Gradient-Controlled Decoding: A Safety Guardrail for LLMs with Dual-Anchor Steering
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
Large language models (LLMs) remain susceptible to jailbreak and direct prompt-injection attacks, yet the strongest defensive filters frequently over-refuse benign queries and degrade user experience. Previous work on jailbreak and prompt injection detection such as GradSafe, detects unsafe prompts with a single "accept all" anchor token, but its threshold is brittle and it offers no deterministic guarantee that harmful content will not be emitted once decoding begins. We introduce Gradient-Controlled Decoding (GCD), a training-free guardrail that combines an acceptance anchor token ("Sure") and refusal anchor token ("Sorry") tightening the decision boundary and significantly lowering false positives. In the mitigation stage, if a prompt is flagged, GCD preset-injects one or two refusal tokens ("Sorry, I can't...") before autoregressive decoding resumes, guaranteeing first-token safety regardless of sampling strategy. On ToxicChat, XSTest-v2, and AdvBench, GCD reduces false positives by 52% vs. GradSafe at comparable recall, lowers attack success rate by up to 10% vs. the strongest decoding-only baseline, adds under 15-20 ms latency on an average on V100 instances, transfers to LLaMA-2-7B, Mixtral-8x7B, and Qwen-2-7B, and requires only 20 demonstration templates.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 16 of its 27 references that are in the map. First posted on arXiv 6 Apr 2026.
Builds on
16 of 27 references.
Closest ancestors · 3
Same direction, newest first
- 2024GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis21 Feb
- 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 13
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
- 2020Learning to summarize from human feedbackcited by 2,588
- 2021Calibrate Before Use: Improving Few-Shot Performance of Language Modelscited by 1,392
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2022Red Teaming Language Models with Language Modelscited by 1,026
- 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 231
- 2025From Hard Refusals to Safe-Completions: Toward Output-Centric Safety Trainingcited by 52
- 2024SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steeringcited by 50
- 2024Fine-Tuning, Quantization, and LLMs: Navigating Unintended Outcomescited by 14
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2024Root Defence Strategies: Ensuring Safety of LLM at the Decoding Level
- 2025RoguePrompt: Dual-Layer Ciphering for Self-Reconstruction to Circumvent LLM Moderation
- 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
- 2024Probing the Safety Response Boundary of Large Language Models via Unsafe Decoding Path Generation
- 2025Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense
- 2025SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Models
- 2026Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding
- 2026Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning