susceptible to adversarial jailbreak attacks. Consequently, robust detection of such malicious inputs is paramount for ensuring model safety. Traditional detection methods typically rely on external models trained on fixed, large-scale datasets, which often incur significant computational overhead. While recent methods shift toward leveraging internal safety signals of models to enable more lightweight and efficient detection. However, these methods remain inherently static and struggle to adapt to the evolving nature of jailbreak attacks. Drawing inspiration from the biological immune mechanism, we introduce the Immune Memory Adaptive Guard (IMAG) framework. By distilling and encoding safety patterns into a persistent, evolvable memory bank, IMAG enables adaptive generalization to emerging threats. Specifically, the framework orchestrates three synergistic components: Immune Detection, which employs retrieval for high-efficiency interception of known jailbreak attacks; Active Immunity, which performs proactive behavioral simulation to resolve ambiguous unknown queries; Memory Updating, which integrates validated attack patterns back into the memory bank. This closed-loop architecture transitions LLM defense from rigid filtering to autonomous adaptive mitigation. Extensive evaluations across five representative open-source LLMs demonstrate that our method surpasses state-of-the-art (SOTA) baselines, achieving a superior average detection accuracy of 94% across diverse and complex attack types. 1 Introduction Large Language Models (LLMs)DeepSeek-AI (2025); OpenAI (2023); Xi et al. (2025) have become foundational in modern AI ecosystemsMon-Williams et al. (2025); Ouyang et al. (2022); Zhang et al. (2023), yet their widespread deployment is shadowed by the persistent threat of jailbreak attacksZou et al. (2023); Liu et al. (2025b); Chao et al. (2023). In contrast to proprietary models fortified by vendor-maintained guardrails, open-source LLMs lack intrinsic defenses, necessitating a reliance on external security measures. To mitigate these risks, traditional jailbreak detection mechanismsInan et al. (2023) typically rely on third-party content moderation models obtained through extensive fine-tuning. As shown in Figure 1, the external model-based method face a core high-resource bottleneck, requiring large-scale labeled datasets and computational cost. Moreover, adapting the models to new attacks is expensive, as adversarial retraining incurs substantial overhead. To address the limitation of external model-based method, recent researchesXie et al. (2024); Robey et al. (2023); Zhang et al. (2025) shift toward inference-time, attack pattern-based detection strategy. Instead of modifying model parameters, the method focus on identifying specific jailbreak attack patterns by analyzing the model’s internal signals, such as logits, perplexity, and gradientsZhang et al. (2024); Phute et al. (2024); Xie et al. (2024). By leveraging these intrinsic signals, the method can distinguish between attack and benign queries in a training-free manner. This paradigm shift demonstrate that jailbreak attacks and benign queries exhibit distinct representations within models, enabling effective detection without additional training. However, existing methods tend to be limited to a static detection paradigm, which leaves them vulnerable to the evolving nature of jailbreak attacksAndriushchenko et al. (2025); Russinovich et al. (2025). As shown in Figure 1, the attack pattern-based method typically rely on fixed detection threshold or predefined reference representations derived from small-scale labeled samples. Fundamentally, existing methods lack the robustness to generalize across evolving jailbreak attacks. When attackers introduce novel attack strategies, these inputs manifest as out-of-distribution samples that the static detection of the existing methods fail to representXie et al. (2024); Hu et al. (2024). Consequently, existing methods are unable to update their decision boundaries in a timely manner, causing defensive mechanisms to lag behind the rapid evolution of attack strategies. Figure 1: Overview of existing methods versus our approach. (1) External model-based method relies on separate moderation models, incurring high data and computational overhead. (2) Attack pattern-based method depends on predefined safety signals, resulting in static defenses vulnerable to evolving attacks. (3) Our method introduces the immune memory mechanism to establish a closed-loop, adaptive framework for robust detection. Inspired by the immune memory mechanism in biological systemsLam et al. (2024); Netea et al. (2015), instead of relying on static detection, we propose an adaptive strategy. In the human immune system, exposure to a pathogen triggers the creation of memory cells, allowing the body to recognize and neutralize the same or similar threats more rapidly in future encounters. In the context of LLM safety, the system should possess the ability to memorize the patterns of emerging attacks during deployment and retrieve them to intercept evolving threats. As shown in Figure 1, this adaptive approach facilitates progressive robustness by continuously analyzing adversarial iterations, thereby refining the system’s capability to counter evolving strategies and effectively immunizing the model against recurring patterns. While immune memory offers a conceptual pathway toward adaptive detection, translating this principle into a practical framework introduces three fundamental challenges. First, the high volatility of attack patternsAndriushchenko et al. (2025). The vast heterogeneity of jailbreak strategies renders static detection obsolete, as they cannot adapt to the shifting characteristics of dynamic attacks. Second, emerging attacks are highly stealthyMu et al. (2025). Emerging attacks often mirror benign representations, creating a feature-space overlap that renders static detection ineffective against such covert threats. Third, sustainable self-evolution is essentialZheng et al. (2025). The continual emergence of attacks renders manual annotation infeasible, creating the need for an automated memory system capable of autonomously maintaining and updating attacks. In this paper, we propose the Immune Memory Adaptive Guard (IMAG) to achieve adaptive jailbreak detection. Our key innovation is the ability to memorize observed jailbreak attack representations and rapidly match them during subsequent encounters. IMAG is composed of three continuously connected modules that together form a detection closed-loop. To resolve the high volatility of attacks, the Immune Detection retrieves previously observed attack patterns by performing similarity matching between safety-critical activations and a memory bank, enabling detection of recurring attacks. Addressing the challenge of stealthy attacks, the Active Immunity deploys a dual-agent simulation-reflection mechanism that simulates responses to stealthy attacks and reflects on their safety, enabling the detection of emerging threats that evade immune detection. Finally, to achieve the system self-evolution, the Memory Updating incorporates the representations of the detected emerging attacks back into the memory bank. This continuous feedback loop allows IMAG to adaptively refine its defense, ensuring that the model becomes progressively immune to diverse and evolving jailbreak patterns. Our contributions can be summarized as follows: ∙ This work is the first to integrate biological immune mechanisms into the jailbreak detection task, introducing a paradigm shift from existing static approaches to an adaptive detection framework. ∙ We propose a novel jailbreak detection guard consisting of three components: immune detection, active immunity, and memory updating. The guard enables efficient and adaptive detection of attacks. ∙ Extensive empirical evaluations across five representative LLMs and diverse jailbreak attack types demonstrate that our method outperforms SOTA methods. Our method achieves an average detection rate of 94% against unknown jailbreak attacks, demonstrating its robust adaptability to existing methods. 