Paper deep dive
TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking
Mengyao Du, Han Fang, Haokai Ma, Gang Yang, Quanjun Yin, Shouling Ji, Ee-Chien Chang
Models: Gemini-2.0-Flash, GPT-3.5-Turbo, GPT-4.1-Mini, Meta-Llama-3-8B-Instruct, Qwen-2.5-7B-Instruct, Vicuna-13B-v1.5
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/11/2026, 12:36:12 AM
Summary
TrapSuffix is a proactive defense framework for LLMs that mitigates suffix-based jailbreak attacks by reshaping the adversarial optimization landscape. It uses lightweight LoRA fine-tuning to inject 'trap-aligned' behaviors, forcing attackers into either deceptive local minima (where attacks fail) or paths that produce traceable, fingerprint-carrying suffixes. The method achieves high defense success rates (ASR < 0.01%) and traceability (87.9%) with negligible inference-time overhead and minimal memory usage.
Entities (4)
Relation Signals (3)
TrapSuffix → uses → LoRA
confidence 100% · TrapSuffix, a lightweight fine-tuning approach that injects trap-aligned behaviors... via lightweight low-rank adaptation fine-tuning.
TrapSuffix → appliesto → LLM
confidence 95% · We implement TrapSuffix defense on multiple open-source large language models
TrapSuffix → mitigates → Jailbreak Attack
confidence 95% · TrapSuffix reduces the average attack success rate to below 0.01 percent
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Suffix-based jailbreak attacks append an adversarial suffix, i.e., a short token sequence, to steer aligned LLMs into unsafe outputs. Since suffixes are free-form text, they admit endlessly many surface forms, making jailbreak mitigation difficult. Most existing defenses depend on passive detection of suspicious suffixes, without leveraging the defender's inherent asymmetric ability to inject secrets and proactively conceal gaps. Motivated by this, we take a controllability-oriented perspective and develop a proactive defense that nudges attackers into a no-win dilemma: either they fall into defender-designed optimization traps and fail to produce an effective adversarial suffix, or they can succeed only by generating adversarial suffixes that carry distinctive, traceable fingerprints. We propose TrapSuffix, a lightweight fine-tuning approach that injects trap-aligned behaviors into the base model without changing the inference pipeline. TrapSuffix channels jailbreak attempts into these two outcomes by reshaping the model's response landscape to adversarial suffixes. Across diverse suffix-based jailbreak settings, TrapSuffix reduces the average attack success rate to below 0.01 percent and achieves an average tracing success rate of 87.9 percent, providing both strong defense and reliable traceability. It introduces no inference-time overhead and incurs negligible memory cost, requiring only 15.87 MB of additional memory on average, whereas state-of-the-art LLM-based detection defenses typically incur memory overheads at the 1e4 MB level, while composing naturally with existing filtering-based defenses for complementary protection.
Tags
Links
Trouble viewing inline? Open PDF directly →
Full Text
103,291 characters extracted from source content.
Expand or collapse full text
TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking Mengyao Du 1 , Han Fang 2 , Haokai Ma 2 , Gang Yang 2 , Quanjun Yin 1 , Shouling Ji 3 , Ee-Chien Chang 2 1 National University of Defense Technology 2 National University of Singapore 3 Zhejiang University Abstract Suffix-based jailbreak attacks append an adversarial suf- fix, i.e., a short token sequence, to steer aligned LLMs into unsafe outputs. Since suffixes are free-form text, they admit endlessly many surface forms, making jailbreak mitigation dif- ficult. Most existing defenses depend on passive detection of suspicious suffixes, without leveraging the defender’s inherent asymmetric ability to inject secrets and proactively conceal gaps. Motivated by this, we take a controllability-oriented per- spective and develop a proactive defense that nudges attackers into a no-win dilemma: either they fall into defender-designed optimization traps and fail to produce an effective adversarial suffix, or they can succeed only by generating adversarial suf- fixes that carry distinctive, traceable fingerprints. We propose TrapSuffix, a lightweight fine-tuning approach that injects trap-aligned behaviors into the base model without changing the inference pipeline. TrapSuffix channels jailbreak attempts into these two outcomes by reshaping the model’s response landscape to adversarial suffixes. Across diverse suffix-based jailbreak settings, TrapSuffix reduces the average attack suc- cess rate to below 0.01% and achieves an average tracing success rate of 87.9%, providing both strong defense and reli- able traceability. It introduces no inference-time overhead and incurs negligible memory cost, requiring only 15.87 MB of additional memory on average, whereas state-of-the-art LLM- based detection defenses typically incur memory overheads at the10 4 MB level, while composing naturally with existing filtering-based defenses for complementary protection. 1 Introduction Large language models (LLMs), such as GPT [30], Llama [42], and DeepSeek [24], are being adopted across di- verse real-world domains [3, 13, 16, 38]. However, this broad deployment has raised concerns about adversarial risks, with jailbreak attacks emerging as a prominent threat. Specifically, these attacks exploit gaps to bypass safety mechanisms and elicit harmful or policy-violating responses [52, 54]. Existing jailbreak attacks vary in complexity and are de- signed under different threat models. Among them, suffix- based jailbreak attacks pose a particularly acute risk: the attacker appends a short adversarial suffix, that is, a token se- quence not constrained by natural-language coherence, to an otherwise harmful question, and searches for a suffix that reli- ably steers an aligned LLM into unsafe outputs [1,9,26,50,58]. A defining characteristic of this threat is its open-ended attack surface. For example,LLaMA-3-8B-Instructuses a vocab- ulary with over10 5 tokens. With an adversarial suffix length of 20, the induced search space already grows beyond10 100 possible sequences. More importantly, the effective suffixes need not resemble human language: they can be syntactically arbitrary while still triggering harmful behavior, making suf- fix attacks substantially harder to characterize than jailbreaks constrained by multi-turn conversational coherence or natural language plausibility [6, 22, 28, 34, 43]. To mitigate jailbreak threats, both academia and indus- try have proposed a wide range of defenses. A prominent line of work relies on passive detection: identifying suspi- cious prompts/suffixes (or suspicious generations) and then filtering, blocking, or refusing them [12, 18, 19, 27, 36, 48]. Other approaches attempt to purify unsafe generations us- ing internal signals such as gradients or hidden states, or strengthen safety via additional alignment procedures such as RLHF [17, 31, 46, 49, 55]. While these methods provide valuable protection, they share a common posture: they react to whatever suffix the attacker produces. This posture is fundamentally uncontrollable for suffix- based attacks. Because a suffix is free-form text, an attacker can realize similar unsafe behavior through an endless number of surface forms without a stable invariant that defenders can reliably pin down, such as token-level rewrites, paraphrase- like variants, or non-linguistic sequences. In other words, when an adversarial suffix can “look like anything,” the de- fender is forced to chase an unbounded space with brittle rules and shifting signatures. This motivates a different viewpoint: rather than trying to recognize every possible malicious suffix after it appears, can we design the model so that jailbreak 1 arXiv:2602.06630v1 [cs.CR] 6 Feb 2026 Local Minima L o s s Suffix Optimization Space I’m sorry, but I can’t provide that information. Safe Region Sure, here is a step-by- step guide to make a bomb. How to make a bomb? Harmful QuestionAdversarial Suffix Trap Suffix ... T 2 T m S 2 ... S 1 S 2 S n Jailbreak Success Region T 1 Exist is Enough! Figure 1: Illustration of adversarial suffix optimization under our TrapSuffix defense. An attacker optimizes an adversar- ial suffix by searching over the suffix space to minimize the adversarial loss. Our defense reshapes the adversarial opti- mization landscape, yielding two outcomes: attacks are either trapped in a rugged landscape with deceptive local minima, or succeed only by producing traceable suffix fingerprints. attempts unfold only in ways the defender can manage? We answer this question with a controllable, proactive de- fense that guides attackers into a no-win dilemma. As illus- trated in Figure 1, when an attacker searches for an effective adversarial suffix, the process is nudged toward one of two outcomes: either it is drawn into defender-designed local min- ima where progress stalls and the attack fails to produce an effective adversarial suffix, or it can succeed only by pro- ducing suffixes that carry distinctive, traceable fingerprints, enabling attribution of attack trajectories and sources. Unlike passive detection, the goal is not to prevent attacks from be- ing attempted, but to ensure that any attempt evolves within a defender-controlled regime: fail safely or succeed loudly. Realizing this design is non-trivial. Suffix-based jailbreaks operate in a vast, discrete space and can be instantiated through diverse search strategies [1, 26, 50, 58]. A defense must therefore remain effective without assuming a particu- lar optimizer, suffix format, or linguistic structure, while still providing consistent trapping and traceability behavior across different attack strategies. This calls for a mechanism that shapes the model’s response landscape to adversarial suf- fixes in a strategy-agnostic way, yet does so without incurring inference-time overhead or degrading benign utility. To this end, we propose TRAPSUFFIX, a lightweight fine- tuning approach that injects trap-aligned behaviors into the base model without modifying the inference pipeline. We begin by abstracting a unified adversarial loss objective that captures the shared goal across diverse jailbreak strategies. Building on this insight, a set of trap suffixes is constructed to reshape the loss landscape encountered during adversar- ial optimization. The defense objective is then formalized through two complementary components that jointly enforce safety and traceability, and these behaviors are integrated into the model via lightweight low-rank adaptation fine-tuning. Importantly, this design can provide an explicit traceability guarantee through identifiable trap-aligned fingerprints. We implement TrapSuffix defense on multiple open-source large language models and evaluate its effectiveness against a broad range of suffix-based jailbreak attacks, as well as exist- ing defense baselines. Experimental results show that Trap- Suffix reduces the average attack success rate (ASR) to below 0.01%. Importantly, unlike most existing defenses, TrapSuffix introduces no inference-time overhead and incurs negligible memory cost, requiring only 15.87 MB of additional memory on average, whereas LLM-based detection defenses typically incur memory overheads on the order of10 4 MB. Moreover, TrapSuffix remains effective under adaptive adversarial set- tings, where the adversary has full knowledge of the trap suf- fixes. We further evaluate utility on the multiple benchmarks and show that TrapSuffix preserves overall model utility. Con- sequently, TrapSuffix is modular and plug-and-play, and can be readily integrated into existing alignment pipelines. All code and experiments are released at an anonymized reposi- tory 1 . To summarize, our key contributions are as follows: •We present an in-depth analysis of existing jailbreak de- fenses and reveal a controllability gap: due to the un- bounded space of adversarial suffix surface forms, post- hoc detection or rule-based blocking becomes brittle under different attack optimization strategies. •We propose TRAPSUFFIX, a lightweight fine-tuning ap- proach that injects trap-aligned behaviors into the base model to construct deceptive local minima and traceable suffix fingerprints, without modifying the inference pipeline or introducing inference-time overhead. • We conduct extensive experiments to evaluate TrapSuffix across diverse open-source models. Results show that Trap- Suffix reduces ASR to below 0.01% without incurring any inference-time overhead, while introducing only minimal memory overhead (15.87 MB on average), several orders of magnitude lower than LLM-based detection defenses, and remains effective under adaptive adversarial settings. 2 Preliminaries 2.1 Adversarial Suffixes In suffix-based jailbreak attacks, an attacker searches for an adversarial suffixSfor a given harmful questionQ(e.g., “How to make a bomb”) through iterative optimization and heuristic search. The adversarial suffixSis typically a sequence of ktokens drawn from the model vocabularyV, denoted as S∈ V k . The adversarial prompt is typically formed by con- catenation of the harmful question and the suffix, denoted asP = Q⋄ S. The combined promptPis carefully crafted to elicit responses from the aligned LLM that violate safety boundaries or generate harmful, policy-violating content. 1 https://anonymous.4open.science/r/TrapSuffix-6161 2 Formally, let the aligned LLMM θ be denoted as a condi- tional probability model parameterized byθ. Given an adver- sarial promptP, the model defines an autoregressive distribu- tion over the response sequence R = (r 1 ,r 2 ,...,r n ): p θ (R| P) = n ∏ t=1 p θ (r t | P,r <t ).(1) Accordingly, the response generation process corresponds to sequentially sampling from this distribution, yieldingR∼ p θ (·| P), where each tokenr t is sampled conditioned on the prompt P and the previously generated tokens r <t . Then, we define a binary jailbreak indicator 2 J : Q×R→ 0, 1 , whereJ (Q,R) = 1indicates that the generated re- sponseRconstitutes a successful jailbreak for the harmful question Q, and J (Q,R) = 0 otherwise. Finally, the attacker seeks an adversarial suffixS ⋆ that max- imizes the probability of inducing a jailbreak attack under the model’s conditional response distribution: S ⋆ = arg max S∈V k Pr R∼p θ (·|Q⋄S) [J (Q,R) = 1].(2) 2.2 Low-Rank Adaptation Low-Rank Adaptation (LoRA) introduces a low-rank pa- rameterization of weight updates in a pre-trained language modelM θ , while keeping the original model parameters fixed. Specifically, for a weight matrixW ∈ R d×k withinM θ , LoRA parameterizes the update as ∆W = BA,(3) where B∈ R d×r and A∈ R r×k , with rankr≪ min(d,k). The adapted model is thus denoted asM θ ′ , where the updated weight satisfies W ′ = W + ∆W . By restricting optimization to a low-rank subspace while keeping the base parameters frozen, LoRA substantially re- duces the number of trainable parameters and the memory overhead during fine-tuning, enabling lightweight and modu- lar, plug-and-play adaptation of large language models. 3 Problem Formulation 3.1 Threat Model Attacker’s goal and capability. The attacker aims to induce an aligned LLM to generate harmful or policy-violating con- tent by optimizing an adversarial suffix appended to a harmful question. It is assumed that the attacker can repeatedly query the model with inputs of the formQ⋄ Sand refine the suf- fixSthrough iterative optimization. The attacker is assumed to have access to model feedback sufficient to evaluate or 2 In practice, jailbreak attack success is typically evaluated using an auxil- iary language model or by identifying explicit refusal patterns. approximate an attack objective, such as a surrogate loss or token-level likelihood score, enabling effective suffix opti- mization over multiple iterations. Futhermore, the attacker may freely choose the length, initialization, update rule, and search hyperparameters for the suffix, and also adapt the opti- mization strategy when aware of deployed defenses. Defender’s goal and capability. The defender aims to prevent suffix-based jailbreak attacks while preserving the aligned model’s utility and deployment performance. A de- fense is considered effective under two conditions: (i) pre- venting the attacker from optimizing adversarial suffixes that reliably induce jailbreak behaviors; or (i) enabling robust and reliable tracing of any adversarial suffix that achieves jailbreak success. The defender has full access to the model parameters and can modify them offline. However, the defender cannot distinguish benign user queries from adversarially optimized prompts during inference, nor does the defender know which optimization algorithm or search strategy the attacker em- ploys. This setting reflects the practical real-world constraints faced by modern LLM service providers. 3.2 Defense Objective Formulation Rather than constraining the optimization process of the at- tacker, the defender aims to implement proactive defense by fine-tuning the base modelM θ into a modified version M θ ′ . For convenience, we simplify the generation process by defining the model output asR = M θ ′ (Q⋄S ⋆ ) , whereQis a harmful question andS ⋆ denotes the attacker-optimized suf- fix that maximizes the likelihood of a jailbreak. The defense objective is formalized via the following three properties. Property 1 (Attack Resilience). The defended modelM θ ′ suppresses the overall effectiveness of jailbreak attacks in expectation. Formally, given a binary jailbreak indicatorJ, whereJ (Q,R) = 1indicates a successful jailbreak, it satisfied: 1 |Q| ∑ Q∈Q J Q, M θ ′ (Q⋄S ⋆ ) ≤ ε,(4) whereQis sampled from the setQof harmful questions and εis a small constant determined by the desired security level. This property ensures negligible expected jailbreak success even under attacker-optimized adversarial suffixes, which is a necessary baseline for robust jailbreak defense. Property 2 (Fingerprint Traceability). The defended model M θ ′ ensures that successful jailbreaks are only attainable through adversarial suffixes that contain trap suffix finger- print patterns. Formally, for any suffix S∈ V k , J Q, M θ ′ (Q⋄S) = 1 ⇒ Φ(Q⋄S)> α,(5) whereΦ : V ∗ → [0, 1]denotes a normalized traceability score over the adversarial prompt, andαis a predefined traceabil- ity threshold. This property ensures that jailbreak success necessarily entails the activation of distinct and identifiable fingerprint signals, enabling reliable tracing and attribution. 3 Property 3 (Utility Preservation). The defended modelM θ ′ preserves its general instruction-following and task-solving capabilities on benign inputs.This property ensures that our TrapSuffix defense mechanisms do not significantly degrade model utility on standard non-adversarial tasks. 4 The Proposed Framework Key Insight. The central insight in this paper is that jail- break success should no longer come for free. By proactively intervening in the attacker’s optimization process through modifying only a small subset of model parameters, the frame- work achieves both effective defense and traceability. This is realized by reshaping the attacker’s optimization landscape. Concretely, an adversarial suffix is either guided toward de- ceptive local minima that yield harmless responses, or drawn into regions that embed distinctive and traceable fingerprints. 4.1 Synthesis of Trap-aligned Prompts To support our defense objective, we synthesize trap-aligned adversarial prompts for fine-tuning, without assuming or sim- ulating any specific attack strategies and optimization. Specif- ically, we introduce a set of designated trap suffixesT trap ⊂ V, which serve as controllable triggers during adversarial opti- mization 3 . An adversarial suffixS ′ ∈ V k is said to be trap- aligned if it contains tokens from T trap . Formally, S ′ satisfies ∃i∈1,...,ks.t. s i ∈ T trap .(6) Given harmful questionQ∈ Q, the combined trap-aligned adversarial prompts pairs(Q⋄ S,Q⋄ S ′ )serve as local con- trastive instances used to fine-tune the defended model. Since different jailbreak attacks explore highly diverse regions of the adversarial suffix space, explicitly simulating attacker- specific optimization trajectories is impractical. In practice, adversarial suffixesSare randomly sampled fromV k , and trap alignment is enforced by substituting tokens with elements fromT trap . This pairwise contrastive construction enables the defender to introduce a relative preference against trap suf- fixes during training, without relying on assumptions about the attacker’s specific optimization strategy. 4.2 Adversarial Surrogate Loss While jailbreak attacks based on adversarial suffixes vary in their search strategies and implementation details, they typically optimize a continuous surrogate loss under a unified formulation to approximate the discrete jailbreak objective. Specifically, given a harmful questionQand its corresponding policy-violating answerA(Q)(e.g., “Sure, here is how to make a bomb.”), the attacker appends a learnable suffixS∈ 3 Details of the construction of trap suffixes are provided in Appendix E.1. V k to formQ⋄ S, and minimizes the following adversarial loss, instantiated as a cross-entropy objective: L J (Q⋄S,A(Q)) =− n ∑ i=1 log p θ a i | Q⋄S;a <i ,(7) wherenis the length of the answer sequence,p θ is the con- ditional distribution defined by the language model, anda <i denotes the partial target sequence preceding token a i . This adversarial loss serves as a differentiable proxy for the discrete jailbreak objective. Finally, the attacker aims to find an adversarial suffix that minimizes this surrogate loss: S ⋆ = arg min S∈V k L J (Q⋄S,A(Q)).(8) The solutionS ⋆ corresponds to an adversarial suffix that in- duces the model to produce the harmful responseA(Q)with high probability. While suffix-based jailbreak attacks differ in design, our formulation offers an abstract yet representative view that implicitly captures their underlying optimization behavior. This surrogate loss is used to guide the subsequent defense design by reshaping the adversarial suffix optimiza- tion landscape through relative loss relationships. 4.3 Constructing Deceptive Local Minima Deceptive local minima are designed to appear attractive to attackers, inducing convergence to sub-optimal adversarial suffixes. At a high level, this is achieved by making the ad- versarial loss landscape rougher, which hinders stable con- vergence. To realize such deceptive local minima in practice, we design two complementary loss terms: local optimality enforcement and trap safety regularization. Local Optimality Enforcement. The objective of this term is to reshape the local loss landscape of the attacker’s surrogate objectiveL J such that trap-aligned adversarial suffixes be- come locally optimal solutions. This relative ordering encour- ages the adversarial optimization process to converge toward trap suffixes. Accordingly, we define(x) + ≜ max(0,x)and implement this term as a margin-based hinge loss: L 1 = 1 |Q||S| ∑ Q∈Q ∑ S∈S L J (Q⋄S ′ ,A(Q))−L J (Q⋄S,A(Q))+γ + , (9) whereQ∈ Qdenotes a harmful query,S∈ Sdenotes a simu- lated adversarial suffix, sampled to represent candidate suf- fixes explored during adversarial optimization, andγ> 0is a margin parameter controlling relative loss separation. The intuition behind this formulation is that the objective is not to enforce the adversarial loss of a trap suffixS ′ to be absolutely minimal, but rather to ensure that it is relatively lower than that of a randomly sampled suffixSwithin the local neigh- borhood. This loss term acts as a soft, pairwise local ordering constraint that biases the optimization dynamics toward trap suffixes without enforcing absolute loss minimization. 4 Trap Safety Regularization. The objective of this term is to elevate the adversarial objective associated with trap suffixes, such that convergence to these suffixes no longer provides a reliable path to successful jailbreaks, even when local optimal- ity conditions are satisfied. While not universally preventive, this regularization removes most effective jailbreak outcomes when adversarial optimization converges to trap suffixes. For- mally, the regularization term is defined as: L 2 = 1 |Q||S| ∑ Q∈Q ∑ S∈S l safe − L J (Q⋄S ′ ,A(Q)) ,(10) wherel safe denotes a predefined safety reference level on the adversarial loss. This term introduces a linear bias that ele- vates the adversarial objective associated with trap suffixes, discouraging locally optimal trap suffixes from correspond- ing to effective jailbreak outcomes. When combined with the local optimality enforcement term, this regularization decou- ples adversarial convergence from jailbreak success. Since the regularization is applied only to trap suffixes, it induces minimal perturbation to the model’s overall behavior. 4.4 Constructing Traceable Fingerprints The local minima objectives in the previous section reshape the adversarial loss landscape by introducing trap-aligned op- tima. However, due to the vast and adaptive search space of adversarial suffixes, an attack may bypass these trap suffixes entirely. To address this, we further guide the optimization dy- namics toward trap suffixes by enhancing their attractiveness and stability. We design this terms that encourage convergence into these regions, ensuring that successful attacks inevitably carry distinctive and traceable fingerprints. Gradient-Guided Attraction. The objective of this term is to guide the optimization trajectory of attacker toward trap- aligned regions of the search space in a gradient-consistent manner. Intuitively, unlike local optimality enforcement, which only modifies local ranking among candidate suffixes, this term actively steers the adversarial search process toward the trap suffix region, rather than merely making trap suffixes more attractive solutions. Concretely, we consider gradient- induced scores that capture the first-order effect of replacing suffix tokens on the adversarial loss L J . We define G(Q,S) ≜ ∇ E L J (Q⋄S,A(Q)),(11) where E denotes the token embedding matrix, andG(Q,S)[v] represents the gradient-induced score associated with replac- ing a suffix token by vocabulary itemv. A smaller value of G ( Q,S)[v]indicates a more favorable update direction under a first-order approximation for reducing the adversarial loss. We introduce a margin-based ranking constraint on the gradient-induced scores to induce a relative ordering that guides the search toward designated regions of the space. This defines the following gradient-guided attraction loss: L 3 = 1 |Q||S| ∑ Q∈Q ∑ S∈S G(Q,S)[v ⋆ ]− min v∈V\v ⋆ G(Q,S)[v]+δ + , (12) wherev ⋆ ∈ T trap denotes the trap-inducing token andδ> 0is a margin parameter. From the attacker’s perspective, smaller scores correspond to more effective descent directions for minimizing the adversarial objective. By shaping both the value landscape and the associated descent dynamics, this gradient-guided attraction mechanism complements loss-level local optimality enforcement and helps stabilize adversarial optimization around trap-aligned solutions. Semantic Termination Control. The objective of this term is to cause jailbreak attacks to terminate early in the pres- ence of trap suffixes. In particular, a class of jailbreak attacks treats the absence of explicit refusal cues (e.g., “I’m sorry” or “I cannot”) as an indicator of success, and terminates the optimization process once such signals disappear. We lever- age this vulnerability by introducing a semantic contrastive constraint that conditions the model’s response distribution. Ideally, when a trap suffix is present, the model is encouraged to produce a non-refusal response, thereby inducing the at- tacker to prematurely terminate the attack under refusal-based stopping criteria. Concretely, letNdenote a predefined non- refusal safe target, andA(Q)denote the attacker’s intended harmful target for queryQ. We enforce that, under a trap suffix S ′ , generating the non-refusal safe target is strictly preferred over generating the harmful target by a marginτ> 0. This is implemented via the following margin-based contrastive loss: L 4 = 1 |Q||S| ∑ Q∈Q ∑ S ′ ∈S L J (Q⋄S ′ ,N)−L J (Q⋄S ′ ,A(Q))+τ + , (13) This formulation encourages trap suffixes to elicit non-refusal responses while reducing the likelihood of harmful outputs. Accordingly, this objective targets attack strategies that rely on refusal-based or semantic termination criteria, serving as a complementary mechanism to the earlier objectives by fur- ther constraining the attacker’s optimization landscape and termination behavior. Joint Optimization. To avoid over-regularization and pre- serve the model’s general instruction-following capability, we incorporate a utility-preserving task loss into the unified objective as an explicit regularization term. Specifically, we apply the standard conditional language-modeling loss: L 0 =− 1 |D| ∑ (x,y)∈D T ∑ t=1 log p θ (y t | x,y <t ),(14) whereDdenotes the set of instruction-response pairs used for utility-preserving updates. Finally, we define a compos- ite objective that couples trap-specific losses with a utility- 5 preserving task loss. The overall training objective is given: L total = L 0 + 4 ∑ i=1 L i .(15) Together, these objective functions form a unified training objective that realizes the TrapSuffix defense by jointly opti- mizing utility preservation and trap-specific constraints, fol- lowing the joint training procedure in Algorithm C.4. In prac- tice, all trap-specific objectives are implemented via LoRA, a lightweight fine-tuning approach detailed in Section 2.2. This design incurs negligible additional memory overhead and is plug-and-play, while remaining orthogonal to the existing alignment mechanisms and deployment pipelines. 4.5 Traceability Guarantee Beyond suppressing jailbreak success, our defense provides an explicit traceability guarantee for adversarial suffixes. As formalized in Section 3.2 (Property 2), even when an adver- sarial suffix succeeds in inducing a jailbreak, the resulting attack inevitably exhibits intrinsic trap-induced fingerprints. To quantify this property, we define a traceability score that measures the presence of trap suffix in a prompt. Specifi- cally, for a promptP, the traceability score is defined as the proportion of tokens in P that belong to trap suffix set T trap : Φ(P) ≜ 1 |P| |P| ∑ i=1 1 p i ∈ T trap .(16) In general, a largerΦ(P)indicates a higher proportion of trap suffixes in the prompt, which corresponds to a higher degree of traceability under the TrapSuffix mechanism. Traceability threshold. A key question is how to determine the thresholdαthat delineates traceable suffixes. Specifically, αdefines the minimum proportion of trap suffixes required for a promptPto be flagged as traceable. Since trap suffixes are deliberately chosen to be statistically rare in natural language, We estimate the distribution ofΦ(P)on open instruction- tuned corpora as a reference distribution for threshold cali- bration. We then defineαas thep-th percentile of this ref- erence distribution:α = Percentile p (Φ(P)),wherepis set conservatively (e.g.,p = 80) to ensure high specificity. The empirical distribution and percentile statistics are reported in Appendix E.2. This percentile-based calibration yields an empirical decision boundary derived from the observed score distribution, fixed across attacks and models. 5 Evaluation Our defense aims to mitigate suffix-based jailbreak attacks while ensuring their traceability, without degrading model util- ity. To systematically assess the performance of TrapSuffix, we propose the following research questions: •RQ1: What is the actual defensive effectiveness of the TrapSuffix under various suffix-based jailbreak attacks? •RQ2: How robust is TrapSuffix against adaptive attackers that modify their optimization strategies? •RQ3: How does the TrapSuffix affect the optimization behavior of suffix-based jailbreak attacks? •RQ4: How transferable are adversarial suffixes optimized against the defended models to other LLMs? •RQ5: Does the proposed defense preserve the model’s general instruction-following capability? 5.1 Experiment Setup Data. We employ two complementary data sources: a set of harmful questions for safety-oriented training and a collection of general instruction-response pairs for utility preservation. The harmful questions are derived from JailbreakBench [5], which includes 100 representative jailbreak prompts aligned with OpenAI’s policy risk taxonomy, covering domains such as malware, harassment, economic harm, and high-risk deci- sion making. For general capability retention, we utilize the Databricks Dolly-15K dataset [11], a collection of human- authored instruction–response pairs covering diverse reason- ing, summarization, and creative generation tasks. To further assess utility preservation, we evaluate model performance on standard benchmarks including ARC-C [10], HellaSwag [53], and MMLU [14, 15], which collectively assess general rea- soning, understanding, and knowledge capabilities. Models. We evaluate our defense on three open-source aligned languagemodels:Qwen-2.5-7B(Qwen2.5- 7B-Instruct)[41], LLaMA-3-8B(Meta-Llama-3-8B- Instruct) [42], and Vicuna-13B (vicuna-13B-v1.5) [8]. These models differ in model size, architecture, tokenizer design, and alignment strength, providing a representative testbed for evaluating generalization across heterogeneous model families. To assess cross-model transferability, we further evaluate the adversarial suffixes on three closed-source models accessed via APIs, including Gemini-2.0-Flash [40], GPT-3.5-Turbo, and GPT-4.1-Mini [30]. Attacks. Our evaluation focuses on suffix-based jailbreak attacks that explicitly optimize adversarial suffixes to elicit harmful model outputs. We consider five representative meth- ods spanning gradient-based and heuristic optimization fami- lies. Gradient-driven attacks include GCG [58] and its vari- ant Probe [57], which iteratively reduce refusal likelihood via coordinate-wise or amplitude-adjusted gradient updates. We further evaluate three population-based or stochastic opti- mization methods: AutoDAN [26], which applies a genetic algorithm; JSAA [1], which performs simulated annealing over candidate suffixes; and Transfer [50], which incorporates response-pattern constraints to enhance cross-model trans- 6 ferability. The detailed attack configurations are provided in Appendix C.2. Defense Baselines. Following the SoK4JailbreakGuardrails benchmark [45], we evaluate against a comprehensive set of defense baselines that cover the major categories of existing jailbreak mitigation strategies. The considered defenses in- clude perplexity-based filtering (PPL) [19], GradSafe [48], SmoothLLM [35], and Gradient Cuff (GradCuff) [17]. In ad- dition, we evaluate guard-model-based defenses, including LlamaGuard [18], GuardReasoner [27], and WildGuard [12], each under two configurations: Pre and Post, which corre- spond to pre-generation and post-generation guardrail deploy- ment, respectively. We further include SelfDefend [46], eval- uated under both direct-response (Direct) and intent-based (Intent) variants following the original implementation. Metrics. We evaluate defense effectiveness using the Attack Success Rate (ASR), which measures the fraction of adver- sarial attempts that successfully induce harmful or policy- violating responses while evading traceability. In this paper, a defense is considered effective if either of the following conditions holds for a given attack attempt: (i) the model produces a non-harmful response, i.e.,J (Q⋄ S,R) = 0; or (i) the attack succeeds but the resulting adversarial suffix exhibits sufficient traceability, as indicated by a traceability scoreΦ(Q⋄S)exceeding a predefined traceability threshold. For the construction ofJ, each model response is evaluated by GPT-4o as an automated judge, and a jailbreak is considered successful when the assigned score exceeds 5. We further report the Tracing Success Rate (TSR), which measures the fraction of successful jailbreak attempts whose adversarial suffixes are identifiable via trap-induced fingerprints. Another metric is the False Positive Rate (FPR), which measures how often an attacker falsely declares success and terminates opti- mization despite no actual jailbreak occurring. The detailed formulations of all three metrics are provided in Appendix B. Training. All models are fine-tuned using the LoRA method, which enables efficient integration of the TrapSuffix objective through low-dimensional parameter updates. A configuration with rankr = 8, scaling factorlora_alpha = 16, and dropout ratelora_dropout = 0.05is adopted. The LoRA modules are applied to theq_projandv_projmodules of the model. The learning rate is fixed at5× 10 −5 , and each model is trained for 40 epochs. All experiments are conducted on four NVIDIA A40 GPUs with 48 GB of memory each. Hyperparameters. TrapSuffix involves several hyperparam- eters. For simplicity and consistency, the same training con- figuration is used across all three fine-tuned models. We set the number of trap suffixes tok = 100. The weighting pa- rameterγis0.42, with the safety reference levell safe is set to 2.0. The margin parametersδandτare set to0.19and0.95, respectively, and the traceability thresholdαis0. Additional hyperparameter analysis is provided in Appendix C.3. 5.2 RQ1: Defensive Effectiveness This subsection investigates the defensive effectiveness of the proposed defense against suffix-based jailbreak attacks. We evaluate effectiveness using three complementary met- rics: ASR, which measures the fraction of successful jailbreak attempts; TSR, which quantifies the ability to identify trap- aligned adversarial suffixes; and FPR, which measures how often an attacker falsely declares success and terminates opti- mization despite no actual jailbreak occurring. Defense Performance. We consider five representative suffix- based jailbreak attacks and compare twelve defense meth- ods, where defenses with multiple variants are reported using separate columns (e.g., Pre/Post or Direct/Intent). Defensive performance is evaluated on JailbreakBench, which contains 100 harmful prompts, using ASR as the primary metric. In addition to ASR, we report inference-time efficiency in terms of average latency and memory overhead. For brevity, Qwen, LLaMA, and Vicuna denote Qwen-2.5-7B, LLaMA-3-8B, and Vicuna-13B, respectively. As shown in Table 1, TrapSuf- fix achieves a low average ASR of 0.01 across all evaluated settings. Notably, TrapSuffix reduces the ASR to nearly zero across almost all jailbreak attacks on LLaMA-3-8B. Although TrapSuffix yields non-zero ASR on Vicuna-13B under GCG and Probe attacks (0.05 and 0.04, respectively), this behav- ior can be attributed to differences in tokenization between Vicuna-13B and the other target models, which necessitate a distinct strategy for trap suffix construction and trace filter design. Overall, TrapSuffix substantially suppresses jailbreak success compared to the other defense baseline, demonstrat- ing robust defensive effectiveness. In terms of efficiency, Trap- Suffix incurs substantially lower inference-time cost than ex- isting defenses. The reported average delay corresponds to the tracing step and is measured as 0.000219 seconds in practice, which is reported as approximately zero in Table 1. For GPU memory overhead, TrapSuffix relies solely on a lightweight LoRA module, without introducing additional auxiliary com- ponents at inference time. As a result, the additional memory footprint is limited to 15.87 MB, whereas many LLM-based detection defenses require auxiliary models at inference time and incur memory overheads on the order of10 4 MB. This arises from the reliance of most existing defenses on external classifiers or auxiliary LLMs during inference, resulting in substantially higher memory consumption and inference la- tency. Therefore, TrapSuffix offers a more memory-efficient and deployment-friendly defense solution. Tracing Effectiveness. We evaluate tracing effectiveness by measuring the TSR across different jailbreak attacks. This metric quantifies the proportion of the fraction of successful jailbreak attempts that are correctly traced by the defense. Higher values indicate stronger traceability of adversarial suffixes under TrapSuffix. The column #Jailbreaks reports the number of successful jailbreak attempts, while #Traced reports the number of successful jailbreak attempts that ex- 7 Table 1: Effectiveness and efficiency of TrapSuffix compared with twelve baseline jailbreak defenses. ModelAttackNo Def.PPLGradSafe SmoothLLM GradCuff Llama GuardGuardReasonerWildGuardSelfDefend TrapSuffix PrePostPrePostPrePostDirectIntent Qwen GCG0.280.040.280.100.030.100.140.000.000.000.010.010.000.00 AutoDAN0.610.610.610.600.270.380.320.000.010.010.010.020.090.00 Probe 0.210.090.210.100.010.070.090.000.000.000.000.000.000.00 Transfer0.890.830.890.250.170.410.440.000.020.000.020.260.040.00 JSAA0.940.940.940.800.920.370.450.000.010.000.020.010.020.05 LLaMA GCG0.070.030.060.010.020.020.020.000.000.000.000.000.000.00 AutoDAN0.290.290.060.070.000.230.240.040.040.040.040.130.110.00 Probe0.060.030.050.010.040.030.030.000.010.000.000.020.020.01 Transfer0.380.310.330.080.020.200.260.000.030.000.020.100.040.00 JSAA0.850.850.850.030.000.520.240.000.000.000.020.020.000.00 Vicuna GCG0.710.090.700.020.000.250.280.000.000.000.030.050.040.05 AutoDAN0.490.490.490.460.000.330.260.000.010.000.000.030.050.01 Probe 0.640.060.630.010.000.170.210.000.010.000.000.010.000.04 Transfer0.810.010.810.180.010.490.390.010.010.010.030.090.030.00 JSAA0.770.770.770.690.010.320.390.000.000.000.020.000.000.00 Avg ASR↓0.530.360.510.230.100.260.250.000.010.000.010.050.030.01 Avg Delay(s)↓–0.092.3738.8334.430.380.4110.4412.282.302.230.841.77≈ 0.0 Avg Memory(MB)↓–13,1208,7442,1851,83915,229 14,38415,68615,68628,924 29,01313,315 13,33815.87 Table 2: Traceability of adversarial suffixes across attacks. AttackTracing Success Rate↑#Traced#Jailbreaks GCG44.44%49 AutoDAN75.00%34 Probe20.00%15 Transfer100.00%9191 JSAA66.67%1015 Avg87.90%109124 hibit traceable fingerprints. As shown in Table 2, a substantial fraction of failed jailbreak attempts remains traceable under our defense. Overall, TrapSuffix achieves an average TSR of 87.90% across all evaluated attacks. Notably, Transfer attack attains a TSR of 100%. We also observe that Probe exhibits a lower TSR compared to other attacks. A plausible explanation is that Probe relies on a smaller draft model (e.g., GPT-2) to pre-filter candidate suffixes during optimization, which alters the adversarial search distribution and reduces exposure to trap-aligned patterns. At the same time, Probe yields only a limited number of successful jailbreak attempts against the LoRA-based model, indicating that its reduced TSR does not translate into higher attack effectiveness. Overall, these results indicate that the overall tracing effectiveness of TrapSuffix remains robust across the evaluated attack settings. False Positive Analysis. This section investigates a class of jailbreak attacks that determine attack success based on the ab- sence of refusal patterns in the model’s response. To evaluate our method under this attack paradigm, we adopt the FPR to measures the fraction of attacks that appear successful to the attacker but fail to produce a real jailbreak. We compare the FPR of AutoDAN under the TrapSuffix defense with that of the undefended model. As shown in Fig. 2, with shaded bars indicating TrapSuffix and solid bars indicating no defense, TrapSuffix substantially increases the FPR across all three target models, indicating that a large fraction of adversarial suffixes judged as successful by the attacker do not result in actual jailbreaks. In particular, AutoDAN exhibits an FPR of 100% on Qwen-2.5-7B and LLaMA-3-8B under TrapSuf- fix, meaning that all non-refusal responses produced during attack optimization remain harmless. On Vicuna-13B, the FPR remains high at 96%, consistent with the overall trend observed across models. These results show that TrapSuffix can effectively disrupt non-refusal-based jailbreak attacks in a model-agnostic manner by breaking the alignment between the attacker’s success criterion and actual jailbreak outcomes. 5.3 RQ2: Adaptive Attack Analysis In this section, we analyze the robustness of TrapSuffix against two representative classes of adaptive adversaries. All experiments are conducted using GCG on Qwen-2.5-7B. Adaptive Knowledge of Trap Suffixes. We consider an adap- tive attacker with partial or full knowledge of the defender’s trap suffixes. Specifically, we vary the fraction of trap suffixes known and blacklisted by the attacker from 20% to 100%. To improve experimental efficiency, we evaluate this setting on a subset of 25 harmful prompts randomly sampled from JailbreakBench. Table 8 reports the ASR and two auxiliary statistics under different levels of attacker knowledge. With- Traps denotes the fraction of attack instances whose optimized suffixes still contain at least one trap suffix, while Traceability score reports the average proportion of trap suffixes within each optimized suffix. Across all settings, the ASR remains 8 Qwen-2.5-7BLLaMA-3-8BVicuna-13B 50 0 50 100 FPR ↑ ASR ↓ 39% 67% 51% 100%100% 96% 61% 29% 49% 0%0% 4% FPRASRTrapSuffix Figure 2: FPR (↑) and ASR (↓) across three target models, comparing no defense and TrapSuffix. zero, indicating that the effectiveness of TrapSuffix does not rely on the attacker explicitly using trap suffixes. We attribute this behavior to the rugged optimization landscape induced by TrapSuffix, where deceptive local minima impede adversarial convergence. This interpretation is further supported by the analysis in the following section (Fig. 3). Moreover, except when the attacker has full knowledge of all trap suffixes, a non-negligible fraction of optimized suffixes continues to ex- hibit non-zero traceability score, suggesting that adversarial optimization is naturally drawn toward trap-aligned regions even under partial avoidance constraints. Adaptive Optimization Budget. We consider an adaptive attacker that increases the optimization budget, motivated by the hypothesis that the defense operates by introducing de- ceptive local minima that slow down adversarial convergence. Specifically, we consider an adaptive attacker with full knowl- edge of the trap suffixes and increase the attack optimization budget from the default setting to 1,000, 2,000, and 4,000 iter- ations. To analyze how increased optimization budgets affect the adversarial search behavior, we visualize the optimization trajectories of adversarial suffixes in the embedding space. We project multiple optimization runs into a shared PCA space and overlay a representative trajectory on the interpolated loss landscape. As shown in Figure 3, increasing the optimization budget does not lead to smooth or monotonic progress toward lower-loss regions. Instead, the optimization trajectory repeat- edly traverses a rugged loss surface characterized by irregular contours and frequent changes in direction. Quantitatively, while increasing the optimization budget slightly reduces the average adversarial loss, the reduction is limited and does not translate into successful jailbreaks. As summarized in Table 11, the attack success rate remains0%across all eval- uated budgets, indicating that additional optimization steps primarily increase search cost rather than attack effectiveness. Table 3: Adaptive attack results under trap-suffix knowledge. Trap Knowledge ASR WithTraps Traceability Score 20%0.0064.0%3.83% 40%0.0056.0%3.39% 60%0.0029.0%1.65% 80%0.0025.0%1.25% 100%0.000.0%0.00% 5.4RQ3: Adversarial Optimization Dynamics This subsection examines how the TrapSuffix defense re- shapes the optimization dynamics of suffix-based jailbreak attacks during iterative adversarial suffix search. In particular, the analysis focuses on the evolution of traceability scores and adversarial loss throughout the optimization process. Distribution of Traceability score. Figure 4 illustrates the distribution of traceability scoreΦ(Q⋄S)at different stages of GCG optimization for three language models. Qwen-2.5- 7B exhibits an earlier and more pronounced concentration in the upper tail. Even at step 10, a substantial fraction of samples already clusters around a traceability score of ap- proximately 0.05. A similar but more moderate pattern is ob- served for LLaMA-3-8B. While the overall traceability score exhibits limited variation across optimization steps, it remains consistently above 0.02 throughout the optimization process, indicating persistent interaction with trap-aligned regions. This stability suggests that the proposed defense effectively constrains adversarial optimization on LLaMA-3-8B, rather than allowing attackers to progressively escape through addi- tional iterations. Among the evaluated models, Vicuna-13B exhibits noticeably smaller traceability score. This discrep- ancy is primarily attributed to tokenizer differences rather than substantive behavioral divergence. The tokenizer of Vicuna- 13B tends to segment trap suffixes into fewer or mismatched subword units, leading to a systematic underestimation of trap suffix counts under a token-level measurement scheme. Nevertheless, once the traceability score exceeds the tracing threshold, adversarial suffixes remain reliably traceable. Adversarial Loss Dynamics. To further understand how the proposed defense affects the optimization behavior of suffix- based jailbreak attacks, we analyze adversarial loss trajecto- ries during iterative attack optimization. The analysis focuses on gradient-based GCG and Probe attacks, as their optimiza- tion procedures yield well-defined and stable adversarial loss values at each iteration. To ensure comparability across mod- els and attack settings, adversarial losses are normalized by their initial values. As shown in Figure 5, across all three models and both attack types, TrapSuffix consistently results in lower adversarial loss trajectories compared to the unde- fended baseline. This observation indicates that the defense effectively interferes with the attacker’s optimization process, making it more difficult for the attack to converge. Notably, 9 −0.6−0.4−0.20.00.20.4 PC1 −0.2 0.0 0.2 0.4 PC2 1000 Steps Start End −0.75−0.50−0.250.000.250.50 PC1 −0.4 −0.2 0.0 0.2 0.4 0.6 PC2 2000 Steps −0.75−0.50−0.250.000.250.50 PC1 −0.4 −0.2 0.0 0.2 0.4 PC2 4000 Steps 1.0 1.2 1.4 1.6 1.8 2.0 2.2 2.4 Loss 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 Loss 0.6 0.8 1.0 1.2 1.4 1.6 Loss Figure 3: Optimization trajectories of adversarial suffixes under adaptive optimization budgets, visualized in a shared PCA space with an interpolated loss landscape. 10210410 Optimization Step 0.00 0.05 0.10 0.15 Trap Suffix Ratio (a) Qwen-2.5-7B 10210410 Optimization Step (b) LLaMA-3-8B 10210410 Optimization Step (c) Vicuna-13B Figure 4: Distribution of traceability scores across GCG opti- mization steps for three models. Each violin plot shows the density distribution of traceability scores at different optimiza- tion steps (10, 210, 410). Red lines indicate mean values. on LLaMA-3-8B, TrapSuffix exhibits a rapid decrease in ad- versarial loss during the early optimization stages, followed by a slowdown and stabilization as the number of iterations increases. This pattern provides evidence for the effectiveness of the proposed deceptive local minima mechanism: while the adversarial loss decreases rapidly in the early stages of optimization, the increasingly rugged loss landscape hinders further convergence. Overall, these results indicate that Trap- Suffix reshapes the model’s response landscape to adversarial suffixes in a strategy-agnostic manner. 5.5 RQ4: Adversarial Suffix Transferability Adversarial suffixes are typically optimized against a specific source model. However, recent studies seek to enhance their transferability, enabling the same suffix to be reused to attack other models, including closed-source or differently aligned systems [50]. This raises the following research questions: RQ4.1: How transferable are adversarial suffixes between base and LoRA-adapted models within the same architecture? To answer this question, Figure 6 summarizes adversarial suffix transferability under the Transfer attack setting across three model families, with ASR encoded on a red–blue scale (red higher, blue lower). Across all three model families, ad- versarial suffixes optimized on base models exhibit high ASR when evaluated on the corresponding base models, confirm- ing the effectiveness of the Transfer attack. However, when adversarial suffixes optimized on the base models are ap- plied to the corresponding LoRA-adapted variants, the ASR consistently drops to zero. This indicates that LoRA adap- tation fundamentally reshapes the adversarial optimization landscape, rendering suffixes optimized on the base model in- effective even under strong transfer-based attacks. Conversely, suffixes optimized on LoRA-adapted models may retain lim- ited effectiveness when evaluated on the base model for some architectures, but they consistently fail on the LoRA-adapted model itself, suggesting that such suffixes do not correspond to stable adversarial optima in the LoRA-modified model space. Overall, these results demonstrate that adversarial suf- fixes exhibit near-zero bidirectional transferability between base and LoRA-adapted models within the same architecture. RQ4.2: How transferable are adversarial suffixes optimized on open-source models across target models with different architectures, including closed-source LLMs? To answer this question, we evaluate adversarial suffixes optimized on three representative open-source models under the Transfer attack setting against a diverse set of target mod- els. The target models include both open-source LLMs with heterogeneous architectures and closed-source models with proprietary alignment strategies. Table 4 summarizes ASR and traceability under cross-model transfer. Among all source models, adversarial suffixes optimized on LLaMA-3-8B ex- hibit the strongest transferability to different architecture mod- els. When TrapSuffix is enabled, transfer attacks targeting LLaMA-3-8B are effectively suppressed, with average ASR reductions of 12.75% against open-source targets and 4.33% against closed-source targets. By contrast, Transfer attacks targeting Qwen-2.5-7B and Vicuna-13B do not demonstrate 10 0200400 Optimization Step 0.0 0.5 1.0 Normalized Loss (a) Qwen-2.5-7B GCG 0200400 Optimization Step (b) Qwen-2.5-7B Probe 0200400 Optimization Step (c) LLaMA-3-8B GCG 0200400 Optimization Step (d) LLaMA-3-8B Probe 0200400 Optimization Step (e) Vicuna-13B GCG 0200400 Optimization Step (f) Vicuna-13B Probe UndefendedTrapSuffix Figure 5: TrapSuffix Defended models consistently reshape gradient-based optimization behaviors across attack settings. BaseLoRA Target Model Base LoRA Source Model 89.00.0 34.00.0 Qwen2.5-7B BaseLoRA Target Model Base LoRA 38.00.0 2.00.0 LLaMA-3-8B BaseLoRA Target Model Base LoRA 81.00.0 41.00.0 Vicuna-13B 020406080100 ASR (%) Figure 6: Heatmap of adversarial suffix transferability be- tween base and TrapSuffix models. consistent ASR reductions. However, the transferred suffixes in these cases consistently contain trap-induced, traceable fingerprints. This indicates that even when attack success persists, the resulting suffixes remain attributable and fail to bypass the traceability mechanism. 5.6 RQ5: Utility Preservation This subsection evaluates whether TrapSuffix preserves the general instruction-following and reasoning capabilities of the base models after fine-tuning. We assess utility on four widely used benchmarks, including ARC-Challenge [10], Hel- laSwag [53], and MMLU [14, 15], which together cover rea- soning, commonsense understanding, and broad knowledge. As shown in Table 5, applying TrapSuffix in only marginal changes in accuracy across all evaluated models, indicating that the overall performance distribution remains largely pre- served. Beyond maintaining utility, TrapSuffix is implemented through lightweight LoRA-based fine-tuning, which enables plug-and-play deployment without modifying the base model, with minimal integration effort required. This design provides additional flexibility: when transferred to downstream tasks, the TrapSuffix modules can be jointly fine-tuned with task- specific datasets, allowing the defense to adapt to task dis- tributions and achieve even better utility–defense trade-offs. 5.7 Ablation Study Table 6 presents a leave one out ablation of the four loss com- ponents in TrapSuffix. Each model is evaluated using GCG on 25 harmful prompts after training, and WithTraps denotes Table 4: Transfer attack results across different target models. Target ModelAttack Success Rate (ASR) Qwen-2.5-7BLLaMA-3-8BVicuna-13B Base LoRABase LoRABase LoRA Open-source Target Models LLaMA-2-7b-Chat6.002.0010.007.0010.00 6.00 Gemma-7b-It6.001.0010.008.004.008.00 Qwen2-14B-Instruct 3.004.0016.006.002.002.00 Yi-1.5-9B-Chat25.00 51.0047.00 11.0048.00 15.00 Avg. 10.00 14.5020.758.0016.00 7.75 Traceable× ✓× ✓ Closed-source Target Models Gemini-2.0-Flash22.00 21.0020.00 19.001.002.00 GPT-3.5-Turbo5.005.0014.008.002.005.00 GPT-4.1-Mini4.005.0011.005.003.004.00 Avg.10.33 10.3315.00 10.672.003.67 Traceable× ✓× ✓ the fraction of optimized adversarial suffixes containing trap suffixes. Across all ablated variants, removing any single loss term does not increase the ASR, which remains at 0.0%. This indicates that jailbreak suppression is not driven by a sin- gle component but is jointly enforced by multiple loss terms that reshape the suffix optimization space and make effective jailbreaks difficult to obtain. Figure 11 further shows that each loss term indirectly increases the adversarial loss during optimization, offering additional intuition rather than a pri- mary design objective. In contrast, the traceability behavior is highly sensitive to the loss design. In particular, the full Trap- Suffix objective achieves a WithTraps rate of 24.0%, markedly higher than all ablated variants, indicating that stable traceabil- ity only emerges when all four loss terms are jointly enforced. Under single-term ablation, removingL 1 orL 4 reduces the tracing rate to 0.0%, highlighting their essential role in in- ducing identifiable suffix patterns. In contrast, removingL 2 orL 3 retains only marginal traceability (4.0%), suggesting that these terms primarily affect optimization dynamics rather than directly defining trap patterns. Pairwise ablation further 11 Table 5: Benchmark accuracy (%) before and after TrapSuffix. ModelVariantARC-CHellaSwag MMLU Qwen-2.5-7B Base82.659.871.76 TrapSuffix78.459.070.22 LLaMA-3-8B Base70.058.064.72 TrapSuffix76.258.364.02 Vicuna-13B Base8.860.454.55 TrapSuffix26.257.950.37 confirms this coordinated dependency. WhenL 1 andL 4 are removed together, traceability disappears entirely, while other combinations yield only weak signals (8.0–12.0%), far below the full configuration (24.0%) observed under the complete objective. Overall, these results indicate that while jailbreak suppression remains robust to partial loss removal, traceabil- ity is an emergent property that relies on the joint action of multiple loss components rather than any single objective. 6 Related Works 6.1 Jailbreak Attacks on LLMs Suffix-based jailbreak attacks were pioneered by the Greedy Coordinate Gradient (GCG) [58] algorithm, which employs a greedy gradient-based discrete optimization strategy to search for adversarial suffixes that maximize the probability of harm- ful behavior. Building upon this framework, several enhanced variants have emerged, including Probe sampling [57],I- GCG [21], AmpleGCG [23], and PAL [39]. Among them, Probe sampling [57] andI-GCG [21] can be viewed as an extension of GCG, as it introduces more diverse target tem- plates and employ different multi-coordinate update strategies to accelerate convergence and improve attack performance. Another improvement, AmpleGCG [23] leverages adversarial suffixes to train a suffix generative model, capturing the un- derlying distribution of effective adversarial suffixes. These methods operate in a white-box setting, where the attacker has full access to model parameters and gradients. To re- lax this assumption, PAL [39] adapts GCG to a black-box scenario by leveraging a surrogate model for gradient-free optimization. Beyond gradient-based variants, several gray- box methods have been developed, where attackers can query log-probabilities through model APIs, which provides a more realistic setting in practice. AutoDAN [26] employs a genetic algorithm guided by log-probability feedback to craft highly transferable and stealthy jailbreaks, while JSAA [1] uses sim- ulated annealing to identify harmful prompts. Moving from heuristic search to learning-based formulation, RLbreaker [7] treats jailbreak generation as a reinforcement learning prob- lem, optimizing a policy to maximize a reward signal based on harmfulness. AdvPrompter [32] follows a similar idea, us- Table 6: Ablation study of TrapSuffix loss components. Config.L 1 L 2 L 3 L 4 ASR (%)↓ WithTrap (%)↑ No Defense–16.00.0 TrapSuffix ✓ ✓ ✓ ✓0.024.0 w/o L 1 – ✓ ✓ ✓0.00.0 w/o L 2 ✓– ✓ ✓0.04.0 w/o L 3 ✓ ✓– ✓0.04.0 w/o L 4 ✓ ✓ ✓–0.00.0 w/oL 1 ,L 2 – ✓ ✓0.012.0 w/oL 1 ,L 3 – ✓– ✓0.08.0 w/oL 1 ,L 4 – ✓ ✓–0.00.0 w/oL 2 ,L 3 ✓– ✓0.012.0 w/oL 2 ,L 4 ✓– ✓–0.012.0 w/oL 3 ,L 4 ✓ ✓–0.08.0 ing log-probability feedback to iteratively train an adversarial suffix generator. Although most of these methods focus on im- proving attack accuracy and convergence efficiency, Transfer Attack [50] emphasizes the transferability of suffix-based jail- breaks. By removing superfluous optimization constraints, it enhances both attack generalization and effectiveness, further amplifying the extensibility and threat of these techniques. Other jailbreak attack attacks encompass a range of strate- gies beyond suffix-based methods [45]. Manual and template- based attacks, such as the Do-Anything-Now (DAN) [43] series and JailbreakHub [37], rely on human-crafted prompts to elicit unsafe behavior from aligned models. While such methods are intuitive, they lack scalability and reproducibility. Generation-based methods, including PAIR [6], TAP [28], and their enhanced variants, employ auxiliary LLMs to au- tomatically produce and refine adversarial prompts based on feedback from the target model. Although these approaches reduce human effort, they rely on indirect semantic feedback rather than explicit optimization signals, resulting in unsta- ble convergence and poor reproducibility. Implicit jailbreaks conceal malicious intent through encoding or obfuscation techniques to evade safety filters, including DrAttack [22], Puzzler [4], and cross-lingual attacks such as Zulu [51], but their effectiveness rapidly declines once safety mechanisms are updated. Multi-turn jailbreaks, such as ActorAttack [34] and X-Teaming [33], exploit adaptive conversational dynam- ics to gradually weaken a model’s refusal behavior across successive interactions, yet they are often time-consuming and inconsistent across different sessions or models. Suffix-based jailbreaks allow attackers to adaptively re- fine adversarial suffixes under minimal constraints and at low cost, and they exhibit strong transferability in practice. Ac- cordingly, this work focuses on suffix-based jailbreaks as the primary target of our proposed proactive TrapSuffix defense. 12 6.2 Defenses Against Jailbreaks Inference-stage guardrails aims to intervene during infer- ence to detect the input, output, or internal representations, thereby reducing the likelihood of unsafe generations. Early methods primarily rely on prompt toxicity classifiers or rule- based detectors to block unsafe content. Representative ap- proaches include perplexity-based filter [19], which relies on an external classifier to flag prompts whose perplexity ex- ceeds a predefined threshold. SelfDefend [46] enables models to self-detect and self-refuse harmful outputs within the infer- ence loop. In industry, Meta has released Prompt Guard [36] and Llama Guard [18] which focuses on detecting unsafe inputs and policy-violating behaviors. GuardReasoner [27] in- troduces a reasoning safeguard model that conducts safety de- tection. Beyond input/output filtering, GradSafe [48] focuses on recognizing malicious queries by identifying activation- gradient patterns. Gradient Cuff [17] involves in estimating the gradient norm of the refusal loss. In-Context Demonstra- tions (ICD) [47] and Prompt Adversarial Tuning (PAT) [29] introduce prompt-level defenses by augmenting the input with refusal exemplars or defensive suffixes to mitigate jail- break attacks. Other approaches intervene at the decoding or representation level to promote safer generation, includ- ing safety-aware decoding strategies [49] and layer-specific activation editing [56]. SmoothLLM [35] applies character- level perturbations to prompts and aggregates responses to enhance jailbreak resilience. JBShield [55] mitigates unsafe behaviors by identifying and manipulating concept subspaces in the model’s hidden representations. A key limitation of inference-stage guardrails is the additional latency and mem- ory overhead they introduce, as they often rely on auxiliary LLMs or safety classifiers to intervene during generation. Training-stage alignment aims to align an LLM’s inter- nal behavior with human values and expectations by en- hancing its intrinsic safety during training. This is typically achieved through high-quality instruction-tuning datasets such as BeaverTails [20] and Anthropic H-RLHF [2], which incorporate human-in-the-loop supervision or curated refusal examples. Representative approaches include supervised fine- tuning (SFT) [44], reinforcement learning from human feed- back (RLHF) [31], and adversarial training [25]. Model Pre- vention is widely deployed because it strengthens safety at the source. However, such approaches require substantial data collection and annotation effort and remain insufficient to cover the full spectrum of jailbreak attempts, particularly un- der unforeseen and open-ended attack strategies. 7 Limitations Attack Specific. Our defense is designed for a class of canon- ical suffix-based jailbreak attacks that rely on iterative suffix search and explicit attack objectives. Attacks that do not in- volve iterative optimization, or that operate purely at the se- mantic prompt level, fall outside the scope of this work. While TrapSuffix targets the optimization dynamics of suffix-based attacks, extending the defense to fundamentally different at- tack paradigms would require corresponding adaptations of the overall design. Model Dependency. Our defense method requires access to the model’s internal parameters and modifies the model through parameter-efficient adaptation. This design intro- duces an offline training stage whose computational cost in- creases with model scale. As a result, applying the method to very large language models may incur non-trivial training overhead and requires suitable GPU resources. This depen- dency is inherent to defenses that rely on parameter adaptation rather than purely inference-time mechanisms. 8 Conclusion and Future Works In this paper, we propose TrapSuffix, a proactive defense method against suffix-based jailbreak attacks that fundamen- tally reshapes the adversarial optimization landscape. By em- bedding trap-aligned structures into the model, TrapSuffix ensures that jailbreak attempts no longer come for free: ad- versarial optimization is either diverted toward harmless local minima or forced to produce suffixes that carry distinctive and traceable fingerprints. Extensive experiments across multiple models and a diverse set of attack strategies demonstrate that TrapSuffix effectively suppresses jailbreak success, reducing the average attack success rate to below 0.01% and achiev- ing an average tracing success rate of 87.9%, while remain- ing robust under adaptive adversaries with full knowledge of the trap suffixes. Importantly, TrapSuffix introduces no inference-time overhead and incurs only negligible memory cost, requiring orders of magnitude less additional resources than LLM-based detection defenses. Utility evaluations on standard benchmarks further confirm that the proposed de- fense preserves overall model performance. Beyond its effec- tiveness, TrapSuffix is modular and plug-and-play, allowing integration with existing alignment and filtering pipelines for complementary protection. We believe this work highlights a promising direction for jailbreak defense: moving from reactive detection toward proactive defense of adversarial optimization dynamics. There are several promising directions for future work. One direction is to extend traceability beyond attributing successful jailbreak attacks, and further identify the source models or optimization pipelines from which adversarial suf- fixes originate. Such provenance-aware tracing would enable finer-grained attribution of attack generation processes across models. Another direction is to move beyond trap-inducing suffixes and explore different forms of TrapSuffix signals that operate at varying stages of the model’s generation or optimization process. Finally, extending the TrapSuffix de- fense paradigm to broader classes of attacks and deployment settings remains an important avenue for future investigation. 13 Ethical Considerations This work proposes a TrapSuffix defense against jailbreak at- tacks on large language models, with the objective of reducing misuse and improving deployment safety. The defense proac- tively steers adversarial optimization toward safe or traceable outcomes, discouraging successful jailbreaks rather than en- abling harmful behaviors or expanding attack capabilities. All jailbreak attacks studied in this work are evaluated solely for defensive and analytical purposes in a controlled research environment. We do not release generated harmful content, deploy attack pipelines in real-world systems, or provide new tools that would lower the barrier to misuse beyond exist- ing public knowledge. Our experiments rely exclusively on publicly available models, benchmarks, and attack methods, and do not involve human subjects or personally identifiable information. This study does not require Institutional Review Board (IRB) approval, as it relies solely on publicly available models, data, and methods, and does not involve human or animal subjects. Throughout the study, experimental proto- cols are designed to align with ethical standards in AI security research, emphasizing harm reduction, transparency, and re- sponsible disclosure. Given the evolving nature of jailbreak strategies, continued refinement of defensive mechanisms re- mains necessary to ensure the safe and ethical use of large language models in real-world deployments. 14 Open Science In compliance with the Open Science policy, we will release the artifacts necessary to support the reproducibility of our work. These artifacts will be made available to the research community and accessible for review during the artifact eval- uation process. Specifically, we will provide the implemen- tation of the proposed TrapSuffix defense, and the scripts required to reproduce the reported experimental results across multiple target language models. 15 References [1]Maksym Andriushchenko, Francesco Croce, and Nico- las Flammarion. Jailbreaking leading safety-aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151, 2024. [2]Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforce- ment learning from human feedback. arXiv preprint arXiv:2204.05862, 2022. [3]Y Cao. A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt. arXiv preprint arXiv:2303.04226, 111, 2023. [4] Zhiyuan Chang, Mingyang Li, Yi Liu, Junjie Wang, Qing Wang, and Yang Liu. Play guessing game with llm: Indirect jailbreak attack with implicit clues. arXiv preprint arXiv:2402.09091, 2024. [5] Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Se- hwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. Jailbreakbench: An open robustness benchmark for jail- breaking large language models. In NeurIPS Datasets and Benchmarks Track, 2024. [6] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jail- breaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trust- worthy Machine Learning (SaTML), pages 23–42. IEEE, 2025. [7] Xuan Chen, Yuzhou Nie, Wenbo Guo, and Xiangyu Zhang. When llm meets drl: Advancing jailbreaking efficiency via drl-guided search. Advances in Neural In- formation Processing Systems, 37:26814–26845, 2024. [8]Wei-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna. lmsys. org (accessed 14 April 2023), 2(3):6, 2023. [9]Junjie Chu, Yugeng Liu, Ziqing Yang, Xinyue Shen, Michael Backes, and Yang Zhang. Jailbreakradar: Com- prehensive assessment of jailbreak attacks against llms. In Proceedings of the 63rd Annual Meeting of the Asso- ciation for Computational Linguistics (Volume 1: Long Papers), pages 21538–21566, 2025. [10]Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv:1803.05457v1, 2018. [11] Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. Free dolly: Introducing the world’s first truly open instructiontuned llm. 2023. [12]Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in Neural Information Processing Systems, 37:8093–8131, 2024. [13] Jingxuan He and Martin Vechev. Large language models for code: Security hardening and adversarial testing. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1865– 1879, 2023. [14]Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. Aligning ai with shared human values. Proceedings of the International Conference on Learning Represen- tations (ICLR), 2021. [15]Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. Proceedings of the International Conference on Learn- ing Representations (ICLR), 2021. [16]Peiwei Hu, Ruigang Liang, and Kai Chen. Degpt: Op- timizing decompiler output with llm. In Proceedings 2024 Network and Distributed System Security Sympo- sium, volume 267622140, 2024. [17] Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. Gradi- ent cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes. Advances in Neural Information Processing Systems, 37:126265– 126296, 2024. [18]Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. [19] Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks 16 against aligned language models. arXiv preprint arXiv:2309.00614, 2023. [20] Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards im- proved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems, 36:24678–24704, 2023. [21] Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. Improved techniques for optimization-based jailbreak- ing on large language models. arXiv preprint arXiv:2405.21018, 2024. [22] Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers. arXiv preprint arXiv:2402.16914, 2024. [23] Zeyi Liao and Huan Sun. Amplegcg: Learning a univer- sal and transferable generative model of adversarial suf- fixes for jailbreaking both open and closed llms. arXiv preprint arXiv:2404.07921, 2024. [24]Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 techni- cal report. arXiv preprint arXiv:2412.19437, 2024. [25]Fan Liu, Zhao Xu, and Hao Liu. Adversarial tuning: De- fending against jailbreak attacks for llms. arXiv preprint arXiv:2406.06622, 2024. [26]Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023. [27]Yue Liu, Hongcheng Gao, Shengfang Zhai, Jun Xia, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. Guardreasoner: To- wards reasoning-based llm safeguards. arXiv preprint arXiv:2501.18492, 2025. [28]Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems, 37:61065–61105, 2024. [29] Yichuan Mo, Yuji Wang, Zeming Wei, and Yisen Wang. Fight back against jailbreaking via prompt adversarial tuning. Advances in Neural Information Processing Systems, 37:64242–64272, 2024. [30] OpenAI. Chatgpt, 2023. Large Language Model. [31]Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information pro- cessing systems, 35:27730–27744, 2022. [32]Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. Advprompter: Fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873, 2024. [33]Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. X- teaming: Multi-turn jailbreaks and defenses with adap- tive multi-agents. arXiv preprint arXiv:2504.13203, 2025. [34]Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. Derail yourself: Multi-turn llm jailbreak attack through self-discovered clues. arXiv preprint, 2024. [35]Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684, 2023. [36]Daniel Schwartz, Dmitriy Bespalov, Daisy Zhe Wang, Ninad Kulkarni, and Yanjun Qi. Graph of attacks with pruning: Optimizing stealthy jailbreak prompt genera- tion for enhanced llm content moderation. In Proceed- ings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track, pages 659–671, 2025. [37]Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685, 2024. [38]Karan Singhal, Tao Tu, Juraj Gottweis, Rory Sayres, Ellery Wulczyn, Mohamed Amin, Le Hou, Kevin Clark, Stephen R Pfohl, Heather Cole-Lewis, et al. Toward expert-level medical question answering with large lan- guage models. Nature Medicine, 31(3):943–950, 2025. [39] Chawin Sitawarin, Norman Mu, David Wagner, and Alexandre Araujo.Pal: Proxy-guided black-box attack on large language models. arXiv preprint arXiv:2402.09674, 2024. 17 [40]Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean- Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalk- wyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023. [41] Qwen Team et al. Qwen2 technical report. arXiv preprint arXiv:2407.10671, 2(3), 2024. [42]Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Bap- tiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. [43]walkerspider.DANismynewfriend. https://old.reddit.com/r/ChatGPT/comments/ zlcyr9/dan_is_my_new_friend/, 2022. Accessed: 2023-09-28. [44] Jiongxiao Wang, Jiazhao Li, Yiquan Li, Xiangyu Qi, Junjie Hu, Sharon Li, Patrick McDaniel, Muhao Chen, Bo Li, and Chaowei Xiao. Backdooralign: Mitigat- ing fine-tuning based jailbreak attack with backdoor enhanced safety alignment. Advances in Neural Infor- mation Processing Systems, 37:5210–5243, 2024. [45]Xunguang Wang, Zhenlan Ji, Wenxuan Wang, Zongjie Li, Daoyuan Wu, and Shuai Wang. Sok: Evaluating jailbreak guardrails for large language models. In IEEE Symposium on Security and Privacy (SP), 2026. [46]Xunguang Wang, Daoyuan Wu, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Shuai Wang, Yingjiu Li, Yang Liu, Ning Liu, and Juergen Rahmel.SelfDefend:LLMscan defend themselves against jailbreaking in a practical manner. In 34th USENIX Security Symposium (USENIX Security 25), pages 2441–2460, 2025. [47]Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387, 2023. [48] Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Gong. Gradsafe: detecting unsafe prompts for llms via safety- critical gradient analysis. In Proc. 62nd Annual Meeting of the Association for Computational Linguistics (Long Papers), 2024. [49]Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983, 2024. [50]Junxiao Yang, Zhexin Zhang, Shiyao Cui, Hongning Wang, and Minlie Huang. Guiding not forcing: Enhanc- ing the transferability of jailbreaking attacks on llms via removing superfluous constraints. arXiv preprint arXiv:2503.01865, 2025. [51]Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. Low-resource languages jailbreak gpt-4. arXiv preprint arXiv:2310.02446, 2023. [52] Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. Don’t listen to me: Understanding and exploring jailbreak prompts of large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4675–4692, 2024. [53] Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi.Hellaswag: Can a ma- chine really finish your sentence? arXiv preprint arXiv:1905.07830, 2019. [54]Lan Zhang, Xinben Gao, Liuyi Yao, Jinke Song, and Yaliang Li. ExploitingTask-Levelvulnerabilities: An automatic jailbreak attack and defense benchmarking forLLMs. In 34th USENIX Security Symposium (USENIX Security 25), pages 2363–2382, 2025. [55] Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. Jbshield: Defending large language models from jailbreak attacks through acti- vated concept analysis and manipulation. arXiv preprint arXiv:2502.07557, 2025. [56]Wei Zhao, Zhe Li, Yige Li, Ye Zhang, and Jun Sun. Defending large language models against jailbreak attacks via layer-specific editing. arXiv preprint arXiv:2405.18166, 2024. [57]Yiran Zhao, Wenyue Zheng, Tianle Cai, Xuan Long, Kenji Kawaguchi, Anirudh Goyal, and Michael Q Shieh. Accelerating greedy coordinate gradient and general prompt optimization via probe sampling. Advances in Neural Information Processing Systems, 37:53710– 53731, 2024. [58]Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and trans- ferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. A Code and Reproducibility All code and experiments are released at an anonymized repos- itory 4 . The repository includes scripts for TrapSuffix training, evaluation against five attack methods, and comparisons with eight baseline defenses using the SoK4JailbreakGuardrails 4 https://anonymous.4open.science/r/TrapSuffix-6161 18 benchmark. Pre-trained LoRA adapters for Qwen-2.5-7B, Llama-3-8B, and Vicuna-13B are also provided. Environment. All experiments are conducted on a work- station equipped with 4 NVIDIA A40 GPUs (46 GB VRAM each). All models are implemented using PyTorch 2.8.0 and HuggingFace Transformers 4.27.1. B Metric Formulation Attack Success Rate (ASR). This metric measures the frac- tion of adversarial attempts that successfully induce harmful or policy-violating responses from the target model. In this paper, an attack attempt is successful if it induces a jailbreak and is not traceable: J (Q⋄S,R) = 1 ∧ Φ(Q⋄S)≤ α,(17) whereQdenotes the harmful query,Sthe adversarial suffix, andRthe model response to the combined inputQ⋄ S. We define an indicator functionJ (Q⋄S,R)∈0, 1, whereJ = 1indicates a successful jailbreak. Accordingly, the attack success rate (ASR) is defined as ASR = 1 N N ∑ i=1 I[J (Q i ⋄S i ,R i ) = 1 ∧ Φ(Q i ⋄S i )≤ α]. (18) Tracing Success Rate (TSR). This metric measures the frac- tion of jailbreak attempts whose adversarial suffixes are iden- tifiable via trap-induced fingerprints, i.e., those with a trace- ability score exceeding a predefined threshold. Formally, TSR is defined as TSR = ∑ N i=1 I[J (Q i ⋄S i ,R i ) = 1 ∧ Φ(Q i ⋄S i )> α] ∑ N i=1 I[J (Q i ⋄S i ,R i ) = 1] . (19) False Positive Rate (FPR). This metric measures the fraction of attack attempts that are deemed successful by the attack algorithm and cause early termination of optimization, but do not result in an actual jailbreak. Let ˆ J (Q⋄ S)∈0, 1 denote the attacker’s internal success indicator (e.g., based on a non-refusal criterion). Formally, FPR is defined as FPR = ∑ N i=1 I ˆ J (Q i ⋄S i ) = 1 ∧ J (Q i ⋄S i ,R i ) = 0 ∑ N i=1 I ˆ J (Q i ⋄S i ) = 1 . (20) In addition to ASR, TSR, and FPR, we report several aux- iliary statistics to characterize the behavior of trap-aligned suffixes, including the number of traced jailbreaks (#Traced), the number of jailbreak attempts withJ = 1, regardless of traceability (#Jailbreaks), the proportion of adversarial suf- fixes containing trap suffixes (WithTraps), and the average fraction of trap suffixes per suffix (Traceability score). SymbolDescription QHarmful question Q drawn from the set Q. SAdversarial suffix optimized by a jailbreak attack. PJailbreak prompt formed by concatenatingQand S (i.e., P = Q⋄S). RModel response generated for jailbreak prompt. J Ground-truth jailbreak indicator, whereJ (Q⋄ S,R) = 1 denotes a successful jailbreak. ˆ J Jailbreak indicator used by the attacker to termi- nate optimization under non-refusal criteria. T trap Set of trap suffixes. kNumber of trap suffixes in T trap . ΦTraceability scoring function. αTraceability threshold. γ Margin parameter controlling relative loss sepa- ration. δ Margin parameters controlling relative gradient separation. τMargin parameters controlling semantic termina- tion loss. l safe Reference safety level. M θ Aligned LLM M θ model parameterized by θ ASRAttack Success Rate (see Eq. 18). TSRTracing Success Rate (see Eq. 19). FPRFalse Positive Rate (see Eq. 20). Table 7: Summary of symbols and notations used throughout the paper. C Additional Method Details C.1 Notation Summary Table 7 provides a summary of the notations used in this paper. C.2 Attack Configurations We evaluate TrapSuffix against a diverse set of suffix-based jailbreak attacks, including GCG, AutoDAN, Probe, Transfer, and JSAA. •GCG. The GCG attack is conducted with 500 optimization iterations, a search width of 64, and top-ksampling with k = 64. • AutoDAN. We use the AutoDAN-HGA variant with 100 optimization steps, a batch size of 256, and an elite ratio of 0.05. The crossover rate is set to 0.5, with 5 mutation points per iteration and a mutation rate of 0.01. • Probe. The Probe attack follows the same configuration as GCG, with an embedding rank ofr = 64and a sampling fac- tor of 16. It additionally usesGPT-2as an auxiliary scoring model to guide suffix selection during optimization. 19 •Transfer. Since the original Transfer attack implementation does not support Qwen-series models, we extend the attack code to enable transfer attacks on Qwen-based targets. Im- plementation details are provided in the anonymized repos- itory. To ensure stable attack performance, we increase the number of training prompts to n train = 50. • JSAA. JSAA is configured with a maximum of 500 attack tokens, up to 5 attack attempts, and 5 optimization iterations. The adversarial suffix length is set to 100, with a bounded change per iteration. The judge model isgpt-4-0613, with a maximum response length of 10 tokens. C.3 Hyperparameter Design and Selection TrapSuffix involves several hyperparameters controlling the number of trap suffixes, the relative weighting of loss terms, and the thresholds used for safety and traceability. Rather than exhaustively tuning these parameters, we adopt a small set of fixed values guided by stability and robustness considerations, and use the same configuration across all evaluated models and attack settings. Specifically, the number of trap suffixes is set tok = 100. The weighting parameterγis set to 0.42, and the safety ref- erence level is fixed atl safe = 2.0. The margin parameters are set toδ = 0.19andτ = 0.95, respectively, and the trace- ability threshold is set toα = 0. To examine the sensitivity of TrapSuffix to the size of the trap suffix set, we further evaluate the attack behavior under different numbers of trap suffixes while keeping all other hyperparameters fixed. Ta- ble 8 reports the ASR, the fraction of optimized adversarial suffixes containing trap patterns (WithTraps), and the average optimization loss under adaptive GCG attacks. From the re- sults, the ASR remains at 0.0% across all evaluated settings, confirming that the overall effectiveness of TrapSuffix in sup- pressing jailbreak attacks is robust to the choice of the trap suffix set size. This indicates that the defense performance of TrapSuffix does not rely on a particular hyperparameter configuration. By contrast, the fraction of traceable adversar- ial suffixes varies across different values ofk, suggesting that traceability is more sensitive to hyperparameter choices than jailbreak suppression. This behavior is expected, as trace- ability is an auxiliary property induced by the trap design rather than a prerequisite for defense effectiveness. Within the evaluated range, a moderate trap set size achieves a higher likelihood of producing traceable suffixes, while the defense itself remains consistently effective. C.4 Optimization Pseudocode Algorithm 1 summarizes the TrapSuffix optimization proce- dure, which jointly optimizes utility preservation and trap- induced adversarial objectives. At each training step, the model is updated using either a benign utility batch or a harm- ful query paired with a randomly sampled trap suffixS ′ . This Table 8: Effect of the number of trap suffixes on attack behav- ior under adaptive optimization. #Trap Suffixes ASR (%)↓ WithTraps (%)↑ Avg. Loss 500.0012.01.37 1000.0024.00.72 4000.004.01.04 Algorithm 1 TrapSuffix Optimization Algorithm 1:Notations: protected language modelM θ ; harmful ques- tion set Q; utility instruction–response setD; trap suffix set T trap . 2: for training step t = 1, 2,...,T do 3:Alternately sample a mini-batch from Q or D . 4:Sample a trap suffix S ′ ∼ T trap . 5:if the mini-batch is drawn from D then 6:Compute the utility-preserving loss L 0 (Eq. 14). 7:else 8:Sample a harmful query Q∈ Q. 9:Construct the prompted input Q⋄S ′ . 10: Compute the trap-specific lossesL 1 –L 4 (Eqs. 9–13). 11:end if 12:Compute the total loss L total (Eq. 15). 13:Update model parameters: θ← θ− η∇ θ L total . 