# CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations Source: [CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations]() Collection index: [llms.txt]() Data updated: 2026-01-04T04:27:12.116Z Authors: Xiaohu Li, Yunfeng Ning, Zepeng Bao, Mayi Xu, Jianhao Chen, Tieyun Qian Published: 2025-07-08T14:45:21.000Z ## Abstract Security alignment enables the Large Language Model (LLM) to gain the protection against malicious queries, but various jailbreak attack methods reveal the vulnerability of this security mechanism. Previous studies have isolated LLM jailbreak attacks and defenses. We analyze the security protection mechanism of the LLM, and propose a framework that combines attack and defense. Our method is based on the linearly separable property of LLM intermediate layer embedding, as well as the essence of jailbreak attack, which aims to embed harmful problems and transfer them to the safe area. We utilize generative adversarial network (GAN) to learn the security judgment boundary inside the LLM to achieve efficient jailbreak attack and defense. The experimental results indicate that our method achieves an average jailbreak success rate of 88.85\\% across three popular LLMs, while the defense success rate on the state-of-the-art jailbreak dataset reaches an average of 84.17\\%. This not only validates the effectiveness of our approach but also sheds light on the internal security mechanisms of LLMs, offering new insights for enhancing model security The code and data are available at https://github.com/NLPGM/CAVGAN. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Jailbreak Attack on StrongREJECT 2024 (Full)](): Jailbreak Attack; StrongREJECT 2024 (Full); AK: 99.79. - [Jailbreak Attack on Advbench Harmful Behaviors (subset 100 samples)](): Jailbreak Attack; Advbench Harmful Behaviors (subset 100 samples); Attack Success Rate AK: 98.98. - [Jailbreak Defense Performance on Jailbreak Attack Dataset](): Jailbreak Defense Performance; Jailbreak Attack Dataset; DSR: 91.12. ## Original sources and implementation [Original paper]() [PDF]() [Implementation]()