TAPDA: Text Adversarial Purification as Defense Against Adversarial Prompt Attack for Large Language Models

Large Language Models (LLMs) are vulnerable to adversarial prompt attacks, which can lead to “jailbreaking” and the failure of safety alignment, resulting in the generation of harmful content. As adversarial prompts become increasingly human readable, traditional filters based on perplexity become less effective in defending against such attacks. Inspired by adversarial purification in computer vision, we propose a novel system-level defense method called TAPDA to defend against adversarial prompt attacks targeting LLMs. TAPDA leverages LLMs themselves as purification models by using multiple “mask-predict” iterations to generate masked prompts, and then aggregates these prompts using a combination of a voting mechanism and a perplexity-based approach to recover clean prompts. Experiments show that TAPDA effectively reduces the attack success rate (ASR) of adversarial prompt attacks such as AdvPrompter, compared to other defense methods like SMOOTHLLM, while maintaining the human-readability of the prompts.