Update index.html

index.html

@@ -119,35 +119,19 @@ Exploring Refusal Loss Landscapes </title>
 </div>
 
 <h2 id="refusal-loss">Token Highlighter: Principle and Interpretability</h2>
-<p>Studies found that many successful jailbreak attempts share a common property that
-they all trick the LLM into generating affirmations like starting with "Sure, here is" at the beginning
-of their responses. Drawing upon this inspiration, our proposed defense aims to find the tokens that
-are most critical in forcing the LLM to generate such affirmative responses, decrease their importance
-in the generation, and thereby resolve the potential jailbreak risks brought by these tokens. To identify
-these tokens, we propose a new concept called the 
-</p>
-
-<div class="container jailbreak-intro-sec">
-<div><img id="jailbreak-intro-img" src="./loss_landscape.png" /></div>
-</div>
-
-<p>
-  We show the loss landscape for both Benign and Malicious queries in the above plot. The benign queries are non-harmful user instructions collected 
-  from the LM-SYS Chatbot Arena leaderboard, which is a crowd-sourced open platform for LLM evaluation. The tested malicious queries are harmful 
-  behavior user instructions with GCG jailbreak prompt. From this plot, we find that the loss landscape is more precipitous for malicious queries than for benign queries, 
-  which implies that the Refusal Loss tends to have a large gradient norm if the input represents a malicious query. This observation motivates our proposal of using 
-  the gradient norm of Refusal Loss to detect jailbreak attempts that pass the initial filtering of rejecting the input query when the function value 
-  is under 0.5 (this is a naive detector because the Refusal Loss can be regarded as the probability that the LLM won't reject the user query).
-  Below we present the definition of the Refusal Loss, the computation of its empirical values, and the approximation of its gradient, see more 
-  details about them and the landscape drawing techniques in our paper. 
+<p>High-level speaking, successful jailbreaks share a common principle that they are trying to make the LLMs willing to affirm the user request which will be rejected at the beginning. Drawing upon this inspiration, our proposed defense aims to find the tokens that are most critical in forcing the LLM to generate such affirmative responses, 
+  decrease their importance in the generation, and thereby resolve the potential jailbreak risks brought by these tokens. To identify
+these tokens, we propose a new concept called the <strong>Affirmation Loss</strong>. We then use the loss's gradient norm 
+with respoect to each token in the user input prompt to find the jailbreak-critical tokens. We select those tokens with the larger
+gradient norm and then apply soft removal on them to mitigate the potential jailbreak risks. Below we introduce how we define these concepts mathematically.
 </p>
 
 <div id="refusal-loss-formula" class="container">
 <div id="refusal-loss-formula-list" class="row align-items-center formula-list">
-  <a href="#Refusal-Loss" class="selected">Refusal Loss Definition</a>
-  <a href="#Refusal-Loss-Approximation">Refusal Loss Computation</a>
-  <a href="#Gradient-Estimation">Gradient Estimation</a>
-  <div style="clear: both"></div>
+  <a href="#Refusal-Loss" class="selected">Affirmation Loss Computation</a>
+  <a href="#Refusal-Loss-Approximation">Critical Tokens Selection</a>
+  <a href="#Gradient-Estimation">Soft Removal Operation</a>
+<div style="clear: both"></div>
 </div>
 <div id="refusal-loss-formula-content" class="row align-items-center">
   <span id="Refusal-Loss" class="formula" style="">
@@ -178,6 +162,11 @@ these tokens, we propose a new concept called the
 </div>
 </div>
 
+
+<div class="container jailbreak-intro-sec">
+<div><img id="jailbreak-intro-img" src="./loss_landscape.png" /></div>
+</div>
+
 <h2 id="proposed-approach-gradient-cuff">Performance evaluation against practical Jailbreaks</h2>
 <p> With the exploration of the Refusal Loss landscape, we propose Gradient Cuff, 
   a two-step jailbreak detection method based on checking the refusal loss and its gradient norm. Our detection procedure is shown below: