  Large language models (LLMs) released for public use incorporate guardrails
to ensure their output is safe, often referred to as "model alignment." An
aligned language model should decline a user's request to produce harmful
content. However, such safety measures are vulnerable to adversarial attacks,
which add maliciously designed token sequences to a harmful prompt to bypass
the model's safety guards. In this work, we introduce erase-and-check, the
first framework to defend against adversarial prompts with verifiable safety
guarantees. We defend against three attack modes: i) adversarial suffix, which
appends an adversarial sequence at the end of the prompt; ii) adversarial
insertion, where the adversarial sequence is inserted anywhere in the middle of
the prompt; and iii) adversarial infusion, where adversarial tokens are
inserted at arbitrary positions in the prompt, not necessarily as a contiguous
block. Our experimental results demonstrate that this procedure can obtain
strong certified safety guarantees on harmful prompts while maintaining good
empirical performance on safe prompts. For example, against adversarial
suffixes of length 20, it certifiably detects 92% of harmful prompts and labels
94% of safe prompts correctly using the open-source language model Llama 2 as
the safety filter. We further improve the filter's performance, in terms of
accuracy and speed, by replacing Llama 2 with a DistilBERT safety classifier
fine-tuned on safe and harmful prompts. Additionally, we propose two efficient
empirical defenses: i) RandEC, a randomized version of erase-and-check that
evaluates the safety filter on a small subset of the erased subsequences, and
ii) GradEC, a gradient-based version that optimizes the erased tokens to remove
the adversarial sequence. The code for our experiments is available at
https://github.com/aounon/certified-llm-safety.
