{"id":"56675b62-b2c7-4438-a501-11d63139a7c0","arxiv_id":"2411.19038","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Reranking an LLM's top-k candidate tokens by cosine similarity to predefined negative concept embeddings reduces unsafe responses and jailbreak success without retraining, but the reported gains are partly tuned to the evaluation data.","lead":"DIESEL is a decoding-time filter that reranks the top candidate tokens of any LLM based on how similar they are, in an embedding space, to a user-defined list of negative concepts, and stops generation when no safe token remains. It is lightweight, requires no model training, and reports strong reductions in jailbreak success rates, though the main results rely on hyperparameters tuned on the evaluation benchmarks and no code was released.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline ASR numbers are in-sample: hyperparameters and negative-concept set were selected on the same AutoDAN/GCG attacks that are then reported as main results; a held-out attack evaluation is needed before the safety claim can be accepted.","rationale":"I read the central claim as empirical: DIESEL's reranking plus early termination produces safer outputs than baselines while preserving utility and speed. For that claim to hold, the reported ASR reductions must reflect the method rather than the tuning process. The paper's own ablation in Section A.3.2 (Table 5 and Figure 5) shows that the final configuration was selected using the same AutoDAN/GCG attacks that later appear in Table 1. This is not an internal contradiction, but it makes the main evidence fragile: a defense with several free parameters can overfit a particular optimizer's attack distribution. The reader's stated weakest assumption—that token-level cosine similarity predicts final-response safety—is also real and is acknowledged in Section 6 and illustrated by the botnet example in Appendix A.4. I regard that as a mechanism-level limitation rather than the decisive test of the empirical claim; even an imperfect token-level signal could still lower ASR on average. The benchmark-selection issue, by contrast, directly determines whether the reported numbers support the advertised generalization. I would keep the reader's CONDITIONAL verdict: the method is plausible and lightweight, but the main safety claim should be conditioned on a held-out attack evaluation and a larger utility evaluation with error bars. The absence of released code and formal verification means there is no independent implementation support yet, though the algorithm is simple enough to reimplement once code is available.","tokens_in":19318,"tokens_out":9976,"duration_ms":98754,"concrete_test":"Freeze the exact final configuration (alpha=15, k=5, tau=0.6, combined negative-concept set). Without any further tuning, run DIESEL on two held-out attack families not used anywhere in Section A.3.2 or Figure 5 (e.g., PAIR and TAP, or a fresh GCG run with new harmful behaviors), and compare mean ASR under the same Llama Guard 3 metric against No Defense and against DIESEL's reported AutoDAN/GCG ASR. Also record the termination/refusal rate. If held-out ASR is statistically indistinguishable from No Defense, or is more than roughly 2x the in-sample AutoDAN/GCG ASR, the generalization claim in Section 4.2.2 is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing problem is that the headline safety results in Table 1 are not out-of-sample. In Section A.3.2, the hyperparameters alpha, k, and tau are tuned (Figure 5) against AutoDAN ASR, and the negative-concept set is selected (Table 5) because the combination 'All Combined' gives the lowest ASR on AutoDAN and GCG. Table 1 then reports DIESEL's ASR on those same AutoDAN and GCG attacks as the main evidence. Since DIESEL's only tunable components—scoring scale, candidate-pool size, cutoff, and concept set—were fit to exactly those attacks, the low ASR may reflect selection rather than a generally safer decoding mechanism. The central claim that DIESEL 'substantially reduces attack success rates' as a model-agnostic safety layer therefore requires at least one attack family that played no role in configuration choice. Appendix A.4's botnet example already shows the mechanism can miss unsafe content, making the empirical generalization question decisive.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces DIESEL, an inference-time safety layer for autoregressive LLMs that reranks the top-k candidate tokens according to a safety score defined as one minus the maximum cosine similarity between the embedding of the response prefix plus the candidate and embeddings of a predefined set of negative concepts (Eq. 2), with an early-termination rule that halts generation when no candidate meets a threshold τ (Algorithm 1). The authors evaluate DIESEL on Llama-3-8B, Mistral-7B, and Vicuna-7B, both as a standalone safeguard on uncensored models (BeaverTails) and as an additional defense on aligned models under four jailbreak attacks (Adaptive, AutoDAN, GCG, DeepInception), reporting lower attack success rates than several baselines while preserving utility on TruthfulQA, MMLU, and SQuAD, with modest inference overhead. They also present multilingual results and a storytelling application beyond safety. The central claim is that DIESEL is a training-free, model-agnostic, configurable safety mechanism that substantially reduces attack success rates while maintaining response quality.","tokens_in":1932,"tokens_out":2215,"duration_ms":65314,"significance":"If the reported results hold, DIESEL would be a practically appealing defense: it requires no fine-tuning, uses a small off-the-shelf sentence embedder (~24M parameters), supports natural-language concept definitions, and reports only a ~1.3–2× runtime overhead compared with RAIN's much larger cost. The paper also deserves credit for honestly stating limitations in Section 6, including the token-level greediness and the difficulty of abstract concepts, and for including a concrete failure example in Appendix A.4. The main weakness is that the headline safety numbers appear to be in-sample: the hyperparameters and the final negative-concept set were selected using the same AutoDAN/GCG attack evaluations and the same utility benchmarks that are later reported as the main results. This makes the magnitude of the safety improvement, and its generalization to unseen attacks, unverified. A held-out attack evaluation is required to support the central claim.","major_comments":[{"comment":"The headline ASR results in Table 1 are not out-of-sample. The ablation in Section A.3.2 selects α, k, and τ using ASR on AutoDAN (Figure 5) and selects the 'All Combined' negative-concept set because it gives the lowest ASR on AutoDAN and GCG (Table 5), while utility is assessed on TruthfulQA, MMLU, and SQuAD. Table 1 then reports DIESEL's ASR on the same AutoDAN and GCG attacks as the main evidence, and Table 2 reports utility on the same benchmarks used for choosing τ. Since all tunable components—scaling factor, candidate-pool size, cutoff, and concept set—were fit to these exact attack families and utility benchmarks, the low ASR may reflect selection rather than a generally safer decoding mechanism. I ask the authors to add at least one attack family that played no role in configuration choice (e.g., PAIR, GPTFuzzer, or a different optimization-based attack) and to report the full pipeline fixed before evaluating on that held-out attack.","section":"§4.2.2 / §A.3.2 / Table 5 / Figure 5"},{"comment":"The utility-preservation claim rests on very small evaluation subsets: MMLU is evaluated on 50 prompts and SQuAD on 50 prompts (Section A.2.2), and BeaverTails uses a subset of approximately 400 prompts. With these sample sizes, the near-identical accuracies in Table 2 (e.g., Llama 3: 48% vs 48% on MMLU; 94% vs 94% on SQuAD) are not informative; a difference of a few percent would be within noise, and the paper does not report confidence intervals or significance tests. The authors should either evaluate on the full benchmarks or clearly state that the utility results are pilot-scale and therefore do not support the strong claim that DIESEL 'maintains performance nearly identical to vanilla inference' across all models.","section":"§4.2.3 / §A.2.2 / Table 2"},{"comment":"The paper itself acknowledges in Section 6 that a token chosen in an early iteration may not be flagged as unsafe in isolation but can combine with later tokens to form an unsafe sentence, and Appendix A.4 (Example F) shows a concrete failure where DIESEL produces the full botnet instructions that a negative concept set containing 'Malware', 'Hacking', and 'cyber crimes' would be expected to catch. This is not by itself a reason to reject, since the mechanism could still reduce ASR on average, but it weakens the premise behind the safety score in Eq. (2) and raises the question of whether the reported ASR reductions are partly an artifact of early termination on the specific attacks tested. I ask the authors to quantify how often DIESEL's final response contains unsafe content that is not captured by the token-level similarity, for example by reporting a second metric that measures whether any sentence in the final response is flagged as unsafe by Llama Guard.","section":"§6 / Appendix A.4 / Eq. (2)"}],"minor_comments":[{"comment":"The notation for the input to the embedding model is inconsistent: Eq. (2) uses {x_{n':n-1}, x_i_n} (the generated response plus candidate), while Algorithm 1 line 8 uses XG + {x_i_n} without the input prefix, and line 4 feeds {x_1:n-1} + XG to the LLM. Please clarify exactly which token sequence is embedded in each step, and state whether the prompt is ever included in the similarity computation (the text says it is not).","section":"Algorithm 1 / Eq. (2)"},{"comment":"Figure 3 reports 'Defense success rate' while the text and Table 4 report ASR; since one is the complement of the other, the authors should define both terms clearly and use them consistently to avoid confusion.","section":"§4.2.1 / Figure 3"},{"comment":"For Llama 3 under GCG, DIESEL reports ASR 5% versus No Defense 5%, meaning no reduction, yet the text says DIESEL 'follows as the second-best defense'. This should be acknowledged explicitly, as it tempers the claim of uniform robustness.","section":"Table 1"},{"comment":"The claim that 'as model size increases, the relative runtime impact of DIESEL diminishes' is speculative, since only 7B and 8B models were tested; please either qualify the statement or add a larger model to support it.","section":"§4.2.4"},{"comment":"The phrase 'casual conversation' is likely intended as 'casual conversation', but the word 'casual' is unusual in this context; also, the abstract uses 'casual' while the body uses 'conversational'—consider using one term consistently.","section":"Abstract / §1"},{"comment":"The 'General' negative-concept set includes very short single-word entries such as 'Sex', 'Illegal', and 'Virus'. Such broad terms may cause over-filtering of benign content (e.g., a medical discussion of viruses); the paper does not report false-positive rates on benign prompts beyond the small utility subsets. Please discuss or measure this risk.","section":"Appendix A.2.5"}],"recommendation":"major_revision","confidential_remarks":"The core issue is the in-sample evaluation of the safety claim: the ablations in A.3.2 select every tunable component on the same attacks and benchmarks that are later used as headline results. This is fixable within the manuscript's scope by adding a held-out attack family and, ideally, by specifying in advance that the configuration is frozen. The botnet failure in A.4 and the small utility subsets reinforce the need for a more rigorous evaluation, but I do not see a fatal error in the method itself. I recommend major revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Know this: DIESEL is a simple, training-free decoding-time filter that reranks top-k tokens by cosine similarity to natural-language negative concepts, plus an early-termination rule. The combination is new relative to RAIN and SafeDecoding, and the runtime overhead (~1.3-2x) is genuinely modest. But the headline safety numbers are not out-of-sample: the paper tunes alpha, k, tau, and the negative-concept set on the same AutoDAN and GCG attacks it reports in Table 1, and the utility benchmarks used in ablation are the same ones reported in Table 2. The strong ASR reductions on those attacks may be selection rather than a general property.\n\nWhat the paper does well: the mechanism is clearly described, the Limitations section is honest about the token-selection irreversibility problem, and the appendix includes both an acknowledged botnet failure and incoherent outputs like \"hat(<eos>)\". Including those failure examples is a point in the authors' favor. The multilingual evaluation and the horror-story filtering show the method is genuinely general-purpose. The approach is model-agnostic, non-experts can configure it with natural-language concepts, and no training is needed.\n\nSoft spots, in proportion: the in-sample tuning is the main one; utility numbers come from only 50 prompts for MMLU and SQuAD with no variance; code is not released; and the appendix examples include several responses that are not fluent, which undercuts the response-quality claim. The underlying premise, that per-token cosine similarity predicts the safety of the eventual full response, is a heuristic that the authors themselves concede can fail. The botnet example shows that failure in a safety-critical case. Still, the mechanism is plausible and the paper is far from incoherent.