CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
As large language models (LLMs) are increasingly deployed in real-world applications, ensuring the safety of their outputs during decoding has become a critical challenge. However, existing decoding-time interventions, such as Contrastive Decoding, often force a severe trade-off between safety and response quality. In this work, we propose CARE, a novel framework for decoding-time safety alignment that integrates three key components: (1) a guard model for real-time safety monitoring, enabling detection of potentially unsafe content; (2) a rollback mechanism with a token buffer to correct unsafe outputs efficiently at an earlier stage without disrupting the user experience; and (3) a novel introspection-based intervention strategy, where the model generates self-reflective critiques of its previous outputs and incorporates these reflections into the context to guide subsequent decoding steps. The framework achieves a superior safety-quality trade-off by using its guard model for precise interventions, its rollback mechanism for timely corrections, and our novel introspection method for effective self-correction. Experimental results demonstrate that our framework achieves a superior balance of safety, quality, and efficiency, attaining a low harmful response rate and minimal disruption to the user experience while maintaining high response quality.
Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 31 of its 40 references that are in the map. First posted on arXiv 1 Sep 2025.
Builds on
31 of 40 references.
Closest ancestors · 4
Same direction, newest first
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
- 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset10 Jul
Other references · 27
- 2023GPT-4 Technical Reportcited by 18,396
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
- 2022Contrastive Decoding: Open-ended Text Generation as Optimizationcited by 609
- 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 500
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
15 more
- 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
- 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
- 2024ARGS: Alignment as Reward-Guided Searchcited by 103
- 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
- 2025Effectively Controlling Reasoning Models through Thinking Interventioncited by 65
- 2022In conversation with Artificial Intelligence: aligning language models with human valuescited by 62
- 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
- 2024ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decodingcited by 32
- 2025Think Before Refusal : Triggering Safety Reflection in LLMs to Mitigate False Refusal Behaviorcited by 12
- 2024Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Modelscited by 7
- 2025Safeguarding Large Language Models in Real-time with Tunable Safety-Performance Trade-offscited by 5
- 2025Attention Slipping: A Mechanistic Understanding of Jailbreak Attacks and Defenses in LLMscited by 5
- 2024A Framework for Real-time Safeguarding the Text Generation of Large Language Modelcited by 2
Built on by
Citing papers per year: 2025: 1; 2026: 5.
6 papers.
- 2025Qwen3Guard Technical Reportcited by 155
- 2026What Matters For Safety Alignment?cited by 7
- 2026TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defensecited by 4
- 2026Light Alignment Improves LLM Safety via Model Self-Reflection with a Single Neuroncited by 0
- 2026Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failurescited by 0
- 2026Separating Prompt Harmfulness from Interaction Safety via Partial Generationcited by 0
- 2026Separating Prompt Harmfulness from Interaction Safety via Partial Generation12 Oct 2026
- 2026Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failures28 May 2026
- 2026TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense9 Apr 2026
- 2026Light Alignment Improves LLM Safety via Model Self-Reflection with a Single Neuron2 Feb 2026
- 2026What Matters For Safety Alignment?7 Jan 2026
- 2025Qwen3Guard Technical Report16 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2024SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Models
- 2024Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements
- 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patching
- 2023All Languages Matter: On the Multilingual Safety of Large Language Models
- 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
- 2024LongSafety: Enhance Safety for Long-Context LLMs
- 2026Multilingual Safety Signals Are Multi-Layered: Filtering Safety-Degrading Data for Safer LLMs
- 2025Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary