Detecting Fluent Optimization-Based Adversarial Prompts via Sequential Entropy Changes

Optimization-based adversarial suffixes can jailbreak aligned large language models (LLMs) while remaining fluent, weakening static and windowed perplexity-based detectors. We cast adversarial suffix detection as an *online change-point detection* problem over the token-level next-token entropy stream. Using the LLM system prompt to estimate a robust baseline, we standardize user-token entropies and apply a one-sided CUSUM statistic. The resulting detector, *CPD Online* (CPD), is model-agnostic, training-free, runs online, and localizes the adversarial suffix onset. On a benchmark of 1,012 optimization-based suffix attacks (GCG, AutoDAN, AdvPrompter, BEAST, AutoDAN-HGA) and 1,012 perplexity-controlled benign prompts, CPD improves F1 over the strongest windowed-perplexity baseline on all six open-weight chat models (LLaMA-2-7B/13B, Vicuna-7B/13B, Qwen2.5-7B/14B). On LLaMA-2-7B at the canonical CUSUM setting ($k=0$), CPD reaches AUROC $0.88$ and F1 $0.82$. Beyond prompt-level detection, CPD concentrates 79.6% of its triggers inside the adversarial suffix, versus 17–46% for windowed perplexity. Finally, when used as a lightweight gate for LLaMA Guard, CPD reduces guard calls by 17–22% on a high-volume, benign-dominated deployment while preserving guard-level detection quality.

Large language models like ChatGPT are trained to refuse harmful requests, but attackers can trick them by appending a carefully-crafted string of text to the end of a question. Modern versions of these "adversarial suffixes" are generated automatically and dressed up to read naturally, so ordinary text-quality filters routinely miss them. We built a lightweight watchdog, CPD Online, that does something different: it listens, word by word, to how surprised the model is by what it is reading. The system's own instructions set what normal surprise looks like, and an alarm fires when that pattern shifts and stays shifted — the signature of a hidden suffix taking over from the legitimate question. It needs no training, no second model, runs alongside the model's normal work, and pinpoints where the attack begins. Tested on six open-weight models (LLaMA-2, Vicuna, Qwen2.5, 7–14 billion parameters) against five attack families, it catches these hidden suffixes more reliably than comparable simple defenses. Used as a fast first-pass screen, it cuts the compute cost of running heavier safety classifiers by 17–22% on realistic traffic without weakening protection.