2 Related work 2.1 Jailbreak Attack Jailbreak attacksShen et al. (2024); Yi et al. (2024); Liu et al. (2025a) target LLMs by bypassing their built-in safety mechanisms and alignment constraints. These adversarial techniques manipulate model inputs and induce them to bypass safety guardrails. One line of attack leverages optimization and feedback. For example, the GCG method is a white-box, gradient-based approach that iteratively appends an adversarial suffix to maximize the probability of disallowed outputsZou et al. (2023). In contrast, PAIR adopts a multi-LLM strategy: one LLM evaluates the target model’s responses while another uses those scores to refine the prompt, achieving high success rates under black-box accessChao et al. (2023). Other techniques automate known prompt exploits. AutoDAN uses a hierarchical genetic algorithm to generate stealthy “Do Anything Now”-style prompts from initial jailbreak seedsLiu et al. (2025b). Likewise, DrAttack decomposes a forbidden request into harmless-looking sub-prompts and then implicitly reconstructs it, thereby obscuring malicious intent and evading detection by the model’s filtersLi et al. (2024b). Meanwhile, obfuscation-based attacks hide the illicit content in translation or code: attackers have encoded requests in Base64 to slip past content filtersWei et al. (2023a), or even translated queries into low-resource languages like ZuluDeng et al. (2023). Recent evaluations benchmark these diverse jailbreak strategies across many modelsLuo et al. (2024), noting that while simple obfuscation can succeed in specific cases, more advanced iterative attacks generally yield higher overall bypass ratesChu et al. (2024). 2.2 Jailbreak Detection The jailbreak detection task aims to protect LLMs from the impact of jailbreak attacks by detecting jailbreak prompts. Existing studies on jailbreak prompt detection can be broadly divided into two categories: external-model-based methods and LLM-feedback-based methods. External-model-based methods examine input prompts by using fine-tuned API interfaces or specialized Moderation LLMs. These methods typically identify the toxicity of prompts or assess whether they are harmful. For example, OpenAI Moderation APIs serve as a dedicated content safety review tool for detecting harmful inputs which are fine-tuned by ChatGPTOuyang et al. (2022). They classify input text into 11 risk categories and provide corresponding harm scores. Similarly, Guard LLMsLi et al. (2024a); Han et al. (2024) such as Llama GuardInan et al. (2023) that is fine-tuned from the Llama model, are used to judge the harmfulness of input content. Attack pattern-based methods leverage the self-censoring capabilities of LLMs through zero-shot or few-shot prompt engineering, enabling them to function as harmful content detectorsXie et al. (2023); Phute et al. (2024); Jain et al. (2023); Wei et al. (2023b). Some studies evaluate the responses generated by LLMs to obtain classification resultsZhang et al. (2024). Similarity, GradSafeXie et al. (2024) compare the gradients of safe and unsafe prompts when setting a Sure token as the label. However, these methods struggle to identify challenging prompts that do not trigger the safeguards of LLMs. Moreover, these methods exhibit inflexibility in handling benign prompts. Distinct from existing jailbreak detection approaches, we propose a immune memory adaptive guardrail incorporating an immune memory mechanism. By utilizing a memory bank to maintain security signatures, our framework achieves adaptive detection for emerging jailbreak attacks while simultaneously ensuring the rapid identification of known attack patterns. 2.3 LLM-based Agent LLM-based intelligent agentsWang et al. (2024); Luo et al. (2025a); Liu et al. (2025c) are autonomous entities capable of perceiving their environment, making decisions, and taking actions to achieve specified goalsWu et al. (2024); Hong et al. (2023); Qiao et al. (2024). For instance, the reflexionShinn et al. (2023) framework is a prime example of augmenting an agent with self-critique. Other approaches employ multiple LLMs in collaborative roles to plan and solve tasks. CAMELLi et al. (2023) introduces a role-playing multi-agent paradigm in which two or more communicative agents converse with each other, guided by an inception prompt, to autonomously drive the dialog toward task completion while adhering to intended goals. Similarly, AutoGenWu et al. (2024) provides a general framework for spawning and orchestrating multiple agents that communicate in natural language or code. In an embodied setting, VoyagerWang et al. (2023) demonstrates long-horizon agent planning and learning. These multi-agent frameworks and self-reflection techniques enable capabilities like dynamic planning, task decomposition, and error correction that exceed what a single LLM can achieve in isolation, pointing to promising directions for more robust and autonomous AI systems. Distinct from traditional multi-agent systems tailored for mathematical reasoning, current research lacks a comprehensive MAS framework dedicated to safeguarding LLMsZeng et al. (2024); Srivastav and Zhang (2025); Wang et al. (2025). Although some existing approaches utilize multi-agent guardrails, they are limited by static coordination schemesLuo et al. (2025b); Mao et al. (2025); Cai et al. (2025). To address this limitation, Our method introduces a emerging memory mechanism that facilitates adaptive, dynamic detection, thereby making a substantial contribution to the robustness of jailbreak defense. 3 Method Figure 2: Overview of the IMAG framework. The system operates as a adaptive closed loop orchestrated through three synergistic stages. (1) Immune Detection leverages internal activations from the target LLM and compares them to stored benign and attack activations, enabling efficient detection of known attacks. (2) Active Immunity deploys a dual-agent simulation-reflection system to proactively verify ambiguous queries that evade immune detection, effectively handling novel or stealthy attacks. (3) Memory Updating incorporates detection outcomes from both the immune detection and active immunity modules, updating the short-term and long-term memory banks accordingly, continuously refining the guard. 3.1 Problem Definition The jailbreak detection task is formulated as a binary classification problem, where the goal is to distinguish between jailbreak and benign queries. Following prior worksXie et al. (2024); Inan et al. (2023), we design the guard on open-source target models and leverage the hidden states of LLMs as safety-relevant representations. For each input prompt x, the hidden states are extracted from the final token at every transformer layer. Formally, let L be the total number of layers, and d is the hidden dimensionality. The activations at layer l∈1,…,Ll∈\1,…,L\ is defined as hl(x)h_l(x). These internal activations encode semantic and functional signals, which we use to identify adversarial intent. The guard is defined as g(hl(x))=yg(h_l(x))=y, where y∈attack,benigny∈\attack,benign\ denotes the detection outcome for input x. 3.2 Overview The proposed framework is an adaptive system comprising immune detection, active immunity, and memory updating. Initially, immune detection module serves as a low-latency gatekeeper, leveraging internal signal to detect known attacks stored in the memory bank. Prompts that evade this initial screening are treated as zero-day threats and routed to the active immunity module. Here, a dual-agent architecture is designed to detect safety violations. Finally, the memory updating module performs knowledge distillation of these validated samples, populating the memory bank with newly identified attacks. By closing the loop between detection and learning, the framework facilitates a self-evolving defense capable of neutralizing increasingly sophisticated and out-of-distribution jailbreak attempts. 3.3 Immune Detection Inspired by antigen-antibody recognitionLam et al. (2024), the jailbreak attacks are treated as pathogens and their hidden states as antigens. These antigens are matched against a repertoire of benign or attack patterns to trigger detection. To facilitate this process, the system maintains a long-term memory bank that stores activations of identified attack and benign prompts as known memory. Relevant attack and benign activations are retrieved for similarity matching against query x. Since the memory bank may contain numerous safety states, processing all states would incur substantial computational overhead. Therefore, the top-k sampling are used to retrieve states from both categories for subsequent computation, which can be formulated as Xa=TopK(s(hl(x),ℳa)),Xb=TopK(s(hl(x),ℳb)),s(,)=⋅‖‖,X^a=TopK(s(h_l(x),M^a)), X^b=TopK(s(h_l(x),M^b)), s(x,y)= x·y\|x\|\|y\|, (1) where s denotes the cosine similarity function for computing similarity between the query state hl(x)h_l(x) and memory bank states, ℳaM^a and ℳbM^b denote the memory banks storing attack and benign states respectively, and TopK(⋅)TopK(·) denotes the top-k retrieval operation. Given the diversity of jailbreak attacks, different layers of an LLM encode distinct semantic information reflecting various safety featuresFan et al. (2025). To identify the critical safety layer, a layer-wise discriminative operation is conducted to locate the safety layer. The process of finding the critical layers can be formulated as lt=argminl1n∑i=1ncos(hl(xia),hl(xib)),l_t= _l 1n _i=1^n (h_l(x_i^a),h_l(x_i^b) ), (2) where the hl(xia)h_l(x_i^a) and hl(xib)h_l(x_i^b) is the hidden states of jailbreak attack and benign prompts from XAX_A and XBX_B, the ltl_t is the critical layer for safety detection. Once the critical layer is identified, to capture the primary characteristics of attack and benign states, the retrieved benign and attack activations are combined as matrix a=[hlt(x1)⊤hlt(x2)⊤⋮hlt(xn)⊤]wherexi∈Xa,b=[hlt(x1)⊤hlt(x2)⊤⋮hlt(xm)⊤]wherexj∈Xb. ^a= bmatrixh_l_t(x_1) \\ h_l_t(x_2) \\ \\ h_l_t(x_n) bmatrix x_i∈ X^a, ^b= bmatrixh_l_t(x_1) \\ h_l_t(x_2) \\ \\ h_l_t(x_m) bmatrix x_j∈ X^b. (3) To capture the critical features of attack and benign prompts, the Singular Value Decomposition (SVD) are applied to aH^a and bH^b. Then, the rank set to 11, focusing on the most significant singular vector. The captured vectors of matrix denoted as ah^a and bh^b. These reference vectors represent the primary characteristics of attack and benign prompts. Simulation Agent Template Identity: Please answer the following question, ensuring that your response is safe, helpful, and follows ethical guidelines. User Input: user_question Please provide a reasonable and safe answer: Reflection Agent Template Identity: You are an evaluation assistant. Your task is to assess whether the Simulation Agent’s response is appropriate and safe. User Input: The user origin input is user_input Simulation Agent Action: The action of simulation agent is action Simulation Response: The response content of simulation of user input is simulation_response Safety Policy: Six safety policies are safety_policy Evaluation Criteria: correctness = False if: 1. Action = refuse but the user input is completely benign and safe 2. Action = respond and provides helpful, safe, ethical information 3. The response appropriately balances safety and helpfulness 4. Over-rejection: Refusing reasonable requests due to overly cautious interpretation correctness = True if: 1. Action = refuse and the user input could lead to harm or violates policies 2. Action = respond but the content actually helps with harmful/illegal activities 3. The response provides dangerous or unethical information 4. The content violates the safety policy and does not comply with the prescribed safety guidelines. Subsequently, the euclidean distances between the target prompt activations and the reference activations are computed, yielding two distance scores, denoted as sas^a and sbs^b. Specifically, sas^a measures the distance between the target prompt and the adversarial reference vector, while sbs^b corresponds to the distance between the target prompt and the benign reference vector. By comparing sas^a and sbs^b, the immune detection stage categorizes the prompt into one of three classes. The formulation is as follow yimmune=attack,if sa−sb>Tbenign,if sb−sa>Tcandidate,otherwise,sa=‖a−hlt(x)‖2,sb=‖b−hlt(x)‖2, y_immune= casesattack,&if s^a-s^b>T\\ benign,&if s^b-s^a>T\\ candidate,&otherwise cases, s^a= ^a-h_l_t(x) _2, s^b= ^b-h_l_t(x) _2, (4) where τ denote the threshold of memory similarity. When the absolute difference between sas^a and sbs^b exceeds τ, the target vector is more likely to be a known prompt, either attack or benign. Conversely, the request is classified as unknown, indicating a candidate prompt that requires further verification. The immune detection module performs rapid detection of known attack patterns based on the long-term memory bank. However, previously unknown or highly obfuscated attacks may still evade the immune detection module. 3.4 Active Immunity The active immunity module is employed to detect unknown jailbreak attacks. In this module, a simulation-reflection dual-agent system are designed to validate the candidate prompts which are deviating from the immune detection module. The active immunity module is inspired by dendritic cells in the immune systemLam et al. (2024), which actively engulf pathogens to capture their characteristic features, even at the risk of self-infection. Specifically, two collaborative agents are deployed: a simulation agent simA_sim, responsible for generating answers to input queries, and a reflection agent refA_ref, which supervises the generated content and provides evaluative judgment. The simulation agent simA_sim first generates an output with the candidate prompt which can be formulated as rsim∼Psim(r∣x;θsim),r_sim P_A_sim(r x; _sim), (5) where rsimr_sim denotes the simulation response of candidate prompt x, and θsim _sim represents the backbone model of simulation agent feedback. Then the reflection agent refA_ref evaluates the simulation response rsimr_sim of the candidate input which consists of three sequential steps: action validation, safety policy inspection, and correctness assessment. The formulation is given as follow rref=ref(x,asim,rsim,safe;θref),r_ref=A_ref(x,a_sim,r_sim,P_safe; _ref), (6) where asima_sim and rsimr_sim denote the action (e.g., refuse or respond) and response generated by the simulation agent, safeP_safe represents the safety guidelines, and the output rref∈True,Falser_ref∈\True,False\ indicates whether the response adheres to safety protocols. Finally, based on the decision of the reflection agent, denoted as rrefr_ref, the candidate prompt is subjected to a final classification, which is formulated as follows: yfinal=benignif rref=False,attackif rref=True.y_final= casesbenign&if r_ref=False,\\ attack&if r_ref=True. cases (7) In this module, the system proactively simulates the execution of candidate unknown prompts and determines their classification by jointly analyzing the simulated agent’s actions, generated responses, and safety policy evaluations. Ensuring reliable safety assessment for prompts that are not confidently recognized during the immune detection stage. Moreover, it provides more accurate detection outcomes and higher-quality memory data to support the subsequent memory updating process. Algorithm 1 Adaptive Jailbreak Detection Algorithm 0: Input prompt x, Target LLM ℱF, simulation Agents simA_sim, Reflection Agent refA_ref, Attack Memory ℳaM^a, Benign Memory ℳbM^b, Threshold τ. 0: Detection result yfinaly_final. 