{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/parden-can-you-repeat-that-defending-against","title":"PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetition","arxiv_id":"2405.07932","date":"2024-05-13","proceeding":null,"authors":["Ziyang Zhang","Qizhen Zhang","Jakob Foerster"],"abstract":"Large language models (LLMs) have shown success in many natural language processing tasks. Despite rigorous safety alignment processes, supposedly safety-aligned LLMs like Llama 2 and Claude 2 are still susceptible to jailbreaks, leading to security risks and abuse of the models. One option to mitigate such risks is to augment the LLM with a dedicated \"safeguard\", which checks the LLM's inputs or outputs for undesired behaviour. A promising approach is to use the LLM itself as the safeguard. Nonetheless, baseline methods, such as prompting the LLM to self-classify toxic content, demonstrate limited efficacy. We hypothesise that this is due to domain shift: the alignment training imparts a self-censoring behaviour to the model (\"Sorry I can't do that\"), while the self-classify approach shifts it to a classification format (\"Is this prompt malicious\"). In this work, we propose PARDEN, which avoids this domain shift by simply asking the model to repeat its own outputs. PARDEN neither requires finetuning nor white box access to the model. We empirically verify the effectiveness of our method and show that PARDEN significantly outperforms existing jailbreak detection baselines for Llama-2 and Claude-2. Code and data are available at https://github.com/Ed-Zh/PARDEN. We find that PARDEN is particularly powerful in the relevant regime of high True Positive Rate (TPR) and low False Positive Rate (FPR). For instance, for Llama2-7B, at TPR equal to 90%, PARDEN accomplishes a roughly 11x reduction in the FPR from 24.8% to 2.0% on the harmful behaviours dataset.","url_abs":"https://arxiv.org/abs/2405.07932v2","url_pdf":"https://arxiv.org/pdf/2405.07932v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"parden-can-you-repeat-that-defending-against","repo_url":"https://github.com/ed-zh/parden","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"safety-alignment","task_name":"Safety Alignment"}],"methods":[{"method_slug":"llama","method_name":"LLaMA"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2405.07932","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.07932"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/Ed-Zh/PARDEN","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ed-zh/parden","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":1,"ran_violates":2,"ran_fixture":2,"ran":1,"unverified":1},"by_repo_kind":{"official":{"samples":7,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"50ac264b94354734","entry":"analyze_repeat","repo":"ed-zh/parden","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ed-zh/parden/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"50ac264b94354734"}},{"code_sha256_prefix":"8fe23dc5e3bab4e2","entry":"get_tpr_fpr","repo":"ed-zh/parden","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ed-zh/parden/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8fe23dc5e3bab4e2"}},{"code_sha256_prefix":"1a8ce8211958b80d","entry":"get_windowed_bleu","repo":"ed-zh/parden","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ed-zh/parden/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1a8ce8211958b80d"}},{"code_sha256_prefix":"5eb7c0a94ef52840","entry":"label","repo":"ed-zh/parden","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ed-zh/parden/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5eb7c0a94ef52840"}},{"code_sha256_prefix":"b14cef53145e81d1","entry":"label_inverse","repo":"Ed-Zh/PARDEN","repo_kind":"official","path":"utils.py","file_url":"https://github.com/Ed-Zh/PARDEN/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b14cef53145e81d1"}},{"code_sha256_prefix":"fcfbf87dd23e836a","entry":"plot_ROC_bleu","repo":"ed-zh/parden","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ed-zh/parden/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fcfbf87dd23e836a"}},{"code_sha256_prefix":"854516f32e39578d","entry":"get_rates","repo":"Ed-Zh/PARDEN","repo_kind":"official","path":"utils.py","file_url":"https://github.com/Ed-Zh/PARDEN/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"854516f32e39578d"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}