Jailbreak Attacks and Defenses on Large Language Models: A Survey

Source abstract

Large Language Models (LLMs) have demonstrated strong capabilities in content generation and knowledge-centric interaction and have been widely deployed in education, healthcare, communications, and finance. To mitigate unsafe outputs, contemporary LLM systems incorporate safety-alignment strategies and content-filtering mechanisms. However, jailbreak attacks exploit adversarial inputs or generation-control mechanisms to bypass safety constraints and elicit harmful content. With the growing prevalence of multi-turn dialogue and multimodal interaction, these attacks exhibit increased stealth and potential for scalable exploitation. Although prior studies have surveyed jailbreak attacks and defenses, evaluation criteria remain fragmented, hindering fair and reproducible comparisons, and comprehensive reviews under a consistent evaluation framework remain limited. To address these gaps, this paper presents a comprehensive survey of jailbreak attacks and defenses targeting LLMs, grounded in a structured literature collection, screening, and coding process. We first introduce the essential background of LLMs and formalize the jailbreak attack process. We then propose two complementary evaluation frameworks to assess the performance of attack and defense methods, respectively. Building on these frameworks, we construct a taxonomy for jailbreak attacks based on the primary execution interface and manipulated object, as well as a defense taxonomy based on the stage of intervention within the model life cycle. We further provide a comparative and evaluation-oriented synthesis of representative methods in terms of their technical characteristics, application settings, strengths, and limitations. Finally, we identify key open challenges and outline future research directions for improving the security of LLMs against jailbreak attacks.