Perplexity Filtering: The First LLM Defense (And Why Evolutionary Attacks Broke It)

Perplexity filtering catches gibberish jailbreak suffixes almost perfectly. Then evolutionary jailbreaks started optimizing for low perplexity as part of the attack itself. Here's the full arc, with real numbers.