Certifying Robustness Large Language Models via Discrete-Continuous Randomized Smoothing

Large language models have achieved strong performance across diverse language understanding and generation tasks, yet they remain vulnerable to jailbreak attacks, which bypass safety mechanisms and elicit harmful responses. To mitigate this risk, a wide range of heuristic defenses has been proposed, but such defenses offer no formal guarantee and remain vulnerable to adaptive attackers aware of the deployed defensive mechanism. This motivates certified jailbreak defenses with provable guarantees over an explicitly specified perturbation set. However, prior certification methods rely on discrete token-level perturbation, yielding coarse-grained guarantees that treat all token modifications within the same budget as equally severe, regardless of their embedding-space displacement. We propose Discrete-Continuous Randomized Smoothing (DCRS), a certification framework for generative LLMs that combines random token subset selection with Gaussian smoothing in embedding space. By jointly accounting for the number of modified tokens and their embedding-space displacement, DCRS provides a finer-grained certificate than purely discrete token-count guarantees. DCRS converts suffix insertion into fixed-length replacement via dummy token padding and certifies for arbitrary suffix attacks under a fixed-length threat model.