Large language models (LLMs) are typically equipped with alignment mechanisms designed to prevent the generation of harmful content. However, recent advances have led to the emergence of highly evasive disguised prompt jailbreak attacks (DPJAs), where attackers conceal real malicious intent within prompts that appear benign on the surface, thereby inducing the model to produce unsafe outputs. In this work, we propose prompt reconstruction-based detection (RePrompt), a training-free and plug-in detection framework designed to identify such jailbreak attacks. The key insight of RePrompt is that, when guided by carefully designed templates, LLMs possess the capability to uncover disguised adversarial prompts and effectively detect jailbreak attacks. RePrompt leverages the reasoning capabilities of the LLM itself to analyze and uncover the true intent behind a user’s query. When a disguised jailbreak prompt is encountered, RePrompt reconstructs the underlying malicious intent hidden beneath the surface-level disguise. Experiments across multiple LLMs, datasets, and three representative DPJAs demonstrate that RePrompt consistently outperforms state-of-the-art defense methods, reducing the average attack success rate from 47.0% to below 1.6%, achieving a near-zero false positive rate, and limiting the average query cost to only 1.13.

Reconstruction attackers can exploit facial features to recover the original user’s face, resulting in user privacy leakage. One new strategy to enhance the “Edge-Cloud” face recognition system’s privacy is to add adversarial perturbations to facial features, preventing the attackers from high-quality user image recovery. However, the existing works following this strategy suffer from unacceptable damage to face recognition accuracy. Achieving robust privacy enhancement and face recognition accuracy simultaneously is still challenging. To tackle this challenge, we propose an adversarial perturbation-based plug-and-play privacy-enhancing method (Patronus) with robustness against face image reconstruction attacks and near-lossless face recognition performance. The key insight is derived from our observation that the feature distance between two face images of the same person is significantly lower than the threshold set in the face recognition system. This leaves room for adding adversarial perturbations to the facial features without compromising face recognition accuracy. Our strategy limits the amount of adversarial perturbations in a fine-grained manner to ensure that they are within the range of not damaging face recognition accuracy. Our evaluation shows the superior performance ofPatronusin robustness against reconstruction attacks and near-lossless face recognition accuracy compared to state-of-the-art (SOTA) methods.Patronuscan be easily integrated into deployed face recognition systems as a plug-in privacy-enhancing module with low overhead.