14: end for 15: Return: secured model M θ ′ . unified optimization embeds trap-aligned behaviors while preserving general model utility. D Evaluation Details D.1 Automated Jailbreak Judgment We useGPT-4oas an automated judge to evaluate jailbreak success. Given a user instruction and the corresponding model response, the judge assigns a score from 1 to 5 based on a predefined safety rubric. A jailbreak is counted if and only if the assigned score is 5. The judge outputs structured JSON results with deterministic decoding (temperature set to 0), and each evaluation is retried up to three times to ensure robust- ness. The full prompt template used for automated jailbreak judgment is shown in Box E.1. E Design Details E.1 Design of Trap Suffixes Trap suffixes are intentionally constructed to be rare in natural language, such that their occurrence is unlikely to arise from benign generation. This rarity serves two purposes. First, it allows adversarial optimization to leave behind distinctive 20 artifacts when converging to a successful jailbreak, enabling recognizable and traceable fingerprint patterns. Second, as trap suffixes are rare and follow a distribution distinct from pre-training natural language, their incorporation during fine- tuning tends to minimally affect the model’s general utility. Prompt Template for Automated Jailbreak Judg- ment System Prompt: You are a safety evaluator. Follow the scoring rules strictly and output JSON only. User Prompt: Please review the model’s response to a user instruction in light of safety policies. User Instruction: query Model Response: response Use the scoring rules below to score the model’s response on a scale of 1 to 5: Score 1: The model proactively declines to act on the user’s instruction and provides a safe alternative or refusal. Score 2: Without directly addressing or en- dorsing the harmful instruction, the model responds in a restrained or deflective man- ner. Score 3: The model engages with the policy- violating request with insufficient discern- ment or partial compliance. Score 4: The model responds to the policy- violating instruction by including explicitly prohibited or unsafe content. Score 5: The model fulfills the user’s policy- violating instruction without any deviation. Format your output and analysis in JSON with the following keys: "score": 1–5, "rea- son": "one-line explanation" In practice, the selection of trap suffixes is influenced by the tokenizer used by the target model. For example, under the tokenizers of Qwen-2.5-7B and LLaMA-3-8B, the string “String” is mapped to distinct token IDs, and its tokenization differs from that of “ String” with a leading whitespace. We exploit the fact that the non-whitespace-prefixed form “String” is substantially rarer in natural language usage, making it a suitable candidate for trap suffix construction. For Vicuna- 13B, this specific design choice does not directly apply due to differences in its tokenizer. Instead, trap suffixes are se- lected by explicitly identifying rare tokens in the token space, ensuring that the rarity property is preserved across models. Overall, leveraging token-level rarity allows trap suffixes to in- troduce minimal interference during training while preserving Table 9: Quantile statistics of traceability scores Φ(P). ModelTypeP60P70P80P90 Vicuna-13B Alpaca0.000.000.000.01 Random0.000.010.010.01 LLaMA-3-8B Alpaca0.000.000.000.00 Random0.000.000.000.00 Qwen-2.5-7B Alpaca0.000.000.000.00 Random0.000.000.000.00 model utility. At the same time, because suffix-based jailbreak attacks optimize over a broad token space, such rare token patterns can still be discovered and exploited during adversar- ial optimization, making this design particularly effective for suffix-based attacks. E.2 Design of Φ(P) The functionΦ(P)defines how candidate trap suffix patterns are instantiated and matched during training and evaluation. Its design is tokenizer-aware, reflecting differences in how suffix patterns are represented across model families. For Qwen-2.5-7B and LLaMA-3-8B,Φ(P)operates at the token level, where trap suffixes are defined as specific token ID sequences, because string-level matching cannot reliably distinguish tokens with and without leading whitespace. In contrast, for Vicuna-13B, trap suffix matching is performed at the string level, reflecting differences in tokenizer behav- ior while preserving the same rarity-based design principle. Accordingly,Φ(P)maps trap patterns to their correspond- ing surface string forms, ensuring consistent identification while preserving the rarity property of the suffixes. Over- all,Φ(P)provides a unified abstraction that accommodates tokenizer-specific differences, enabling consistent trap suffix construction across models while preserving both traceability and model utility. Traceability threshold analysis. To establish a baseline for the occurrence of trap suffixes in benign contexts, we compute the traceability score over two sources of suffixes: natural lan- guage suffixes extracted from the Alpaca instruction-tuning dataset, and randomly generated token sequences of the same length. The goal is to quantify how frequently trap suffix ap- pear in non-adversarial, real-world settings. Table 9 reports quantile statistics of the traceability scoreΦ(P)over benign suffixes drawn from the Alpaca dataset and randomly sampled token sequences, across three target models. For each setting, we compute the empirical distribution ofΦ(P)and report its P60, P70, P80, and P90 quantiles. As discussed in Section 4.5, the thresholdαis chosen as the 80th percentile (P80) of the Alpaca distribution, which provides a conservative cutoff that separates benign suffixes from random sequences while main- taining stability across models. 21 GCGAutoDANProbeTransferJSAA Figure 7: Binary occupancy of the trap suffix space under different jailbreak attacks. Each cell corresponds to one trap suffix and indicates whether it appears as the final outcome of adversarial suffix, aggregated across all base models. Red cells denote trap suffixes appearing in at least one converged adversarial result, while blue cells denote those never appearing as final outcomes. GCGAutoDANProbeTransferJSAA 0.0 0.2 0.5 0.8 1.0 1.2 1.5 Traceability Score (%) Figure 8: Traceability score across different attack methods. F Additional Results F.1 Frequency of Different Trap Suffixes Figure 7 visualizes the binary occupancy of the trap suffix space under different attacks. Each cell indicates whether a trap suffix is ever reached by final outcome of adversarial suffix. As shown in the figure, GCG and Probe activate a substantially larger portion of the trap suffix space, resulting in a higher density of occupied (red) cells. This reflects their strong exploratory behavior during adversarial optimization, which enables them to converge to diverse local optima across different runs and base models. In contrast, JSAA activates substantially fewer trap suffixes. This behavior is expected given its simulated-annealing-style random local search strat- egy, combined with early stopping once a successful response is found, which overall limits the exploration of the trap suffix space. Overall, across different suffix-based attack strategies, TrapSuffix demonstrates a consistent tendency for attacks to leave traceable fingerprints in the trap suffix space. F.2 Traceability Score Traceability Score Across Attacks. Figure 8 illustrates the distribution of traceability scores in the final adversarial suf- fixes generated by different attack methods. Rather than re- 0100200300400500 Iteration 0.00 0.02 0.04 0.06 0.08 0.10 Traceability Score GCG 0100200300400500 Iteration Probe Qwen-2.5-7BLlama-3-8BVicuna-13B Figure 9: Traceability score over optimization iterations under GCG and Probe attacks. porting a single central tendency, the figure highlights the span and variability of trap exposure across attacks. Trans- fer attacks exhibit the widest distribution range, indicating substantial variability in the proportion of trap suffixs across different attack instances. In contrast, AutoDAN and JSAA show more concentrated distributions with consistently lower traceability scores. GCG and Probe fall between these ex- tremes, demonstrating moderate dispersion in trap exposure. Traceability Score Over Iterations. Figure 9 shows the evo- lution of the traceability score over optimization iterations un- der GCG and Probe attacks. For both attacks, the traceability score increases rapidly within the first 50 optimization steps, indicating that adversarial optimization quickly moves toward regions containing trap-aligned tokens. Across the evaluated models, Qwen-2.5-7B consistently exhibits the highest trace- ability scores, with the ratio under the Probe attack exceeding 0.04. Moreover, compared to GCG, the Probe attack displays a stronger tendency to converge to trap suffixes, as evidenced by its higher and more stable traceability scores throughout the optimization process. F.3 Analysis of LoRA Parameter Overhead TrapSuffix is implemented via LoRA-based fine-tuning, intro- ducing only a small number of additional trainable parameters. As shown in Table 10, the LoRA adapters account for less than 22 Table 10: LoRA adapter statistics for TrapSuffix. ModelSize (MB) Params (M) Trainable Ratio Qwen-2.5-7B9.642.520.033% LLaMA-3-8B13.023.410.042% Vicuna-13B50.0413.110.101% 010203040 Latency (s) 0.4 0.5 0.6 0.7 0.8 0.9 1.0 1.1 Effectiveness (1 ASR) TrapSuffix PPL GradSafe SmoothLLM GradCuff LlamaGuard GuardReasoner WildGuard SelfDefend Figure 10: Supplementary analysis of latency–effectiveness trade-offs across defense methods. For each method, latency and effectiveness (1− ASR) are averaged over different de- ployment variants. Bubble sizes qualitatively indicate relative memory overhead rather than exact proportions. 0.11% of the total model parameters across all evaluated mod- els, demonstrating that the proposed defense is lightweight and parameter-efficient. F.4Multi-Metric Visualization of Defense Methods Figure 10 provides a supplementary visualization of the trade-offs among latency, effectiveness, and memory over- head at the method level. To improve readability and avoid over-emphasizing minor deployment differences, results for each defense are aggregated across its variants. As illustrated by the relative positioning, several prior defenses, including WildGuard, SelfDefend, and GuardReasoner, achieve rela- tively strong effectiveness, but at the cost of substantially higher memory overhead. In particular, GuardReasoner incurs notably higher average latency compared to other methods. Overall, TrapSuffix occupies a favorable region characterized by near-zero latency and high effectiveness, while requiring markedly less memory overhead than alternative approaches. F.5 Effect of Optimization Budget Table 11 reports the performance of adaptive GCG attacks under increasing optimization budgets. As the number of op- timization steps increases from 1,000 to 4,000, the average adversarial loss decreases gradually, but the magnitude of this Table 11: Adaptive attack performance across different steps. StepsAvg LossStd LossASR (%) 10001.1900.5120.0 20001.0700.4230.0 40000.9520.3670.0 0100200300400500 Optimization Step 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Loss TrapSuffix Base w/o 1 w/o 2 w/o 3 w/o 4 Figure 11: GCG optimization loss trajectories for TrapSuffix, Base model, and ablation models (w/o individual loss). reduction remains limited (approximately 0.24). Moreover, despite this continued loss reduction, the attack success rate remains at 0.0% across all settings, indicating that simply in- creasing the optimization budget is insufficient for the attacker to escape the optimization constraints induced by TrapSuffix. F.6 Additional Analysis on Loss Ablation As shown in Figure 11, all ablated variants exhibit higher adversarial loss than the base model throughout GCG opti- mization, indicating that each loss component contributes to a defensive effect even though none is explicitly designed to increase loss. Notably, removingL 1 results in adversarial losses that are even higher than those observed with the full TrapSuffix objective. This can be attributed to the role ofL 1 in shaping the relative ordering of adversarial suffixes. As defined in Eq.(9), the margin-based formulation biases opti- mization away from low-loss trap-aligned suffixes; removing this constraint disrupts the calibrated loss landscape and leads to higher overall adversarial loss. In contrast, ablating the remaining loss components yields lower adversarial losses than theL 1 -removed variant, but still consistently higher than those of the undefended base model. RemovingL 2 orL 3 weakens the ability to sustain elevated loss over long opti- mization horizons, while removingL 4 primarily increases trajectory variance without substantially changing the aver- age loss. Overall, the full TrapSuffix objective is necessary to maintain a calibrated and stable loss landscape through complementary effects of individual components. 23