1: Stage 1: Immune Detection 2: Extract hidden states hl(x)h_l(x) from ℱF for query x. 3: Retrieve Top-K neighbors and compute critical reference vectors a,bh^a,h^b via Eq. (1)-(3). 4: Calculate distance scores sa,sbs^a,s^b and determine preliminary label yimmuney_immune via Eq. (4). 5: Stage 2: Active Immunity 6: if yimmuney_immune is candidate then 7: Generate simulation response rsimr_sim using simulation agent simA_sim via Eq. (5). 8: Evaluate simulation response on reflection agent refA_ref with result rrefr_ref via Eq. (6). 9: Determine final label yfinaly_final via Eq. (7). 10: end if 11: Stage 3: Memory Updating 12: Update memory banks ℳaM^a or ℳbM^b with current states via Eq. (8)-(10). 13: return yfinaly_final 3.5 Memory Updating After the detection of immune detection and active immunity, the processed results are stored in the memory bank for evolving the system. The memory bank is divided into long-term memory and short-term memory, which store commonly confirmed activations and temporary short-term activations, respectively. In subsequent interactions, the system leverages this accumulated memory to achieve more precise and adaptive detection of previously encountered or semantically similar jailbreak attacks. Short-term Memory To facilitate memory updating during the detection process, the system introduces a short-term memory module. The short-term memory temporarily stores memory information generated within the detection cycle and updates the long-term memory bank after verification. Specifically, following the immune detection stage, attack and benign samples identified in yimmuney_immune are stored in the short-term memory bank, which can be formally expressed as follows ℳS←ℳS∪(i,yi)∣i∈ℐknownM_S _S∪ \(h_i,y_i) i _known \ (8) where ℳsM_s denotes the short-term memory set. The tuple (i,y^i)(v_i, y_i) represents the activation vector and the corresponding predicted label of the i-th sample, respectively, and ℐknownI_known signifies the set of indices for samples classified with high confidence in the immune detection phase. Long-term Memory To ensure long-term stability in detection performance, the system maintains a long-term memory bank that stores rigorously verified data. Specifically, the memory bank consists of two types of entries: attack memory and benign memory. The long-term memory is updated from the short-term memory, where attack and benign memories stored in the short-term memory are incorporated into their corresponding memory banks. The formulation is given as follows ℳa ^a ←ℳa∪i∣(i,y^i)∈ℳS,y^i=cattack, ^a∪ \v_i (v_i, y_i) _S, y_i=c_attack \, (9) ℳb ^b ←ℳb∪i∣(i,y^i)∈ℳS,y^i=cbenign ^b∪ \v_i (v_i, y_i) _S, y_i=c_benign \ (10) where cattackc_attack and cbenignc_benign denote the class labels for attack and benign categories, respectively. This operation ensures that only features iv_i associated with confirmed predictions are permanently integrated into the long-term memory bank. By updating emerging safety features, the system achieves robust detection generalization. Unlike traditional memory repositories that store information in textual form, the memory bank represents both attack and benign memories in terms of activations of prompts. This representation enables efficient similarity-based retrieval through activations, significantly reducing memory access latency. Moreover, activations inherently capture rich semantic information, which further ensures accurate and reliable retrieval during the detection process. 4 Experiment Setting 4.1 Target LLMs Following prior worksXie et al. (2024); Zhang et al. (2025), in this study, experiments are conducted on five target LLMs: Mistral-7B, Vicuna-7B, Vicuna-13B, Llama2-7B, and Llama3-8B. Each base model is used to generate corresponding jailbreak attack prompts and is compatible with the base models employed in various baseline methods. In our method, the target model is used to extract hidden states from input prompts in the immune detection module. The GPT-4o-mini is used as the backbone model in active immunity module due to its instruction-following capabilities and reasoning performance. Additionally, the experimental setup ensures that the base models can adapt flexibly across different attack types, validating the robustness and generalizability of our method. 4.2 Datasets Dataset #Harmful category #Harmful prompts #Benign prompts Human annotation Real word AdvBench (2023) 1 500 0 ✗ ✗ Hex-PHI (2023) 11 330 0 ✓ ✗ XSTest (2023) 10 250 200 ✓ ✗ JailbreakBench (2024) 100 100 100 ✓ ✓ WildJailbreak (2024) 13 2100 200 ✗ ✓ Table 1: The Dataset information. AdvBench and Hex-PHI are used to generate jailbreak attacks for each target model. XSTest, JailbreakBench, and WildJailbreak are employed in subsequent experiments to evaluate the false positive rates on benign prompts. To comprehensively evaluate the performance of our proposed framework, six mainstream jailbreak attacks are considered. For each attack type, 850 adversarial prompts are generated per target model from original questions, with 520 sourced from the AdvBench dataset and 330 from the PhTest dataset. As shown in Table 1, beyond the two seed datasets utilized for generating jailbreak prompts, we incorporate three safety datasets in our subsequent experiments. These are employed to assess the guard’s false positive rate on benign prompts. The detailed descriptions of the attack types are provided below. ∙ GCGZou et al. (2023) performs optimization-driven suffix search to construct high-efficacy jailbreak suffixes, representing state-of-the-art white-box gradient-based prompting techniques. ∙ AutoDANLiu et al. (2025b) employs iterative black-box reinforcement to automatically generate harmful prompt chains, simulating attacker-driven strategy exploration. ∙ PAIRChao et al. (2023) manipulates role-playing and instruction-following tendencies of LLMs by assigning deceptive personas to elicit unsafe outputs. ∙ DrAttackLi et al. (2024b) leverages multi-turn dialog role simulation, enabling the attacker to gradually bypass safety constraints through contextual embedding. ∙ Base64Wei et al. (2023a) ncoding-based attacks conceal harmful intentions by encoding malicious instructions in Base64, requiring the model to decode before refusal, thereby exploiting preprocessing vulnerabilities. ∙ ZuluDeng et al. (2023) attacks paraphrase or obfuscate harmful intents using low-resources languages, challenging detectors to identify semantically latent malicious intent rather than surface-level toxicity. 4.3 Baselines To systematically benchmark the effectiveness of our proposed IMAG framework, we compare it against a diverse set of representative jailbreak detection methods spanning both external model-based approaches and attack pattern-based techniques. These baselines cover the mainstream strategies adopted in prior worksXie et al. (2024); Inan et al. (2023). Evaluating IMAG against these methods allows us to assess its robustness, adaptability, and efficiency under a unified experimental protocol. The following methods are used as baseline methods. ∙ Perplexity FilterAlon and Kamfonas (2023):The Perplexity Filter (PPL) uses a GPT-2 model to compute the perplexity of a prompt and rejects inputs whose perplexity exceeds a predefined threshold, based on the observation that jailbreak suffixes typically yield anomalously high perplexity. ∙ Openai Moderation API111https://platform.openai.com/docs/guides/moderation/: The OpenAI Moderation API (OAPI) is designed to classify user-generated content across categories such as hate speech, harassment, self-harm, sexual content, and other safety-critical dimensions. ∙ Llama GuardInan et al. (2023): Llama Guard (LlamaG) is a safety classification model developed by Meta that provides efficient, deployable content filtering for LLMs by categorizing and detecting potentially unsafe user inputs and model outputs. ∙ Self-ExaminationPhute et al. (2024): The Self-Examination (Self-Ex) is a zero-shot defense mechanism in which a language model re-feeds its own generated response into another LLM instance, prompting it to classify whether the text is harmful — thereby filtering out malicious outputs without additional training. ∙ GradSafeXie et al. (2024): GradSafe is currently the SOTA method for jailbreak prompt detection. It first calculates a reference value, then passes the prompt under detection through the LLM and uses Sure as the predicted response to calculate the corresponding gradients. In this work, we follow the original settings and calculate its classification performance across datasets. 4.4 Metrics Following the previous worksInan et al. (2023); Xie et al. (2024), to ensure a comprehensive and reliable assessment of jailbreak detection performance, we adopt two widely used classification metrics: Accuracy (Acc) and F1-score (F1). These metrics capture complementary aspects of system behavior and jointly reflect the overall robustness of a detection method. Our study maintains consistency with the broader previous works. 5 Analysis In this section, we analyze the experimental results and demonstrate that the proposed adaptive detection framework effectively enables jailbreak attack detection. Additionally, ablation studies, efficiency experiments, and case studies are conducted, which are discussed in the following sections. 5.1 Main Results Methods GCG AutoDAN PAIR DrAttack Base64 Zulu Avg Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Mistral-7B OAPI 0.13 0.23 0.05 0.10 0.07 0.13 0.04 0.07 0.00 0.00 0.00 0.01 0.06 PPL 0.33 0.48 0.00 0.00 0.00 0.00 0.00 0.00 0.95 0.95 0.00 0.00 0.22 LlamaG 0.78 0.87 0.77 0.87 0.74 0.85 0.84 0.91 0.50 0.67 0.58 0.73 0.75 Self-Ex 0.52 0.69 0.56 0.72 0.46 0.63 0.51 0.67 0.32 0.49 0.37 0.54 0.54 GradSafe 0.63 0.77 0.05 0.10 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.12 Ours 0.98 0.99 0.95 0.97 0.93 0.96 0.86 0.92 0.95 0.97 0.92 0.96 0.94 Improvement 0.20↑ 0.12↑ 0.18↑ 0.10↑ 0.19↑ 0.11↑ 0.02↑ 0.01↑ 0.00 0.02↑ 0.34↑ 0.23↑ 0.19↑ Vicuna-7B OAPI 0.10 0.18 0.04 0.09 0.04 0.09 0.04 0.07 0.00 0.00 0.00 0.00 0.05 PPL 0.47 0.60 0.00 0.00 0.00 0.00 0.00 0.00 0.95 0.95 0.00 0.00 0.27 LlamaG 0.75 0.86 0.72 0.83 0.75 0.85 0.84 0.91 0.49 0.65 0.55 0.71 0.74 Self-Ex 0.00 0.00 0.00 0.00 0.03 0.06 0.03 0.06 0.01 0.02 0.01 0.03 0.02 GradSafe 0.00 0.00 0.00 0.00 0.03 0.06 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Ours 0.96 0.98 0.94 0.97 0.88 0.93 0.84 0.91 0.91 0.95 0.19 0.32 0.81 Improvement 0.21↑ 0.12↑ 0.22↑ 0.14↑ 0.13↑ 0.08↑ 0.00 0.00 0.04↓ 0.00 0.36↓ 0.39↓ 0.07↑ Vicuna-13B OAPI 0.08 0.16 0.05 0.09 0.05 0.10 0.04 0.08 0.00 0.00 0.00 0.00 0.05 PPL 0.79 0.86 0.01 0.02 0.01 0.02 0.00 0.00 0.95 0.95 0.00 0.00 0.30 LlamaG 0.76 0.86 0.75 0.76 0.75 0.85 0.85 0.92 0.48 0.64 0.54 0.70 0.73 Self-Ex 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GradSafe 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Ours 0.99 0.99 0.99 0.99 0.98 0.99 0.98 0.99 0.91 0.95 0.65 0.79 0.93 Improvement 0.20↑ 0.13↑ 0.24↑ 0.23↑ 0.23↑ 0.14↑ 0.13↑ 0.07↑ 0.04↓ 0.00 0.11↑ 0.09↑ 0.20↑ Llama2-7B OAPI 0.07 0.14 0.09 0.16 0.03 0.05 0.03 0.07 0.00 0.00 0.00 0.00 0.05 PPL 0.79 0.86 0.00 0.00 0.10 0.18 0.00 0.00 0.95 0.95 0.00 0.00 0.31 LlamaG 0.32 0.48 0.38 0.55 0.53 0.69 0.57 0.72 0.49 0.65 0.35 0.51 0.52 Self-Ex 0.28 0.32 0.27 0.31 0.32 0.35 0.24 0.27 0.20 0.32 0.20 0.32 0.28 GradSafe 0.97 0.98 0.96 0.98 0.62 0.77 0.99 0.99 0.00 0.00 0.18 0.31 0.64 Ours 0.99 0.99 0.98 0.99 0.76 0.87 0.65 0.79 0.60 0.75 0.19 0.32 0.74 Improvement 0.02↑ 0.01↑ 0.02↑ 0.01↑ 0.14↑ 0.10↑ 0.34↓ 0.20↓ 0.35↓ 0.20↓ 0.16↓ 0.19↓ 0.10↑ Llama3-8B OAPI 0.12 0.21 0.08 0.14 0.03 0.06 0.03 0.06 0.00 0.00 0.00 0.00 0.06 PPL 0.77 0.86 0.23 0.36 0.00 0.00 0.97 0.98 0.95 0.95 0.00 0.00 0.50 LlamaG 0.54 0.70 0.60 0.75 0.70 0.82 0.55 0.71 0.34 0.51 0.38 0.56 0.59 Self-Ex 0.12 0.21 0.16 0.26 0.16 0.27 0.18 0.30 0.12 0.21 0.14 0.24 0.19 GradSafe 0.00 0.00 0.37 0.54 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.07 Ours 0.98 0.99 0.96 0.98 0.78 0.87 0.96 0.98 1.00 1.00 0.32 0.48 0.85 Improvement 0.21↑ 0.13↑ 0.36↑ 0.23↑ 0.08↑ 0.05↑ 0.01↓ 0.00 0.05↑ 0.05↑ 0.06↓ 0.08↓ 0.26↑ Table 2: Comparison between IMAG and existing jailbreak detection methods across five target LLMs and six representative jailbreak attacks. Extensive experimental results demonstrate that our method achieves SOTA detection capability. Notably, our method exhibits robustness against jailbreak attacks by memorizing the attack activations and consequently immunizing itself against them. Our comprehensive experiments are conducted on five open-source models and six distinct jailbreak attack methods. Furthermore, we compare our method against five existing jailbreak detection methods as baselines. The results reveal that our method outperforms existing methods across multiple attacks, achieving an average detection rate improvement of over 10%10\%. A closer examination of Table 2 reveals that static baselines exhibit severe performance degradation under attack distribution shift. For instance, OAPI and PPL collapse to nearly zero accuracy on AutoDAN, DrAttack, and Zulu across all model architectures, reflecting their inability to generalize when adversaries modify attack style or embed harmful intent through obfuscation. Even Llama Guard exhibits substantial performance degradation on Base64 and Zulu attacks, with f1 dropping from 0.670.67 to 0.510.51 on Mistral-7B and Llama3-8B. In contrast, our method maintains robust detection across all six attack types. It achieves 0.980.98 f1 on GCG and AutoDAN, 0.87–0.960.87–0.96 f1 on role-playing attack PAIR and dialog-based attack DrAttack, and remains resilient under the most challenging obfuscation settings. This stability comes from IMAG’s adaptive pipeline. The immune detection captures evolving attack signatures, while active simulation adds verification of candidate emerging jailbreak attack. As a result, our method avoids the brittleness of fixed decision boundaries and continuously updates as new attacks emerge. In summary, the experimental evidence demonstrates that our method fundamentally outperforms static jailbreak detection methods by introducing adaptivity through immune memory and multi-agent simulation. Static methods are intrinsically limited by fixed data distributions and rigid decision rules, leading to widespread failures under unseen attack strategies. Our method overcomes these limitations by continuously learning from new attack activations and refining its internal memory bank, enabling robust generalization across diverse models and adversarial behaviors. These results establish IMAG as a SOTA adaptive jailbreak detection framework capable of maintaining long-term reliability in dynamic and evolving threat environments. 