CDD-Guard: A Training-Free Endogenous Defense Framework for LLMs via Contrastive Latent Distribution Analysis
Source abstract
Abstract
While the integration of large language models (LLMs) drives intelligent automation, their endogenous vulnerability to complex adversarial prompts engenders critical security threats. To address the limitations of existing defenses relying on prohibitive fine-tuning or lagging text matching, this paper proposes Contrastive Distribution Discriminator Guard (CDD-Guard), a training-free endogenous monitoring framework. CDD-Guard pioneers mapping a latent bipolar semantic axis to geometrically separate benign and malicious representations. To mitigate structural noise, it introduces an adaptive layer filtering mechanism driven by statistical effect size, while a cross-layer projection normalization mechanism utilizes Z-Scores to isolate statistical anomalies from thematic variances. Evaluations across heterogeneous LLMs demonstrate superior detection efficacy. Crucially, by directly reusing hidden states generated during a single forward pass, CDD-Guard circumvents the autoregressive generation overhead of external monitors, reducing computational monitoring latency by over 99%. Operating strictly under the constraint of preserving original weights, this framework achieves substantial improvements in attack interception rates and cross-model generalization, providing a lightweight yet robust contribution to LLM security.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Topic Modeling · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Engineering, Huaqiao University, Quanzhou 362021, China
The FAW-Volkswagen Automotive Company Limited, Foshan 528200, China
School of Information Science and Engineering, Huaqiao University, Xiamen 361021, China
The Chinese Academy of Cyberspace Studies, Beijing 100048, China
Funding
National Key Research and Development Program of China · National Natural Science Foundation of China · Natural Science Foundation of Xiamen · Natural Science Foundation of Fujian Province · Open List and Leader Appointment Project of Fujian Province · Key Program of Natural Science Foundation of Fujian Province · Key Science and Technology Project of Xiamen City · Scientific Research Funds of Huaqiao University · High-level Talent Team Project of Quanzhou City
References (46)
Show source-provided references
1. Liu, S., Zhao, S., Jia, C., Zhuang, X., Long, Z., Zhou, J., Zhou, A., Lan, M., and Chong, Y. (2025, January 19–24). FinDABench: Benchmarking financial data analysis ability of large language models. Proceedings of the 31st International Conference on Computational Linguistics, Abu Dhabi, United Arab Emirates.
2. Zhang, Z., Zhang-Li, D., Yu, J., Gong, L., Zhou, J., Hao, Z., Jiang, J., Cao, J., Liu, H., and Liu, Z. (2025). Simulating classroom education with llm-empowered agents. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), Association for Computational Linguistics.10.18653/v1/2025.naacl-long.520 ↗
3. Gong, X., Gao, J., Sun, S., Zhong, Z., Shi, Y., Zeng, H., and Yang, K. (2025). Adaptive Compressed-based Privacy-preserving Large Language Model for Sensitive Healthcare. IEEE J. Biomed. Health Inform., 1–13.10.1109/JBHI.2025.3558935 ↗
4. HumanMoD: A multi-RAG collaborative LLM for inclusive urban public healthcare services10.1016/j.asoc.2025.113684 ↗
5. Enhancing named entity recognition with external knowledge from large language model10.1016/j.knosys.2025.113471 ↗
6. Disentangling Adversarial Prompts: A Semantic-Graph Defense for Robust LLM Security10.1609/aaai.v40i5.37389 ↗
7. Thakur, V. (2023). Unveiling gender bias in terms of profession across llms: Analyzing and addressing sociological implications. arXiv.
8. Li, H., Guo, D., Fan, W., Xu, M., Huang, J., Meng, F., and Song, Y. (2023). Multi-step jailbreaking privacy attacks on chatgpt. Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2023, Association for Computational Linguistics.10.18653/v1/2023.findings-emnlp.272 ↗
9. Shen, X., Chen, Z., Backes, M., Shen, Y., and Zhang, Y. (2024). “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ACM SIGSAC.10.1145/3658644.3670388 ↗
10. Liu, T., Zhang, Y., Zhao, Z., Dong, Y., Meng, G., and Chen, K. (2024). Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), USENIX Association.
11. Lankford, S., Afli, H., and Way, A. (2023). Adaptmllm: Fine-tuning multilingual language models on low-resource languages with integrated llm playgrounds. Information, 14.10.3390/info14120638 ↗
12. Dong, Q., Li, L., Dai, D., Zheng, C., Ma, J., Li, R., Xia, H., Xu, J., Wu, Z., and Chang, B. (2024). A survey on in-context learning. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics.10.18653/v1/2024.emnlp-main.64 ↗
13. Shi, J., Yuan, Z., Liu, Y., Huang, Y., Zhou, P., Sun, L., and Gong, N.Z. (2024). Optimization-based prompt injection attack to llm-as-a-judge. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ACM SIGSAC.10.1145/3658644.3690291 ↗
14. Yi, J., Xie, Y., Zhu, B., Kiciman, E., Sun, G., Xie, X., and Wu, F. (2025). Benchmarking and defending against indirect prompt injection attacks on large language models. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, ACM.10.1145/3690624.3709179 ↗
15. Explainability for large language models: A survey
16. Prottasha, N.J., Sami, A.A., Kowsher, M., Murad, S.A., Bairagi, A.K., Masud, M., and Baz, M. (2022). Transfer learning for sentiment analysis using BERT based supervised fine-tuning. Sensors, 22.10.3390/s22114157 ↗
17. Model tuning or prompt Tuning? A study of large language models for clinical concept and relation extraction10.1016/j.jbi.2024.104630 ↗
18. Zhang, Z., Yang, J., Ke, P., Mi, F., Wang, H., and Huang, M. (2024). Defending large language models against jailbreaking attacks through goal prioritization. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics.10.18653/v1/2024.acl-long.481 ↗
19. Dou, Y., Forbes, M., Koncel-Kedziorski, R., Smith, N.A., and Choi, Y. (2022). Is GPT-3 text indistinguishable from human text? scarecrow: A framework for scrutinizing machine text. Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics.10.18653/v1/2022.acl-long.501 ↗
20. Phute, M., Helbling, A., Hull, M., Peng, S., Szyller, S., Cornelius, C., and Chau, D.H. (2023). Llm self defense: By self examination, llms know they are being tricked. arXiv.
21. Lin, X., Wang, W., Li, Y., Yang, S., Feng, F., Wei, Y., and Chua, T.S. (2024). Data-efficient Fine-tuning for LLM-based Recommendation. Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, ACM.10.1145/3626772.3657807 ↗
22. Bao, K., Zhang, J., Zhang, Y., Wang, W., Feng, F., and He, X. (2023). Tallrec: An effective and efficient tuning framework to align large language model with recommendation. Proceedings of the 17th ACM Conference on Recommender Systems, ACM.10.1145/3604915.3608857 ↗
23. Jailbroken: How does llm safety training fail?
24. Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., and Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv.
25. Liu, X., Xu, N., Chen, M., and Xiao, C. (2023). Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv.
26. Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., and Wong, E. (2025). Jailbreaking Black Box Large Language Models in Twenty Queries. Proceedings of the 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), IEEE.10.1109/SaTML64287.2025.00010 ↗
27. Shah, R., Pour, S., Tagade, A., Casper, S., and Rando, J. (2023). Scalable and transferable black-box jailbreaks for language models via persona modulation. arXiv.
28. Yong, Z.X., Menghini, C., and Bach, S.H. (2023). Low-resource languages jailbreak gpt-4. arXiv.
29. Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., Wang, H., Zhang, T., and Liu, Y. (2023). Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv.10.14722/ndss.2024.24188 ↗
30. Training language models to follow instructions with human feedback
31. Röttger, P., Kirk, H., Vidgen, B., Attanasio, G., Bianchi, F., and Hovy, D. (2024). Xstest: A test suite for identifying exaggerated safety behaviours in large language models. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), Association for Computational Linguistics.10.18653/v1/2024.naacl-long.301 ↗
32. Jain, N., Schwarzschild, A., Wen, Y., Somepalli, G., Kirchenbauer, J., Chiang, P.y., Goldblum, M., Saha, A., Geiping, J., and Goldstein, T. (2023). Baseline defenses for adversarial attacks against aligned language models. arXiv.
33. Robey, A., Wong, E., Hassani, H., and Pappas, G.J. (2023). Smoothllm: Defending large language models against jailbreaking attacks. arXiv.
34. Inan, H., Upasani, K., Chi, J., Rungta, R., Iyer, K., Mao, Y., Tontchev, M., Hu, Q., Fuller, B., and Testuggine, D. (2023). Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv.
35. Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., and Dombrowski, A.K. (2023). Representation engineering: A top-down approach to ai transparency. arXiv.
36. Dai, J., Pan, X., Sun, R., Ji, J., Xu, X., Liu, M., Wang, Y., and Yang, Y. (2023). Safe rlhf: Safe reinforcement learning from human feedback. arXiv.
37. Zhou, Z., Yu, H., Zhang, X., Xu, R., Huang, F., and Li, Y. (2024). How alignment and jailbreak work: Explain llm safety through intermediate hidden states. Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2024, Association for Computational Linguistics.10.18653/v1/2024.findings-emnlp.139 ↗
38. Natural questions: A benchmark for question answering research10.1162/tacl_a_00276 ↗
39. Are aligned neural networks adversarially aligned?10.52202/075280-2687 ↗
40. Siino, M. (2024). Mistral at semeval-2024 task 5: Mistral 7b for argument reasoning in civil procedure. Proceedings of the 18th International Workshop On Semantic Evaluation (SemEval-2024), Association for Computational Linguistics.10.18653/v1/2024.semeval-1.24 ↗
41. Bai, S., Cai, Y., Chen, R., Chen, K., Chen, X., Cheng, Z., Deng, L., Ding, W., Gao, C., and Ge, C. (2025). Qwen3-vl technical report. arXiv.
42. Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., and Vaughan, A. (2024). The llama 3 herd of models. arXiv.
43. Abdin, M., Aneja, J., Awadalla, H., Awadallah, A., Awan, A.A., Bach, N., Bahree, A., Bakhtiari, A., Bao, J., and Behl, H. (2024). Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone. arXiv.
44. Team, G., Riviere, M., Pathak, S., Sessa, P.G., Hardin, C., and Bhupatiraju, S. (2024). Gemma 2: Improving Open Language Models at a Practical Size. arXiv.
45. Li, H., and Liu, X. (2024). Injecguard: Benchmarking and mitigating over-defense in prompt injection guardrail models. arXiv.
46. Nakajima, Y. (2026, March 17). Yohei’s Blog Post. Available online: https://x.com/yoheinakajima/status/1582844144640471040.