Perplexity Filter Defense

Why it matters

Perplexity filters detect token-optimized attacks. Understanding shapes defense.

The architecture

Score input perplexity with small LM.

Compare to threshold.

Reject high scores.

How it works end to end

Small language model for score.

Threshold tuned on benign.

Jain et al. baseline defense.