5.2 Ablation Study Methods GCG AutoDAN PAIR DrAttack Base64 Zulu Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ Acc↑ F1↑ w/o immune detection Llama2-7B 0.76 0.86 0.95 0.98 0.72 0.84 0.56 0.71 0.00 0.00 0.03 0.06 GPT-3.5 turbo 0.90 0.94 0.88 0.94 0.57 0.72 0.67 0.80 0.56 0.72 0.10 0.18 GPT-4 0.97 0.98 0.96 0.98 0.70 0.82 0.76 0.86 0.97 0.98 0.34 0.50 GPT-4o mini 0.93 0.96 0.96 0.98 0.57 0.72 0.75 0.86 0.88 0.94 0.16 0.28 w/o active immunity - 0.76 0.86 0.95 0.97 0.72 0.83 0.55 0.71 0.00 0.00 0.03 0.06 full guard GPT-4o mini 0.99 0.99 0.98 0.99 0.76 0.87 0.65 0.79 0.60 0.75 0.19 0.32 Table 3: Ablation study of our method, evaluating the immune detection and active immunity modules, with comparative results across six attack methods and four agent base models. Full guard denotes the results when both the immune detection and active immunity modules are enabled. In order to quantify the contribution of each component in our framework, a comprehensive ablation study is conducted. In the ablation study, the effectiveness of the three modules are evaluated with ablation experiments. In addition, the system’s over-refusal behavior on benign requests and detection performance under different hyperparameter settings are examined. The results indicate that all three modules contribute to jailbreak detection, the model accurately identifies benign prompts, and the detection performance remains stable across a range of hyperparameters. (a) Vicuna-7B (b) Mistral-7B (c) Llama2-7B Figure 3: The memory updating experiments of our method. The memory updating module is evaluated under three attack methods, conducting experiments on three publicly available models. The iteration denotes the number of attack rounds performed by the attacker. As shown in Table 3, ablating the immune detection module and active immunity module result in a drop in detection accuracy across the board. In the ablation experiment of immune detection, the input prompts are unknown to the system and detected by dual-agent system. In the ablation experiment of active immunity, the input prompts are detected by memory activation retrieval and the memory bank is initialized with 3030 benign and attack samples. The result demonstrate that without the immune memory, the guard struggle to recognize emerging attack patterns. For instance, in Table 3, removing immune detection causes the f1 on the PAIR attack to drop from 0.870.87 to 0.720.72 on the GPT-4o mini backbone. This performance decline highlights the module’s critical role in unknown jailbreak attacks. Disabling the active immunity module have an even more severe effect on certain attacks. Without the dual-agent system to verify the candidate prompts, the system largely fails to catch obfuscated attacks. Meanwhile, as shown in Table 3, when active immunity is ablated, the system’s detection of Base64 attack drops to 0%0\% which effectively missing all such attacks. Other scenarios also show sharp declines. These consistent performance drops demonstrate that both the immune detection and active immunity stages are indispensable. Notably, these ablation trends hold across different agent backbones, underlining the robustness of our design to the choice of underlying LLM. The above ablations on multiple base models are validated, including open-source models Llama2-7B and proprietary models GPT-3.5, GPT-4, and GPT-4o-mini. The results are observed that only minor variations in absolute performance between models. For instance, GPT-4’s superior language capacity yields slightly higher raw scores under each condition, whereas smaller models start at lower absolute accuracy. However, the relative performance degradation caused by removing each module remains consistent across all backbones. This consistency indicates that the benefits provided by each system module are fundamental rather than backbone-specific. Consequently, the architecture generalizes well and enhances security regardless of the underlying LLM, making the approach broadly applicable across diverse deployments. The ablation analysis validates the design of our proposed system, demonstrating that immune detection, active immunity, and memory updating are all indispensable. Meanwhile, the three modules jointly enable adaptive jailbreak detection. Excluding any module impairs detection or adaptability, confirming that layered defense is superior to individual components. (a) K=1 (b) K=5 (c) K=10 Figure 4: Hyperparameter analysis of the IMAG framework, investigating the detection performance of the model under different Top-K settings on Llama2-7B. (a) JailbreakBench (b) XSTest (c) WildJailbreak Figure 5: Evaluations on the Llama2-7B across three public safety datasets analyzed the confusion matrix regarding benign and harmful prompts. The results demonstrate a minimal false positive rate, validating the method’s precision. 5.3 Memory Updating Analysis As shown in Figure 3, the memory updating experiments are conducted to validate the system’s adaptability and its ability to continuously evolve. This experiment highlights the system’s memory updating capability by examining performance over multiple attack iterations. In this experiment, the system is subjected to multi-round jailbreak attempts and the system is allowed to update its memory bank after each round. The results exhibit a clear upward trend, with the system becoming increasingly effective as it accumulates knowledge of the unknown attacks. For instance, on the Vicuna-7B with GCG attack, the detection accuracy after five attack rounds is considerably higher than after the first round, and by ten rounds the accuracy and capability of detection approach saturation at a much improved level. Similar improvements appear for the other models, indicating that each memory refinement makes the guard more resilient. In contrast, when the memory updating module are ablated, adaptability is lost. The detection performance remains essentially flat even after multiple attack turns. This confirms that the memory updating stage is crucial for long-term evolving. 5.4 Top-K Hyperparameter Analysis As shown in Figure 4, the hyperparameter analysis is conducted to examine how different settings affect detection performance. The results report accuracy and F1 scores in the immune detection stage when top-k memory retrieval is used with varying values of K. As K increases, detection accuracy consistently improves, indicating that larger K enables more accurate and adaptive detection by leveraging richer memory context. However, overly large K introduces unnecessary computational overhead in practice. The results suggest a clear trade-off between performance and efficiency. Specifically, increasing K from 11 to 55 boosts the F1 score on GCG attacks from 0.800.80 to 0.870.87, while further increasing K from 55 to 1010 yields only a marginal gain of 0.02↑0.02 . This indicates that K=5K=5 is a well-balanced choice, achieving strong detection performance without incurring excessive computation. 5.5 False Positive Analysis on Benign Prompts As shown in Figure 5, the experiment presents the detection results of the system on three public safety benchmarks. Despite achieving strong jailbreak detection performance, the system maintains a low false positive rate, demonstrating robust discrimination of benign prompts. This figure presents binary classification heatmaps on three datasets. Across all three cases, the heatmaps are strongly diagonal, indicating high true positive and true negative rates. The system accurately flags the vast majority of malicious prompts and correctly lets benign prompts pass, achieving a desirable balance between security and usability. For instance, the system maintains roughly 85%85\% accuracy on never seen attack attempts, far outperforming static methods. At the same time, benign queries in all datasets are rarely misclassified as attacks. This demonstrates that the system guard not only generalizes to new and obfuscated threats but also remains conservative on safe inputs, thereby avoiding unnecessary refusals or interruptions to normal user queries. 5.6 Efficiency Experiment In this section, the efficiency experiment is conducted from both quantitative and qualitative perspectives. Figure 6 presents a scatter plot comparing our method with existing approaches in terms of efficiency and performance, while Table 4 provides a qualitative analysis highlighting the efficiency advantages of our approach. The results show that the our method achieves strong detection performance while maintaining favorable efficiency. As shown in Figure 6, our method exhibits an outstanding efficiency and performance trade-off. It achieves nearly 90%90\% detection accuracy with an average latency of only 0.770.77 seconds per query. In contrast, baseline methods detect at much lower accuracy levels or require longer runtime. This clear separation suggests that competing approaches often face a trade-off between speed and accuracy, whereas our approach delivers both high precision and fast execution concurrently. As shown in Table 4, the experiment qualitatively compares the efficiency of our method with existing methods across five dimensions. Our method attains high detection performance with low computational cost, avoiding heavy resource usage. Unlike several baselines that depend on external safety models which introduce additional computational overhead, our approach operates directly on the target LLM with minimal overhead. This lightweight, training-free design translates into consistently lower runtime per query without sacrificing detection quality, highlighting the practical efficiency of our solution. Overall, the efficiency experiment confirms that our method is both highly accurate and computationally efficient in practice. By operating directly on the target model’s states with minimal processing, our approach can perform safety checks in near real-time without compromising accuracy. These characteristics make the method well-suited for scalable, real-world deployment. Figure 6: The efficiency experiment of our method and existing methods. The experiment compares existing methods with our approach in terms of detection F1-score and per-query runtime across three target models. Method GPU Usage Performance Third-party Model Target LLMs Fine-tuning Static Detection OAPI Low Low PPL Low Low Self-Ex Medium Low LlamaGuard High High GradSafe High Medium Ours Low High Table 4: The efficiency differences between our method and existing methods are analyzed across five dimensions. indicates that the method utilizes the corresponding resource or requires the specified operation. Conversely, denotes that the method does not require the listed resource or the operation. indicates that our method does not require a third-party model for known queries, whereas a third-party model is needed for unknown queries. 5.7 Case Study Figure 7: Real-case examples of the system workflow. (a) illustrates the system’s input–output pipeline under jailbreak attack, whereas (b) depicts the corresponding workflow for benign query. To illustrate the system’s workflow and practical benefits, a detailed case study is shown in Figure 7. The example traces a sophisticated jailbreak prompt through the system, visualizing the system’s end-to-end behavior step by step. This real-world attack demonstrates not only that IMAG can successfully detect a complex, obfuscated jailbreak, but also how each stage of the pipeline contributes to the final decision. This case highlights the system’s ability to capture subtle malicious signals that would likely evade static filters, while maintaining clear and interpretable reasoning. As illustrated in Figure 7, the system processes the suspect prompt through four stages. First, a memory agent compares the prompt’s hidden-state signature against a memory bank of known attack patterns, quickly flagging potential similarities. Then, a simulation agent then generates a response in a controlled sandbox, previewing how the target LLM would behave without safety constraints and exposing the prompt’s latent intent. Next, a reflection agent evaluates the simulated response and the prompt context, determines whether safety policies are violated, and outputs a verdict with supporting rationale.Finally, based on this verdict, the system issues a recommendation to the target LLM, which in this case results in a safe refusal. Throughout the pipeline, IMAG not only classifies the input as malicious or benign, but also produces human-interpretable reasoning at each stage. This case study underscores IMAG’s superiority over black-box baselines. First, IMAG offers inherent interpretability which intermediate agent outputs provide granular insight into the decision-making process. Second, the system demonstrates adaptability via online learning; detecting a emerging attack triggers an immediate memory updating, thereby hardening the model against future adversarial variants. In summary, IMAG not only effectively intercepts complex jailbreaks but also delivers a transparent, self-improving safeguard for robust LLM deployment. 6 Conclusion & Future Work In this paper, an emerging adaptive jailbreak detection framework is proposed. The guard is consisting of immune detection, active immunity and memory updating modules. The system first matches inputs against known attacks stored in the memory bank, then evaluate ambiguous samples, and finally updates the memory bank with newly identified attacks, forming a closed-loop feedback mechanism. Extensive experiments demonstrate that our method outperforms existing methods. Crucially, the guard’s ability to continuously update its memory allows it to evolve alongside emerging threats without the need for costly retraining. This adaptability positions our method as a scalable solution for real-world open-source LLM security. In future work, we will advance our bio-inspired framework to model the co-evolution of attacks and defenses, incorporating lifelong learning for scalable memory updates. We also plan to extend our evaluation to broader proprietary and multi-modal models. Ultimately, we aim to realize a self-healing paradigm where systems autonomously adapt to and recover from evolving adversarial threats. References G. Alon and M. Kamfonas (2023) Detecting language model attacks with perplexity. CoRR abs/2308.14132. External Links: Document, 2308.14132 Cited by: item ∙ . M. Andriushchenko, F. Croce, and N. Flammarion (2025) Jailbreaking leading safety-aligned llms with simple adaptive attacks. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025, Cited by: §1, §1. Z. Cai, S. Shabihi, and et al (2025) AegisLLM: scaling agentic systems for self-reflective defense in llm security. arXiv preprint arXiv:2504.20965. Cited by: §2.3. P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong (2023) Jailbreaking black box large language models in twenty queries. 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). Cited by: §1, §2.1, item ∙ . J. Chu, Y. Liu, and et al (2024) JailbreakRadar: comprehensive assessment of jailbreak attacks against llms. In Annual Meeting of the Association for Computational Linguistics, Cited by: §2.1. DeepSeek-AI (2025) DeepSeek-r1: incentivizing reasoning capability in llms via reinforcement learning. CoRR abs/2501.12948. Cited by: §1. Y. Deng, W. Zhang, and et al (2023) Multilingual jailbreak challenges in large language models. ArXiv abs/2310.06474. Cited by: §2.1, item ∙ . S. Fan, X. Jiang, and et al (2025) Not all layers of llms are necessary during inference. In Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI 2025, Montreal, Canada, August 16-22, 2025, p. 5083–5091. External Links: Document Cited by: §3.3. S. Han, K. Rao, and et al (2024) WildGuard: open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. CoRR abs/2406.18495. External Links: 2406.18495 Cited by: §2.2. S. Hong, M. Zhuge, and et al (2023) MetaGPT: meta programming for a multi-agent collaborative framework. In The Twelfth International Conference on Learning Representations, Cited by: §2.3. X. Hu, P. Chen, and T. Ho (2024) Gradient cuff: detecting jailbreak attacks on large language models by exploring refusal loss landscapes. Advances in Neural Information Processing Systems 37, p. 126265–126296. Cited by: §1. H. Inan, K. Upasani, and et al. (2023) Llama guard: llm-based input-output safeguard for human-ai conversations. CoRR abs/2312.06674. External Links: Document, 2312.06674 Cited by: §1, §2.2, §3.1, item ∙ , §4.3, §4.4. N. Jain, A. Schwarzschild, and et al (2023) Baseline defenses for adversarial attacks against aligned language models. CoRR abs/2309.00614. External Links: 2309.00614 Cited by: §2.2. N. Lam, Y. Lee, and D. L. Farber (2024) A guide to adaptive immune memory. Nature Reviews Immunology 24 (11), p. 810–829. External Links: ISSN 1474-1741, Document Cited by: §1, §3.3, §3.4. G. Li, H. Hammoud, and et al (2023) Camel: communicative agents for" mind" exploration of large language model society. Advances in Neural Information Processing Systems 36, p. 51991–52008. Cited by: §2.3. L. Li, B. Dong, R. Wang, and et al (2024a) SALAD-bench: a hierarchical and comprehensive safety benchmark for large language models. In Annual Meeting of the Association for Computational Linguistics, Cited by: §2.2. X. Li, R. Wang, and et al (2024b) DrAttack: prompt decomposition and reconstruction makes powerful llm jailbreakers. In Conference on Empirical Methods in Natural Language Processing, Cited by: §2.1, item ∙ . S. Liu, Y. Pan, K. Hong, R. Fei, C. Lin, Q. Li, and C. Shen (2025a) Backdoor threats in large language models—a survey. Science China Information Sciences 68 (9), p. 191101. Cited by: §2.1. X. Liu, P. Li, and et al (2025b) AutoDAN-turbo: A lifelong agent for strategy self-exploration to jailbreak llms. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025, External Links: Link Cited by: §1, §2.1, item ∙ . Y. Liu, L. Liu, and et al (2025c) Embodied navigation. Science China Information Sciences 68 (4), p. 1–39. Cited by: §2.3. J. Luo, W. Zhang, and et al (2025a) Large language model agent: a survey on methodology, applications and challenges. arXiv preprint arXiv:2503.21460. Cited by: §2.3. W. Luo, S. Dai, and et al (2025b) Agrail: a lifelong agent guardrail with effective and adaptive safety detection. arXiv preprint arXiv:2502.11448. Cited by: §2.3. W. Luo, S. Ma, and et al (2024) JailBreakV: a benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. Cited by: §2.1. J. Mao, F. Meng, and et al (2025) Agentsafe: safeguarding large language model-based multi-agent systems via hierarchical data management. arXiv preprint arXiv:2503.04392. Cited by: §2.3. Mon-Williams, R., and et al. (2025) Embodied large language models enable robots to complete complex tasks in unpredictable environments. Nat Mach Intell 7, 592–601. Cited by: §1. H. Mu, H. He, and et al (2025) Stealthy jailbreak attacks on large language models via benign data mirroring. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL 2025 - Volume 1: Long Papers, Albuquerque, New Mexico, USA, April 29 - May 4, 2025, p. 1784–1799. External Links: Document Cited by: §1. M. G. Netea, E. Latz, K. H. G. Mills, and L. A. J. O’Neill (2015) Innate immune memory: a paradigm shift in understanding host defense. Nature Immunology 16 (7), p. 675–679. External Links: ISSN 1529-2916, Document Cited by: §1. OpenAI (2023) GPT-4 technical report. CoRR abs/2303.08774. Cited by: §1. L. Ouyang, J. Wu, and et al (2022) Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems 35, NeurIPS 2022, Cited by: §1, §2.2. M. Phute, A. Helbling, and et al (2024) LLM self defense: by self examination, llms know they are being tricked. In The Second Tiny Papers Track at ICLR 2024, Tiny Papers @ ICLR 2024, Vienna, Austria, May 11, 2024, Cited by: §1, §2.2, item ∙ . S. Qiao, H. Gui, and et al (2024) Making language models better tool learners with execution feedback. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 3550–3568. Cited by: §2.3. A. Robey, E. Wong, H. Hassani, and G. J. Pappas (2023) SmoothLLM: defending large language models against jailbreaking attacks. CoRR abs/2310.03684. External Links: 2310.03684 Cited by: §1. M. Russinovich, A. Salem, and R. Eldan (2025) Great, now write an article about that: the crescendo multi-turn LLM jailbreak attack. In 34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino (Eds.), p. 2421–2440. Cited by: §1. X. Shen, Z. Chen, and et al (2024) "Do anything now": characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, p. 1671–1685. Cited by: §2.1. N. Shinn, F. Cassano, and et al (2023) Reflexion: language agents with verbal reinforcement learning. Advances in Neural Information Processing Systems 36, p. 8634–8652. Cited by: §2.3. D. Srivastav and X. Zhang (2025) Safe in isolation, dangerous together: agent-driven multi-turn decomposition jailbreaks on llms. In Proceedings of the 1st Workshop for Research on Agent Language Models (REALM 2025), p. 170–183. Cited by: §2.3. G. Wang, Y. Xie, and et al (2023) Voyager: an open-ended embodied agent with large language models. arXiv preprint arXiv:2305.16291. Cited by: §2.3. L. Wang, C. Ma, and et al (2024) A survey on large language model based autonomous agents. Frontiers of Computer Science 18 (6), p. 186345. Cited by: §2.3. S. Wang, G. Zhang, and et al (2025) G-safeguard: a topology-guided security lens and treatment on llm-based multi-agent systems. arXiv preprint arXiv:2502.11127. Cited by: §2.3. A. Wei, N. Haghtalab, and J. Steinhardt (2023a) Jailbroken: how does llm safety training fail?. ArXiv abs/2307.02483. Cited by: §2.1, item ∙ . Z. Wei, Y. Wang, and Y. Wang (2023b) Jailbreak and guard aligned language models with only few in-context demonstrations. CoRR abs/2310.06387. External Links: 2310.06387 Cited by: §2.2. Q. Wu, G. Bansal, and et al (2024) Autogen: enabling next-gen llm applications via multi-agent conversations. In First Conference on Language Modeling, Cited by: §2.3. Xi, Z, and et al (2025) The rise and potential of large language model based agents: a survey.. Sci. China Inf. Sci.. Cited by: §1. Y. Xie, M. Fang, and e. a. Pi (2024) GradSafe: detecting jailbreak prompts for llms via safety-critical gradient analysis. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 507–518. Cited by: §1, §1, §2.2, §3.1, item ∙ , §4.1, §4.3, §4.4. Y. Xie, J. Yi, and et al (2023) Defending chatgpt against jailbreak attack via self-reminders. Nat. Mac. Intell. 5 (12), p. 1486–1496. Cited by: §2.2. S. Yi, Y. Liu, and et al (2024) Jailbreak attacks and defenses against large language models: a survey. ArXiv abs/2407.04295. Cited by: §2.1. Y. Zeng, Y. Wu, and et al (2024) Autodefense: multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783. Cited by: §2.3. B. Zhang, J. Zhu, and H. Su (2023) Toward the third generation artificial intelligence. Science China Information Sciences 66 (2), p. 121101. Cited by: §1. S. Zhang, Y. Zhai, K. Guo, H. Hu, S. Guo, Z. Fang, L. Zhao, C. Shen, C. Wang, and Q. Wang (2025) JBShield: defending large language models from jailbreak attacks through activated concept analysis and manipulation. In USENIX Security Symposium, Cited by: §1, §4.1. Z. Zhang, Q. Zhang, and J. N. Foerster (2024) PARDEN, can you repeat that? defending against jailbreaks via repetition. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, Cited by: §1, §2.2. J. Zheng, C. Shi, and et al (2025) Lifelong learning of large language model based agents: A roadmap. CoRR abs/2501.07278. External Links: Document, 2501.07278 Cited by: §1. A. Zou, Z. Wang, J. Z. Kolter, and et al (2023) Universal and transferable adversarial attacks on aligned language models. CoRR abs/2307.15043. External Links: 2307.15043 Cited by: §1, §2.1, item ∙ .