ShieldHead: Decoding-time Safeguard for Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Recent advances in LLM-based moderation methods have demonstrated remarkable promise in identifying safety risks associated with both inputs and outputs in human-AI interactions. |
| Approach: | They propose to learn a classification head on the last-layer hidden states of a dialogue model and use it to detect harmful content. |
| Outcome: | The proposed framework is 300 faster (**1ms**) than previous LLM-based moderation models with 99% less parameters than LlamaGuard. |
Similar Papers
Root Defense Strategies: Ensuring Safety of LLM at the Decoding Level (2025.acl-long)
Copied to clipboard
| Challenge: | Existing methods to detect harmful outputs from prefill-level lacks utilization of the model’s decoding outputs, leading to relatively lower effectiveness and robustness. |
| Approach: | They propose a robust decoding mechanism that corrects harmful queries directly rather than rejecting them outright. |
| Outcome: | The proposed model improves model security without compromising reasoning speed. |
SLM as Guardian: Pioneering AI Safety with Small Language Model (2024.emnlp-industry)
Copied to clipboard
Ohjoon Kwon, Donghyeon Jeon, Nayoung Choi, Gyu-Hwung Cho, Hwiyeol Jo, Changbong Kim, Hyunwoo Lee, Inho Kang, Sun Kim, Taiwoo Park
| Challenge: | Prior safety research on large language models focused on aligning them to safety requirements, but internalizing such safeguard features into larger models brought challenges of higher training cost and unintended degradation of helpfulness. |
| Approach: | They propose a multi-task learning mechanism that integrates harmful query detection and safeguard response into a single model. |
| Outcome: | The proposed approach outperforms the publicly available LLMs in harmful query detection and safeguard response generation. |
SecDecoding: Steerable Decoding for Safer LLM Generation (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing decoding-time defense methods suffer from limited generalization, high computational overhead, or significant utility degradation. |
| Approach: | They propose a decoding-time defense framework that leverages a pair of small contrastive models to estimate token-level safety signals by measuring divergence in their output distributions. |
| Outcome: | The proposed framework achieves near-zero attack success rates against a wide spectrum of advanced jailbreak attacks while maintaining the model’s helpfulness with minimal degradation. |
MULTIGUARD: An Efficient Approach for AI Safety Moderation Across Languages and Modalities (2025.emnlp-main)
Copied to clipboard
Sahil Verma, Keegan Hines, Jeff Bilmes, Charlotte Siska, Luke Zettlemoyer, Hila Gonen, Chandan Singh
| Challenge: | Existing approaches to detect harmful queries to large language models are fallible and vulnerable to attacks that exploit mismatched generalization of model capabilities. |
| Approach: | They propose an approach to detect harmful queries to large language models (LLMs) OMNIGUARD identifies internal representations of an LLM/MLLM that are aligned across languages or modalities and builds a language-agnostic or modality-adic classifier for detecting harmful prompts. |
| Outcome: | OMNIGUARD improves harmful prompt classification accuracy by 11.57% over the strongest baseline in a multilingual setting, by 20.44% for image-based prompts, and sets a new SOTA for audio-based ones. |
Gamma-Guard: Lightweight Residual Adapters for Robust Guardrails in Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) are widely deployed as zero-shot evaluators for answer grading, content moderation, and document ranking. |
| Approach: | They propose a system that trains LLMs with adapters to denoise embeddings and refocus attention. |
| Outcome: | The proposed model lifts adversarial accuracy from 5% to 95% a 90 percentage-point gain while reducing clean-data accuracy by just 8 percentage points. |
ShieldLM: Empowering LLMs as Aligned, Customizable and Explainable Safety Detectors (2024.findings-emnlp)
Copied to clipboard
Zhexin Zhang, Yida Lu, Jingyuan Ma, Di Zhang, Rui Li, Pei Ke, Hao Sun, Lei Sha, Zhifang Sui, Hongning Wang, Minlie Huang
| Challenge: | Existing tools for detecting safety issues in LLMs are expensive and inefficient. |
| Approach: | They propose an LLM-based safety detector which annotates the safety of queries and provides explanations for its decisions. |
| Outcome: | The proposed detector outperforms baselines on four sets of query-response pairs and is effective as a safety evaluator for advanced LLMs. |
LS-Guard: Adaptive Safety Guardrails Tailored to Individual LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing security guardrails built from static datasets ignore each model’s unique safety profile and often force trade-offs between safety and utility. |
| Approach: | They propose a framework for learning model-specific guardrails tailored to each LLM’s vulnerabilities. |
| Outcome: | The proposed framework significantly outperforms baseline guardrails on multiple real-world LLMs, achieving superior robustness, adaptability, and generalization. |
HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router (2026.acl-long)
Copied to clipboard
| Challenge: | Current alignment approaches rely on refusal alignment to avoid harmful content . large language models are often overly cautious or overlook subtle harmful content. |
| Approach: | They propose a framework for fine-grained safe generation in Large Language Models that enables real-time, token-level harmfulness detection and redaction without loss in capability. |
| Outcome: | The proposed framework achieves over 90% in F1 score for detecting and redacting harmful content while preserving overall utility and informativeness of the model’s responses. |
Diversity Helps Jailbreak Large Language Models (2025.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking large language models rely on laborious human engineering and whitebox access to model internals. |
| Approach: | They propose a method that instructs large language models to deviate from prior context and generate harmful outputs by instructing them to deviat from previous attacks. |
| Outcome: | The proposed method achieves a 62.83% higher success rate in compromising ten leading chatbots, while using only 12.9% of the queries. |
LionGuard: A Contextualized Moderation Classifier to Tackle Localized Unsafe Content (2025.coling-industry)
Copied to clipboard
| Challenge: | Existing moderation classes that perform well on English may not perform well in Singlish. |
| Approach: | They propose a Singapore-contextualized moderation classifier that can guard against unsafe LLM usage. |
| Outcome: | The proposed class outperforms existing modes on Singlish data by 14% and up to 51%. |