Speculative Safety-Aware Decoding

Speculative Safety-Aware Decoding (SSD) is a lightweight decoding-time defense mechanism designed to strengthen Large Language Models (LLMs) against jailbreak attacks.

Despite extensive efforts to align LLMs with human values, they remain vulnerable to sophisticated adversarial attacks. Furthermore, fine-tuning large models to address these vulnerabilities is resource-intensive and often degrades the model’s performance on general tasks.

SSD introduces a novel approach to address these challenges:

1. Training-Free for Large Models: The method assumes the existence of a small “expert” model that possesses deep safety alignment. It leverages this small model to guide the generation of the large model, removing the need to fine-tune the large model’s parameters.
2. Speculative Sampling: SSD utilizes the small expert model as a draft model within a speculative sampling framework. This design not only injects the desired safety properties but also accelerates inference time, distinguishing it from other defense methods that typically incur computational overhead.
3. Dynamic Decoding Strategy: The approach utilizes the “Match Ratio” between the small and large models to quantify jailbreak risks dynamically. It adaptively switches between Intersection (to prioritize utility) and Union (to prioritize safety) decoding schemes based on the agreement rate between the models.

Results: Experimental results show that SSD successfully equips large models (such as Llama2 and Vicuna) with the deep safety alignment property, offering robust defense against various jailbreak attacks. Importantly, it allows the model to remain helpful for benign queries (evaluated on GSM8K and Just-Eval) and achieves faster inference speeds compared to standard decoding.

Recommended citation: Wang, Xuekang, Shengyu Zhu, and Xueqi Cheng. (2025). "Speculative Safety-Aware Decoding." In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing (EMNLP).
Download Paper | Download Bibtex