This work proposes LLMSafeGuard, a lightweight real-time framework that integrates an external validator into decoding, rejecting unsafe outputs while allowing valid ones, and introduces a similarity-based validation approach, simplifying safety constraint validation and eliminating the need for external control model training.
Abstract
Large Language Models (LLMs) have significantly advanced natural language processing (NLP) tasks, but also pose ethical and societal risks due to their propensity to generate harmful content. Existing methods have limitations, including the need for training specific control models and proactive intervention during text generation, which leads to quality degradation and increased computational overhead. To mitigate those limitations, we propose LLMSafeGuard, a lightweight real-time framework that integrates an external validator into decoding, rejecting unsafe outputs while allowing valid ones. We introduce a similarity-based validation approach, simplifying safety constraint validation and eliminating the need for external control model training. Additionally, LLMSafeGuard employs a context-wise timing selection strategy, which allows LLMSafeGuard to intervene in LLMs only when necessary. We evaluate LLMSafeGuard on three tasks: detoxification, copyright safeguarding, and jailbreak attack defending across six models, and the results demonstrate its superiority over SOTA baselines on all tasks. For instance, in detoxification, LLMSafeGuard reduces toxic output by at least 38.6% while preserving linguistic quality. For Jailbreak attack defending, LLMSafeGuard reduces the harmful score of the response LLMs under jailbreak attack at least by 11.4% compared to the best baseline. Additionally, its context-wise timing selection achieves a speedup of 1.7X over per-step validation, without compromising effectiveness.
Comprehensive experiments demonstrate that TextCloak consistently impairs unauthorized fine-tuning while maintaining text utility for legitimate use, highlighting its broad applicability as a practical defense against unauthorized LLM exploitation.
Chengshuai Zhao, Pingchuan Ma, Dawei Li et al.· 0 citations
The findings suggest that activation steering may provide a practical, low- cost mechanism for extending English-derived safety signals to other languages, and introduce a multilingual translation-and-evaluation pipeline to facilitate future work on cross-lingual safety interventions.
Emma V. Stein, Dominik Meier, Terry Ruas et al.· 0 citations
It is shown that English-only safety evaluations are insufficient; they require accounting for script family, perturbation type, and per-language alignment coverage, and a geometric mechanistic analysis of refusal failure across language tiers.
The proposed Recursive Self-Correction approach raises model performance from a Political Neutrality Likert scale baseline of 2.14 to 4.56, averaged across all models, demonstrating effective inference-time mitigation of political bias in LLM-generated summaries.
Tejaswi V. Panchagnula, Bruce Coburn, Bryce J. Dietrich et al.· 0 citations
By thoroughly unifying 36 English hate speech datasets spanning multiple labeling schemes, this work fine-tune a generalist LLM, based on Qwen3 (Qwen Team, 2025), specifically for hate speech mitigation, demonstrating not only state-of-the-art performance on in-domain benchmarks but also substantial improvements in cross-domain and cross-lingual generalization--areas where encoder-based specialist classifiers often struggle.
Lukas Edman, Daryna Dementieva, Alexander Fraser· 0 citations
Recent jailbreak attacks demonstrate that large language models (LLMs) can be manipulated to generate harmful outputs through adversarial prompts even after robust alignment. However, prevailing methods typically focus on forcing a desired response at the output layer—a surface-level strategy that is brittle and often fails to bypass the more fundamental safety checks embedded within the model’s internal mechanisms. In contrast, we propose intermediate consistency greedy coordinate gradient (IC-GCG), an approach that extends the GCG framework to explicitly target the model’s internal alignment mechanism. Our method forces a harmful prompt’s hidden representations to mimic those of a semantically related benign counterpart within critical middle layers. By adapting a greedy coordinate optimization strategy to craft an adversarial suffix that minimizes this representational distance, IC-GCG creates “semantic camouflag” that bypasses the model’s internal safety judgments. Experiments on several aligned LLMs indicate that IC-GCG substantially outperforms state-of-the-art baselines, increasing the average attack success rate to 94.3% and proving particularly effective against strongly aligned models such as LLAMA2-7B-CHAT, where it boosts success by over 56 percentage points. Furthermore, the resulting suffixes display superior transferability to other models. Ablation studies confirm that this high efficacy critically depends on a strong semantic link between the harmful and benign prompt pair, empirically validating that the integrity of intermediate representations is a crucial vulnerability and highlighting the need for a new class of defenses that operate directly on the model’s internal states.
Zichu Ren, Donghai Zhu, Haibo Hong et al.· IEEE Internet of Things Jour...· 0 citations