mlsanityData to 7 Oct 2026

Speculative Safety-Aware Decoding

arXiv 2508.17739 ↗First posted 25 Aug 2025cs.LG cs.AIcited by 7

On the map: Efficient LLM inference and serving → Speculative decoding

also in 1 more
Abstract (arXiv)

Despite extensive efforts to align Large Language Models (LLMs) with human values and safety rules, jailbreak attacks that exploit certain vulnerabilities continuously emerge, highlighting the need to strengthen existing LLMs with additional safety properties to defend against these attacks. However, tuning large models has become increasingly resource intensive and may have difficulty ensuring consistent performance. We introduce Speculative Safety-Aware Decoding (SSD), a lightweight decoding-time approach that equips LLMs with the desired safety property while accelerating inference. We assume that there exists a small language model that possesses this desired property. SSD integrates speculative sampling during decoding and leverages the match ratio between the small and composite models to quantify jailbreak risks. This enables SSD to dynamically switch between decoding schemes to prioritize utility or safety, to handle the challenge of different model capacities. The output token is then sampled from a new distribution that combines the distributions of the original and the small models. Experimental results show that SSD successfully equips the large model with the desired safety property, and also allows the model to remain helpful to benign queries. Furthermore, SSD accelerates the inference time, thanks to the speculative sampling design.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Speculative decoding, one of 12 directions in Efficient LLM inference and serving. Builds on 36 of its 46 references that are in the map. First posted on arXiv 25 Aug 2025.

Builds on

36 of 46 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024EAGLE: Speculative Sampling Requires Rethinking Feature Uncertainty26 Jan
  2. 2023SpecInfer: Accelerating Generative Large Language Model Serving with Tree-based Speculative Inference and Verification16 May
  3. 2023Accelerating Large Language Model Decoding with Speculative Sampling2 Feb
  4. 2022Fast Inference from Transformers via Speculative Decoding30 Nov

Other references · 32

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  3. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  6. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  8. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  9. 2023LIMA: Less Is More for Alignmentcited by 1,080
  10. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  11. 2024TinyLlama: An Open-Source Small Language Modelcited by 604
  12. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
20 more
  1. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  2. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  3. 2018Scalable agent alignment via reward modeling: a research directioncited by 438
  4. 2021DExperts: Decoding-Time Controlled Text Generation with Experts and Anti-Expertscited by 434
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  6. 2023Detecting Language Model Attacks with Perplexitycited by 411
  7. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  8. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
  9. 2018Blockwise Parallel Decoding for Deep Autoregressive Modelscited by 318
  10. 2023The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learningcited by 251
  11. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 233
  12. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
  13. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
  14. 2021Alignment of Language Agentscited by 167
  15. 2023Reward-Augmented Decoding: Efficient Controlled Text Generation With a Unidirectional Reward Modelcited by 79
  16. 2022Critic-Guided Decoding for Controlled Text Generationcited by 45
  17. 2023PREADD: Prefix-Adaptive Decoding for Controlled Text Generationcited by 29
  18. 2024PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetitioncited by 29
  19. 2025SafeMERGE: Preserving Safety Alignment in Fine-Tuned Large Language Models via Selective Layer-Wise Model Mergingcited by 25
  20. 2024SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Modelscited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 7.

7 papers.

  1. 2026A Guide to Large Language Models in Modeling and Simulation: From Core Techniques to Critical Challengescited by 2
  2. 2026Adversarial Prompts for Acceptance Collapse in Speculative Decodingcited by 1
  3. 2026Light Alignment Improves LLM Safety via Model Self-Reflection with a Single Neuroncited by 0
  4. 2026Speculative Decoding at Temperature Zero: A Scoped Safety-Invariance Screen with a 48,072-Sample Expansioncited by 0
  5. 2026Robust Critics: Defending LLMs Against Multi-Turn Attackscited by 0
  6. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  7. 2026Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Secure Speculative Decoding for Large Language Models
  2. 2026SafeSpec: Fast and Safe LLM via Dynamic Reflective Sampling
  3. 2024Root Defence Strategies: Ensuring Safety of LLM at the Decoding Level
  4. 2024SSSD: Simply-Scalable Speculative Decoding
  5. 2024Decoding Speculative Decoding
  6. 2024Probing the Safety Response Boundary of Large Language Models via Unsafe Decoding Path Generation
  7. 2025Speculative Decoding: Performance or Illusion?
  8. 2024Unlocking Efficiency in Large Language Model Inference: A Comprehensive Survey of Speculative Decoding