mlsanityData to 14 Oct 2026

CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention

arXiv 2509.06982 ↗First posted 1 Sep 2025cs.LG cs.AI cs.CLcited by 6

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

As large language models (LLMs) are increasingly deployed in real-world applications, ensuring the safety of their outputs during decoding has become a critical challenge. However, existing decoding-time interventions, such as Contrastive Decoding, often force a severe trade-off between safety and response quality. In this work, we propose CARE, a novel framework for decoding-time safety alignment that integrates three key components: (1) a guard model for real-time safety monitoring, enabling detection of potentially unsafe content; (2) a rollback mechanism with a token buffer to correct unsafe outputs efficiently at an earlier stage without disrupting the user experience; and (3) a novel introspection-based intervention strategy, where the model generates self-reflective critiques of its previous outputs and incorporates these reflections into the context to guide subsequent decoding steps. The framework achieves a superior safety-quality trade-off by using its guard model for precise interventions, its rollback mechanism for timely corrections, and our novel introspection method for effective self-correction. Experimental results demonstrate that our framework achieves a superior balance of safety, quality, and efficiency, attaining a low harmful response rate and minimal disruption to the user experience while maintaining high response quality.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 31 of its 40 references that are in the map. First posted on arXiv 1 Sep 2025.

Builds on

31 of 40 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  4. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset10 Jul

Other references · 27

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  4. 2024Qwen2.5 Technical Reportcited by 4,942
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  9. 2022Contrastive Decoding: Open-ended Text Generation as Optimizationcited by 609
  10. 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 500
  11. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  12. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
15 more
  1. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
  2. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  3. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
  4. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  5. 2024ARGS: Alignment as Reward-Guided Searchcited by 103
  6. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
  7. 2025Effectively Controlling Reasoning Models through Thinking Interventioncited by 65
  8. 2022In conversation with Artificial Intelligence: aligning language models with human valuescited by 62
  9. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
  10. 2024ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decodingcited by 32
  11. 2025Think Before Refusal : Triggering Safety Reflection in LLMs to Mitigate False Refusal Behaviorcited by 12
  12. 2024Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Modelscited by 7
  13. 2025Safeguarding Large Language Models in Real-time with Tunable Safety-Performance Trade-offscited by 5
  14. 2025Attention Slipping: A Mechanistic Understanding of Jailbreak Attacks and Defenses in LLMscited by 5
  15. 2024A Framework for Real-time Safeguarding the Text Generation of Large Language Modelcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 5.

6 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2024SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Models
  2. 2024Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements
  3. 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patching
  4. 2023All Languages Matter: On the Multilingual Safety of Large Language Models
  5. 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
  6. 2024LongSafety: Enhance Safety for Long-Context LLMs
  7. 2026Multilingual Safety Signals Are Multi-Layered: Filtering Safety-Degrading Data for Safer LLMs
  8. 2025Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary