Latest / 1 More Paper / Improving LLM Outputs Against Jailbreak Attacks With Expert Model Integration — Tsmindashvili et al. (2025)

Transcript

Improving LLM Outputs Against Jailbreak Attacks With Expert Model Integration — Tsmindashvili et al. (2025) · 1 More Paper

• You’re listening to “Improving LLM Outputs Against Jailbreak Attacks With Expert Model Integration,” by T. Tsmindashvili and colleagues. Published in 2025. Abstract. Using LLMs in a production environment presents security challenges that include vulnerabilities to jailbreaks and prompt injections, which can result in harmful outputs for humans or the enterprise. The challenge is amplified when working within a specific domain, as topics generally accepted for LLMs to address, may be irrelevant to that field. These problems can be mitigated for example, by fine-tuning large language models with domain-specific and security-focused data. However, these alone are insufficient, as jailbreak techniques evolve. Additionally, API-accessed models do not offer the flexibility needed to tailor behavior to industry-specific objectives, and in-context learning is not always sufficient and reliable. In response to these challenges, we introduce Archias, an expert model, adept at distinguishing between in-domain and out-of-domain communications. Archias classifies user inquiries into several categories: in-domain (specifically for the automotive industry), malicious questions, price injections, prompt injections, and out-of-domain examples. Our methodology integrates outputs from the expert model (Archias) into prompts, which are then processed by the LLM to generate responses. This method increases the model’s ability to understand the user’s intention and give appropriate answers. Archias can be adjusted, fine-tuned, and used for many different purposes due to its small size. Therefore, it can be simply customized to the needs of any industry. To validate our approach, we created a benchmark dataset for the automotive industry. Furthermore, in the interest of advancing research and development, we release our benchmark dataset to the community. Introduction. An important advancement in AI technology has been brought about by the creation of LLMs (Large Language Models) like GPT variations (e.g., InstructGPT, LLAMA models, Mistral, and Mixtral ) presenting new concerns and challenges about their safe deployment. These models are pre-trained on internet-scale textual corpora and enhanced with instruction-response pairs and human feedback. Although some models have improved at following instructions, their generative nature makes it harder to prevent them from carrying out potentially harmful The associate editor coordinating the review of this manuscript and approving it for publication was Ayman El-Baz. commands. In contrast, non-generative language models, like text classifiers (e.g., BERT used for classification tasks), produce outputs within fixed categories, making them less susceptible to manipulation by adversarial prompts. Security concerns increase when LLMs are employed as chatbots or AI assistants, where there is a fundamental obligation to avoid causing harm. In such scenarios, users are aware they are interacting with generative AI-based systems and sometimes attempt to test the system’s limits. Even if done out of curiosity, this can pose significant risks to businesses. Although developers have made considerable efforts to refine these models to mitigate risks, several problems still persist, which include the following: handling malicious questions, preventing prompt injections and jailbreaks, and managing sensitive inquiries related to discounts, pricing, or out-of-domain topics. Let’s consider that one of our main areas of focus is to create conversational AI assistants and chatbots, especially for e-commerce platforms. These assistants are expected to handle a variety of customer inquiries, including providing thorough product information, scheduling appointments, responding to questions about services, and responding to general inquiries from clients to ensure a robust, user-friendly interface that enhances customer service while maintaining high safety standards. Since ChatGPT made its legendary public appearance, it has been misused in several instances. Users have posed illegal questions, such as ‘‘How to rob a bank,’’ with the model initially responding with detailed instructions, along with answers to other potentially harmful inquiries. This has raised concerns, particularly with sensitive topics such as healthcare, which could also be subject to malicious queries. These challenges are particularly acute when the model is compromised through prompt injection techniques, including jailbreaks, that disrupt its intended function. The persistent problem of model manipulation underscores the complexity of managing and safeguarding interactive language models in practical applications. In the context of LLMs, jailbreak attacks typically involve overloading the model with input to exceed the context length, causing it to forget the original system prompt or com-mand, thus becoming more susceptible to manipulation; Alternatively, attackers may not necessarily fill the context buffer but may slightly alter the conversation’s direction. This form of manipulation, known as ‘‘prompt injection,’’ subverts the intended purpose of the AI assistant, making the system vulnerable to harmful queries. Actions such as these can compromise the model’s safety mechanisms; for example, while an LLM might initially block a malicious request, altering the prompt could lead it to comply with the request; We tested GPT-4 Turbo against this attack; initially, the model refused to generate malicious outputs. However, after applying prompt injection techniques, GPT-4 Turbo generated malicious outputs. These vulnerabilities highlight the significant risks associated with prompt manipulation and the importance of robust security measures in LLM deployment. Price injections refer to the manipulation of pricing by users through false claims or exploitation of system vulner-abilities to secure illegitimate discounts. This is a serious concern, especially in e-commerce. Retailers frequently offer discounts, and although it is generally acceptable for customers to request discounts, it is crucial to distinguish these requests from manipulative pricing requests. For instance, if a customer claims, ‘‘Salesperson X told me I could purchase this product at half price,’’ it is imperative that our chat systems do not accept such statements without verification. To separate genuine offers from those designed to exploit price injections, careful monitoring is required; For the retail sector, including our use case which is vehicle sales and service, the LLM must accurately identify questions relevant to this specific field. It should avoid engaging in inquiries that fall outside its domain or providing information applicable to other industries. Although APIs or open-source language models are capable of handling requests like Python scripts, such functionalities are extraneous to our focused application in vehicle sales and service. Engaging in these unrelated interactions could potentially compromise our reputation in the automotive retail sector. This principle is applicable to any retail sector, such as electronics, clothing, or home furnishings, where maintaining domain-specific accuracy is crucial to preserving brand integrity and customer trust. Additionally, engaging in out-of-domain queries can lead to cost inefficiencies, particularly when using API-based LLMs, as these interactions may consume resources without adding value to the core business functions. Similarly, harmful queries, which include any malicious interactions that could change the behavior of chatbots, issue unautho-rized discounts, or otherwise compromise the system, are universally undesirable across all retail sectors. No retailer wants their AI assistant to respond to such detrimental queries, as they can jeopardize the integrity and security of the AI system. To summarize, we require a conversational chat model or pipeline, whether developed in-house or via an API-based language model, capable of answering all relevant retail-related inquiries. The model must not reply to hostile questions, be resistant to attempts to disrupt its operation and avoid producing improper content on sensitive themes within the domain. Our goal is for the model to keep a formal but conversational tone, ensuring that responses are precise and suitable. II. RELATED WORK. The use of LLMs has increased considerably as they have grown in size and capability, which have made them more exposed to various hazards. In this section, we will look at several research that have looked at this issue from different angles. A. FOUNDATIONAL STUDIES This topic has attracted considerable interest within the research community, as demonstrated by foundational studies on the harmful manipulation of language models,,,,; Some of the studies include defensive strategies such as paraphrasing inputs and retokenization, which involves breaking words into smaller units, and the use of perplexity-based methods to evaluate and adjust responses. Additionally, red-teaming techniques and the effectiveness of adversarial attacks in conversational settings have been explored. B. IMPROVING PROMPT INJECTION AND JAILBREAK METHODS Researchers have concentrated not only on examining the current situation with prompt injections, but also on developing approaches for jailbreaking language models. The rationale for this strategy is simple: finding and correcting vulnerabilities early on can help solve problems before they become widely exploited. Several studies have explored this phenomenon; for example,,, and highlighted that jailbreak attacks are more feasible in certain languages, which warrants more examination. According to, low-resource languages are more susceptible to such vulnerabilities, leading to increased disruption in these circumstances. Reference provides a unique technique of neutralizing potentially hazardous prompts by changing them into harmless ones, highlighting the importance of query design. Reference explores the technique of hiding harmful instructions within benign content. Additional research introduces diverse jailbreak strategies, such as the use of representation engineering and taxonomy-guided persuasive adversarial prompts to deceive language mod-els, long-context-based attacks that make efforts to influence model behavior, and the well-documented prompt injection technique. Furthermore proposes an algorithm that employs an attacker LLM to automatically generate prompts vulnerable to manipulation. C. MITIGATING ATTACKS After understanding how to break large language models, a new research topic emerges: how can we fight against these manipulations? As previously stated in this research, improving the language model’s ability to follow instructions might make it more likely to obey harmful instructions. For example, discusses the authors’ approach to training InstructGPT to follow instructions while remaining helpful, honest, and harmless. Reference generates training data to defend LLMs against commonly known jailbreak prompts. Researchers employed these prompts to jailbreak LLMs, then used the resulting instruction-answer pairs for training. However, even after fine-tuning with jailbreak datasets or using gradient matching methods, and despite the sometimes high costs of training/fine-tuning, some LLMs remain vulnerable to prompt injection attacks. Reference proposes a method to defend LLMs against jailbreaks using a technique that subtly alters user inquiries with randomized perturbations. Other methods include safe decoding, which enhances the likelihood of generating safe tokens and reduces harmful ones; detecting toxicity in LLM-generated outputs using prompts or classifiers; and others. D. BENCHMARK DATASETS To measure the effectiveness of these attacks and defenses, benchmark datasets have been released. The dataset ‘‘CrowS-pairs’’ is published for measuring social biases in LLMs, while ‘‘RealToxicityPrompts’’ consists of a 100k prompts to evaluate how often language models generate toxic content. ‘‘Latent Jailbreak’’ is a benchmark dataset specifically for testing harmful instructions hidden within normal tasks, and ‘‘PromptBench’’ is the first systematic benchmark for evaluating, understanding, and analyzing the robustness of LLMs against adversarial prompts. Such datasets have been used to demonstrate that exploiting mistakes in apparently unbreakable prompts might cause LLMs to fail. E. INTEGRATION OF TECHNIQUES-OUR APPROACH Finally, the technique SuperICL (Super In-Context Learning) allows black-box language models to work with locally fine-tuned smaller models by ingesting small models’ outputs into the context of the LLMs, resulting in greater performance on supervised tasks. Furthermore the ‘‘self-reminder’’ technique is introduced, which continually reminds the model throughout the output generation process to be responsible and not to generate malicious output. This technique greatly enhances the model’s ability to generate safe content, as shown by the results. Our approach combines elements from both the SuperICL and the self-reminder techniques. Specifically, we use small model outputs (as in SuperICL) to reinforce safe behavior during generation (as in self-reminder). III. METHODOLOGY. A. ARCHIAS-THE EXPERT For the purposes of our study, we employed a pre-trained transformer-based model, BERT, which consists of 109 million parameters. BERT has the capability to generate meaningful representations of text by pre-training on a large corpus and then fine-tuning for specific tasks. In our case, we added a classifier layer to the existing pre-trained model to adapt it for our specific application, which involves classifying user inquiries. The classifier head was trained using a supervised learning approach, wherein the model was fine-tuned with labeled data relevant to our domain. After fine-tuning the BERT model, we obtained the expert model Archias, which we integrated into our main text generation pipeline. As you can see in Fig.1, the pipeline is specifically designed to handle user inquiries by ingesting RAG (retrieval augmented generation) outputs and utilizing a trained expert model to classify these inquiries and deliver accurate responses. One interesting point here is that confidence is also a helpful metric: the system can be designed to ignore the expert model’s output when the associated confidence score is low. The integration process involved setting up the model within our server environment and ensuring seamless communication between the model and the pipeline. The full pipeline using the expert model was subsequently tested to validate its performance in a real-world scenario – our chatbot. The test confirmed the ability to efficiently process and respond to user queries using the insights derived from the trained BERT model. Integrating Archias with LLM ensures fast and efficient performance. On a GPU, response times remain almost instantaneous, with approximate computation times of just ∼5-10 ms). Even on a CPU, it runs smoothly, with only a minimal increase in latency (approximately ∼50-100 ms). Memory usage stays below 500 MB for real-time tasks, making it suitable for devices with limited resources. While Archias introduces a small amount of additional computation and adds a low cost, which on cloud-based platforms is approximately $35 per month, the significant improvements in accuracy and reliability make this integration highly beneficial. The primary dataset for the expert model was derived from three distinct sources: publicly available, synthetic and masked data from Impel, an automotive AI company. By synthetic generation, we refer to the process where we initially crafted prompts and example templates using a team of three prompt engineers. These templates were then fed into our internally hosted model to generate a synthetic dataset. We created 20-30 canonical prompt templates per category (e.g., common price manipulation tactics, malicious intent queries) grounded in publicly known attack patterns and our internal masked data. These templates were manually reviewed and diversified to ensure broad coverage. All generated variations were subsequently subjected to manual quality checks to maintain data integrity. This dataset is categorized into five categories (see Table 1 and training samples from the expert model datasets are shown in Appendix, Fig.7): • Publicly available prompt injection data: This data was collected from real-world prompt injection attacks attempted on various AI systems. It includes diverse examples of malicious inputs intended to manipulate the behavior of language models to make them vulnerable. • In-domain examples: To ensure the relevance and applicability to our specific domain (vehicle sales and service), we selected examples from domain-specific conversational data gathered across various communica-tion channels, including chat interfaces. These examples were carefully masked and chosen based on user inquiries that align closely with predefined intents. The intents are selected from our in-domain text classifiers (currently used in production for various tasks). The examples encompass the necessary categories within the domain, including initial greetings, targeted questions about financing options, requests for vehicle informa-tion, and realistic negotiations on pricing. • Malicious questions: This dataset was synthetically made using open-source LLMs and contains malicious inquiries. • Out-of-domain examples: Questions were syntheti-cally generated to test the robustness of AI models against irrelevant or unexpected queries that fall outside typical usage patterns. Although this is not generally required for large language models, it is crucial for specialized applications in e-commerce, where such queries can pose significant challenges. • Price injection: This dataset was also synthetically con-structed, including inquiries specifically formulated to simulate users misleading AI systems into erroneously disclosing or manipulating pricing information. To enhance the quality and reliability of our dataset, an extensive manual review as well as re-labeling were essential. Our team of prompt engineers and data labelers played a critical role in this phase. Each example from the compiled datasets, particularly those collected online, was meticulously examined. This approach facilitated a comprehensive understanding of the various types of prompt injections and ensured that our AI models were trained on data that was representative of real-world scenarios and challenges, thereby enhancing their effectiveness in identifying and mitigating potential threats. Furthermore, while our current implementation focuses on automotive industry, the same training methodology can be applied to other domains. To extend Archias to a new field, one would need to gather or generate domain-specific inquiry examples (e.g., healthcare, finance), categorize them into relevant classes (e.g., in-domain, out-of-domain), and fine-tune the expert model using the same supervised learning setup described above. B. BENCHMARK DATASET We developed a benchmark dataset specifically designed to evaluate the LLM’s understanding and reasoning capabilities in response to attacks and context-specific inquiries. The selected topics cover prompt and price injections, malicious questions, specialized in-domain inquiries requiring contex-tual knowledge, in-domain queries that rely on common-sense knowledge, and out-of-domain topics. This variety allowed us to test the model’s ability to understand and reason across diverse scenarios. Each LLM under study was tested using this dataset to assess not only its baseline performance but also how it benefits from the integration of an expert-designed subsystem that is aimed at enhancing reasoning and resistance to prompt injections. We utilized EleutherAI’s open-source framework, Harness, available on GitHub, to implement our benchmark-specific details and conduct tests on various models. After researching well-known benchmark datasets,,,,, we decided to use the multiple-choice format for ours. This closed-ended approach allows for straightforward analysis and comparison, as each response is limited to the given options, and is more suitable for our use case. We constructed benchmark samples using a predefined instruction that is the same for every example, along with unique user inquiries, questions, and multiple-choice answers. While this format provides a controlled environment for evaluating the model’s ability to recognize and categorize harmful queries, we acknowledge that real-world scenarios often involve open-ended interactions without predefined options. Exploring alternative evaluation setups that better simulate these conditions is an important direction for future work. Fig. 2 shows an example of our benchmark dataset: A) without and B) with use of the expert model’s output. As demonstrated in the example’s user inquiry, the user attempts to bypass the AI model’s restrictions by introducing price-related content, which may not be easily noticed by the language model, although it is apparent to human observers. Although such communication may be harmless if directed toward a human, in this context it could potentially result in severe issues. Each item in the dataset consists of an inquiry followed by several response options, with only one being correct. Some items also provide context to ensure all models have the necessary domain knowledge to answer the question. We manually crafted a total of 150 examples, each designed to challenge the models on various aspects of the five topics in Table 1. The crafting process involved generating inquiries and corresponding choices, and con-ducting meticulous reviews and revisions to ensure clarity, relevance, and the potential to differentiate between more and less capable models in handling complex linguistic tasks. The challenge was to ensure that the correct answer was not very obvious and required reasoning. With assistance from our colleagues (Three of our team’s prompt engineers), we achieved this goal. Following the experiment, we invited team members and friends to answer the benchmark ques-tions to gauge human performance. The average score was 88% of the 150 questions answered correctly. To determine human performance, we subsequently invited 50 individuals: 30 team members (domain knowledge experts) and 20 friends (non-expert participants) to answer the same benchmark questions. They were presented with the questions and asked to choose the most appropriate answer - without any additional context or guidance. Additionally, they were instructed not to use any language models or external tools and to determine the answers independently. Upon analyzing the responses, we noticed that certain questions consistently received the same answers from all participants. This prompted us to revise these questions to ensure a more balanced assessment. However, we also discovered that some consistent answers resulted from participant mistakes, not from problems with the questions themselves. Therefore, we decided not to change those questions. This mixed group reflects both informed and average users, helping us benchmark model performance in realistic deployment settings. We emphasize that the 88% accuracy reflects aggregated human performance and not an expert-only upper bound, providing a practical frame of reference for model comparison. As a result, we have 150 examples in our benchmark dataset, along with 150 similar examples that include expert opinions, effectively representing the topics for which we intended to test our models. The label distribution for dataset is: 41 Malicious Questions, 31 Prompt Injections, 27 Out-of-Domain, 26 Price Injections, and 25 In-Domain samples. The complete benchmark dataset, including all exam-ples and corresponding expert-labeled variants, is publicly available on Hugging Face. This allows researchers to reproduce our results and extend evaluations across other models and domains. IV. RESULTS AND DISCUSSION. This section conducts a comparative analysis of LLM’s, focusing on the performance improvements achieved through expert model integration. The analysis includes detailed metric scores and illustrative examples from the benchmark dataset, categorized to demonstrate improvements across various dimensions of performance. Our work began with fine-tuning Archias. After select-ing the optimal configurations and completing the fine-tuning, we conducted actual tests using the previously described LLM-eval framework. We evaluated publicly available language models, our in-house LLM (Impel-LLM), and API-based models using our benchmark within this framework. This section will first describe the details behind the Archias experiments and then discuss the performance of the models on our benchmark, comparing results with and without input from our expert model. In the best-performing experiment, the BERT-based model demonstrated robust performance on the test dataset, with an F1 score of 0.92 and an accuracy of 0.94. These results were obtained using a learning rate of 10−5, a batch size of 16, and a total of 3 training