A Causal Perspective for Enhancing Jailbreak Attack and Defense

2026-01-31

AI Summary

This work addresses the limited effectiveness of current jailbreaking attack and defense methods for large language models (LLMs), which stems from a lack of causal understanding. To bridge this gap, we introduce Causal Analyst, the first framework to incorporate causal inference into jailbreaking analysis. Our approach encodes prompts using LLMs and leverages graph neural networks to learn causal graph structures from 35,000 annotated samples, identifying key direct causal factors such as “positive role” and “number of task steps.” Building upon this causal graph, we develop an interpretable, causality-driven jailbreak enhancer and defense advisor that simultaneously improves attack success rates and effectively detects disguised malicious queries. Experimental results demonstrate significant performance gains over non-causal baseline methods.

Technology Category

• Machine Learning: Causal Learning
• Reasoning under Uncertainty: Causality
• Natural Language Processing: Safety and Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information

Abstract

Uncovering the mechanisms behind"jailbreaks"in large language models (LLMs) is crucial for enhancing their safety and reliability, yet these mechanisms remain poorly understood. Existing studies predominantly analyze jailbreak prompts by probing latent representations, often overlooking the causal relationships between interpretable prompt features and jailbreak occurrences. In this work, we propose Causal Analyst, a framework that integrates LLMs into data-driven causal discovery to identify the direct causes of jailbreaks and leverage them for both attack and defense. We introduce a comprehensive dataset comprising 35k jailbreak attempts across seven LLMs, systematically constructed from 100 attack templates and 50 harmful queries, annotated with 37 meticulously designed human-readable prompt features. By jointly training LLM-based prompt encoding and GNN-based causal graph learning, we reconstruct causal pathways linking prompt features to jailbreak responses. Our analysis reveals that specific features, such as"Positive Character"and"Number of Task Steps", act as direct causal drivers of jailbreaks. We demonstrate the practical utility of these insights through two applications: (1) a Jailbreaking Enhancer that targets identified causal features to significantly boost attack success rates on public benchmarks, and (2) a Guardrail Advisor that utilizes the learned causal graph to extract true malicious intent from obfuscated queries. Extensive experiments, including baseline comparisons and causal structure validation, confirm the robustness of our causal analysis and its superiority over non-causal approaches. Our results suggest that analyzing jailbreak features from a causal perspective is an effective and interpretable approach for improving LLM reliability. Our code is available at https://github.com/Master-PLC/Causal-Analyst.

Problem

• jailbreak
• causal analysis
• large language models
• prompt features
• safety

Innovation

• causal discovery
• jailbreak attack
• large language models
• prompt features
• graph neural networks