Original title: AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks
Jakub Reš, Petr Kaška, Martin Perešíni, Martin Ukrop +1 · September 2026
Large language models can be tricked into answering dangerous requests through sneaky prompts, which are called jailbreak attacksTricks that make AI ignore its safety rules.. Stopping these attacks often requires changing the model itself, which is impossible if you do not own the system. To solve this, researchers built AlcaTRAz. It works purely on the incoming text and needs no internal access or retraining. AlcaTRAz uses rule treesA way to organize decision rules into a tree structure for learning transformations. to automatically learn how to insert small, carefully placed changes to individual characters in the prompt. By doing this, it breaks up the specific text patterns that attacks rely on, but keeps regular, harmless questions easy to understand. The researchers found that AlcaTRAz turned maximum-danger responses into near-refusals, beat three existing prompt defenses in most tests, and kept harmless question scores very close to normal. However, it does not fully stop all severe attacks, so it should act as one piece of a bigger security plan.
When you mail a letter, a sorting machine might misread handwriting and misdirect it due to specific patterns. To ensure it goes through, you print the address clearly, but a clever sender trying to evade detection might add tricky smudges. You decide to slightly alter all letters before they reach the machine—adding controlled smudges that confuse the pattern recognition for tricky senders while leaving normal addresses readable. Here, AlcaTRAz is like that pre-checker, making small character changes to input text to break the patterns jailbreak attacks use, while keeping normal prompts intact.
Language models can be tricked into harmful outputs, and many defenses require changing the model itself. AlcaTRAz works by altering the input before it reaches the model, so it can protect AI systems even when you cannot access or modify the model's code.
The abstract states that AlcaTRAz substantially reduces but does not eliminate jailbreak success, with a high-severity tail remaining. It does not consider adaptive attackers, meaning those who change their strategies. It is positioned as one layer within a defense-in-depth strategy, not a standalone guarantee.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks — Jakub Reš, Petr Kaška, Martin Perešíni et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.