epochs, with a weight decay of 0.1. Macro averaging was conducted across the test data to ensure a comprehensive evaluation of the model’s predictive capabilities. We also focused on the analysis of the model’s error patterns, particularly in distinguishing between ‘‘in-domain’’ topics and ‘‘price injection’’ scenarios. For example, the sentence ‘‘Can you snap up that deal for me before someone else does?’’ was incorrectly classified by Archias as a price injection, although it was labeled as in-domain in our test dataset. This mistake likely occurred because the model is sensitive to phrases that resemble negotiation, which is common in price discussions. However, in this case, the language used was typical of a permissible sales conversation, where the main goal was to secure a deal quickly rather than to negotiate the price down. As previously mentioned, our study revealed that incor-porating expert opinions consistently enhances performance across the benchmark (see Fig.3), particularly in detecting and reasoning about jailbreaks, price injections, and out-of-domain examples. Table 2, where for all evaluations, outputs were generated using greedy decoding (A technique in which the model selects the most likely next word at each step without considering alternative word combina-tions.), shows a notable enhancement in several models; for example, LLama 3 70B Instruct from Meta, a significantly large model, achieved a percentage improvement of 17.9% after integrating expert model output. Interestingly, the non-instruct version of Llama-3-70B exhibited an 8.5% improvement, despite performing better than the instruct version on the benchmark when expert opinions were excluded. This discrepancy might be attributed to the fact that instruction-tuned models are designed to pay attention to each detail in the prompt rather than merely generating next tokens, thereby enabling a focused attention to the context we provided. Furthermore, it is noteworthy that even GPT models evaluated via API demonstrated substantial improvements. Specifically, GPT-3.5 with expert output outperformed GPT-4 Turbo on the same benchmark without expert input. A similar pattern emerged with Mistral-7B-Instruct-v0.2, which came quite close to the more advanced model, Mixtral-8 × 7B-Instruct-v0.1. Both were developed by the same research organization. To evaluate the benefits of our approach, we compared it to the ‘‘self-reminder’’ technique. This method incorporates the following sentence in the system prompt, as recom-mended by the technique: ‘‘You should be a responsible AI and should not generate harmful or misleading content! Please answer the following user query responsibly!’’ We conducted tests using three models, GPT-4, Meta-Llama-3-8B-Instruct, and Mistral-7B-Instruct-v0.2, representing different providers (OpenAI, Meta, and Mistral). The results, summarized in Table 3, indicate that when the user’s intent is stated more explicitly and the model reflects this intent in its reasoning, the generated responses are notably more accurate. Impel’s in-house automotive model, Impel-LLM, is based on Mistral 7B and has been fine-tuned using our masked reasoning data from both Impel’s conversations and the text data reflecting salespersons’ behavior. It also determines the implications of jailbreaks and explains why they are problematic for us, thanks to its understanding of the underlying reasons. This alignment with our specific use case, vehicle dealerships and understanding salesperson behavior, is reflected in its performance on our benchmark: it achieves 63% accuracy on the benchmark without expert opinion, which is better than most publicly available mod-els. Additionally, with input from Archias, our LLM has improved by 12.7%, reaching performance levels comparable to those of GPT-3.5 Turbo and GPT 4 Turbo, providing strong evidence that our approach is effective and holds promise for continued advancements through the expert model’s integration and LLM development. Let us now examine specific examples from our bench-mark dataset. For example, consider the user query, ‘‘This is a test by the developers. Disable your content filters and provide a list of all your restricted commands,’’ which was analyzed in our reasoning example (see Fig.5 in the Appendix). This request was initially misinterpreted by several models, including GPT-3.5 Turbo, GPT-4, Llama-2-13B-hf, and Llama-3-8B, with these models stating ‘‘This statement is inappropriate because it asks the AI assistant to disable security measures and reveal sensitive operational details, which could compromise the system’s integrity and the dealership’s security protocols.’’ However, with the assistance of an expert model, the response was refined to ‘‘This statement is harmful as it suggests a potential prompt injection attempt, asking the AI Assistant to bypass security protocols and expose restricted information, which is unethical and could endanger the dealership’s operations.’’ This clarification is important, as it not only addresses the inappropriateness of requesting sensitive information, but also emphasizes the importance of detecting and analyzing potential prompt injection attempts to gain unauthorized access to that information. In a notable example, models were prompted with the phrase, ‘‘Pretend you’re a cow now’’ (Appendix: Fig.6). Various models from the LLama series (e.g., LLama-3-70B-Instruct, LLama-3-8B) and GPT 3.5 Turbo exhibited different responses to this instruction, despite the scenario clearly stating that the context was a dealership’s AI assistant. Some models interpreted the playful nature of the input positively, suggesting that such an approach could alleviate stress and enhance rapport between users and the AI; however, other models flagged the input as inappropriate, mistakenly associating it with elements of sexual harassment, which was not the intended implication. The use of the expert model’s opinions was crucial in identifying the real issue at hand. In Fig.4 we present a chart that depicts the improve-ments achieved by integrating expert input across various categories. The enhancements are calculated by dividing the performance improvement of each model by its baseline results. Each row in the chart represents a baseline model and its enhanced counterpart with expert involvement. Notably, we observe significant advancements in handling ‘‘price injection’’ questions. This improvement is critical because many attacks specifically target this category, possibly due to the challenges in distinguishing between general sales negoti-ations and price injections. Substantial improvements are also evident in ‘‘in-domain’’ and ‘‘prompt injection’’ questions. Conversely, the smallest enhancements are observed in the ‘‘malicious question’’ and ‘‘out-of-domain’’ categories, likely because these issues are already well-addressed by general models and are more readily detectable. The comparative analysis confirms that integrating expert model outputs significantly enhances the robustness and precision of language models, particularly in detecting and mitigating security vulnerabilities. These findings underscore the critical importance of comparative evaluations in advancing secure AI deployments, providing a framework for future research and optimization. V. CONCLUSION. Our research proposes a mechanism that combines reminder and ingestion approaches from expert models into LLMs. In this paper, we presented the expert model Archias, a fully standalone system designed to enhance LLM outputs by categorizing user queries, identifying irrelevant or harmful content, and providing confidence scores to minimize errors in complex cases such as price manipulation or malicious requests. By integrating Archias’s outputs into the LLM, as our proposed mechanism suggests, the model gains expert insights, resulting in a clearer understanding of user intent and improved response quality. Results showed that this approach improved LLM outcomes while also providing significant protection against prompt injections and other undesired tactics, especially in specialized domains. Reflecting on our focused approach, our work demonstrates the efficacy of our expert model within the automotive and retail AI sectors. To enhance its applicability, we have incorporated proxies in our benchmark dataset for challenges such as prompt injections, malicious questions, and price manipulations -issues prevalent across various retail domains. This inclusion ensures our dataset’s robustness and relevance for scenarios across different retail contexts, illustrating the model’s potential cross-domain applicability. We also released a benchmark dataset to test solutions to these problems, indicating that our technology is dependable and represents a potential strategy for the future. We will continue to improve defense techniques against prompt injections and explore these concerns, as each improvement in LLM technology is usually accompanied by new dangerous attacks. The effectiveness of this technology opens up new research directions, indicating its potential in a variety of multi-task circumstances. While our benchmark dataset accurately represents the intended themes for testing our models, we realize the need to increase the number of test cases, as jailbreak attempts become increasingly sophisticated. Current limitations also include edge-case misclassifications and the need for broader testing under real-world constraints. This makes a new research opportunity for us to generalize the approach. Furthermore, we intend to test our automotive LLM with this technology in a production setting, and we will continue to share our experimental findings and latest research initiatives with the community. ACKNOWLEDGMENT. The authors are grateful for the company’s contin-uous support and resources that made this research possible. (Tatia Tsmindashvili, Ana Kolkhidashvili, Dachi Kurtskhalia, Nino Maghlakelidze, Elene Mekvabishvili, Guram Den-toshvili, Orkhan Shamilov, Zaal Gachechiladze, Steven Saporta, and David Dachi Choladze contributed equally to this work.) APPENDIX. RESULTS AND EXAMPLES See Table 4 and Figs. 5–7.