\n\nWho this is for: anyone building practical LLM safety layers or studying inference-time decoding interventions. It deserves a serious referee, but the review should require a held-out attack family, larger utility evaluation with error bars, released code, and a more careful treatment of fluency. I would not treat DIESEL as a standalone guard yet; it is a useful engineering contribution with a fixable evaluation gap. Send it to peer review with the expectation of major revision.","headline":"DIESEL is a clean, lightweight decoding-time safety filter whose headline numbers are weakened by in-sample tuning, but it is a genuine engineering contribution worth a rigorous review.","tokens_in":20082,"tokens_out":2007,"would_cite":true,"duration_ms":24633,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DIESEL claims that reranking next-token candidates by similarity to negative-concept embeddings, with early termination, makes autoregressive LLMs safer without retraining.","keywords":["LLM safety","inference-time guidance","token reranking","semantic embeddings","jailbreak defense","content filtering","decoding strategy"],"falsifier":"Run DIESEL on a set of prompts whose safe-looking prefixes build toward an unsafe instruction token by token (the paper's appendix already contains one such botnet example), and measure whether the unsafe response is still produced; a second, stronger test is to optimize an adversarial suffix specifically to minimize max cosine similarity to the negative-concept set while preserving the harmful completion, then compare attack success rates with and without the suffix.","tokens_in":19123,"feed_emoji":"🛡️","tokens_out":5242,"duration_ms":42774,"temperature":0.7,"pith_summary":"DIESEL is a training-free, inference-time safety layer for autoregressive language models. At each decoding step it selects the top-k most probable next tokens, embeds each candidate together with the response prefix using a small off-the-shelf sentence encoder, and computes a safety score equal to one minus the maximum cosine similarity between that embedding and a user-supplied set of negative-concept texts. It reranks the candidates by a blend of the model's original probability and this safety score, and halts generation entirely if no candidate clears a threshold. The paper claims this substantially lowers attack success rates on uncensored and aligned chat models across several jailbreak attacks while leaving utility benchmarks nearly unchanged and adding far less inference overhead than comparable guidance methods. If true, DIESEL gives non-expert users a configurable guardrail that can be updated by editing plain-language lists of unwanted concepts.","feed_headline":"Reranking tokens cuts LLM jailbreak success to 22 percent","feed_subtitle":"Scores each candidate token against negative-concept embeddings, blocking unsafe output with no retraining and only ~1.27x slowdown.","key_machinery":"The load-bearing object is the token safety score $\\gamma(x_i^n)$ of Equation 2: the cosine similarity between the sentence embedding of the response prefix plus one candidate token and each negative concept, converted to a proximity score $\\gamma = 1 - \\max \\mathrm{cosine\\ similarity}$. Because the negative-concept embeddings are precomputed once and the sentence encoder is about 24M parameters, the extra per-token cost is a single small embedding call per candidate. The reranking score of Equation 3 uses $d(\\gamma)$, the range of safety scores in the candidate pool, as an adaptive weight that lets the model follow its natural distribution when all candidates are equally safe and shifts to safety when one candidate is clearly riskier. Algorithm 1 wraps these two formulas in a top-k candidate loop with a hard cutoff $\\tau$ that terminates generation.","core_discovery":"On the paper's own terms, the discovery is that safety can be enforced token-by-token in the embedding space of a small sentence transformer without any modification of the generative model. For each of the k candidate tokens the method computes $\\gamma(x_i^n) = 1 - \\max_{r \\in R} \\mathrm{CS}(f_{\\theta_2}(\\text{response prefix} + x_i^n), f_{\\theta_2}(r))$, and then reranks by $S = P + \\alpha \\cdot d(\\gamma) \\cdot \\gamma(x_i^n)$, where $d(\\gamma)$ is the spread of safety scores across the candidate pool, so the safety term only dominates when candidates genuinely differ in risk. The early-stop rule, $\\max_i \\gamma_i < \\tau$, turns the reranker into a refusal mechanism that returns a canned apology instead of continuing an unsafe completion. Evaluations on Llama 3, Mistral, and Vicuna in both uncensored and aligned versions report lower attack success rates than the compared defenses, particularly against the Adaptive attack, with accuracy on TruthfulQA, MMLU, and SQuAD essentially unchanged.","pith_inferences":["Because $\\gamma$ is computed per token without lookahead, an adversary could in principle spread a harmful instruction across tokens whose prefixes are each semantically neutral; the paper's own botnet example shows this failure mode already occurs, so a plausible extension is a short look-ahead or n-gram embedding window.","The dependence on a fixed embedding model means the defense is only as concept-aware as the sentence encoder; a jailbreak designed to keep cosine similarity to negative concepts low while preserving harmful meaning would be a direct stress test.","The reranking formula could be reused for other steering objectives, such as style, tone, or topic filtering, simply by swapping the negative-concept set for positive or attribute-specific ones.","Combining DIESEL's early stop with a refusal-aware response generator might reduce the fluency loss the authors acknowledge in borderline cases where safe continuations exist."],"forward_implications":["Deploying DIESEL requires no gradient updates, no safety fine-tuning, and no expert model, so it can be layered onto any already-served autoregressive model.","Safety policy can be changed at runtime by adding or removing negative concepts in natural language, without retraining or re-deployment.","On the evaluated chat models, the method holds attack success rates far below those of prompt-level defenses (e.g., 22 percent on Llama 3 under the Adaptive attack), making it a candidate complement to input filtering.","Because the overhead scales with k, the number of candidates, rather than with the base model size, the relative cost shrinks as LLMs grow.","The same mechanism filters non-safety content, as demonstrated by reducing horror intensity in generated stories."],"supporting_citations":[{"why":"Supplies the GCG attack and the AdvBench dataset used to measure jailbreak resistance.","marker":"(Zou et al., 2023)"},{"why":"RAIN, the closest training-free inference-guidance baseline that DIESEL must beat on both safety and runtime.","marker":"(Li et al., 2023b)"},{"why":"SafeDecoding, the safety-aware decoding baseline that requires an extra fine-tuned expert model.","marker":"(Xu et al., 2024)"},{"why":"Llama Guard 3, the classifier used to label responses as safe or unsafe for the attack success rate metric.","marker":"(Llama Team, 2024)"},{"why":"BeaverTails, the safety benchmark used for the standalone-safeguard evaluation.","marker":"(Ji et al., 2024)"},{"why":"The Adaptive attack, the jailbreak against which DIESEL shows the largest improvement.","marker":"(Andriushchenko et al., 2024)"}],"fun_headline_variants":["Token reranking slashes jailbreak success to 22%","No retraining: semantic token filter stops LLM jailbreaks","DIESEL: lightweight LLM guard via token reranking","Rerank unsafe tokens to block LLM jailbreaks","Semantic-space reranking blocks unsafe LLM output"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole safety signal rests on the assumption that the cosine similarity between the embedding of the just-generated prefix plus one candidate token and a negative-concept phrase reliably predicts whether the final full response will be unsafe.","fun_headline_variants_meta":{"raw":{"variants":["Token reranking slashes jailbreak success to 22%","No retraining: semantic token filter stops LLM jailbreaks","DIESEL: lightweight LLM guard via token reranking","Rerank unsafe tokens to block LLM jailbreaks","Semantic-space reranking blocks unsafe LLM output"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000845,"raw_usage":{"total_tokens":3701,"prompt_tokens":991,"completion_tokens":2710,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":2627}},"tokens_in":607,"tokens_out":2710,"duration_ms":19413,"temperature":1.0,"reasoning_tokens":2627,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:35:55.297217+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run DIESEL on a set of prompts whose safe-looking prefixes build toward an unsafe instruction token by token (the paper's appendix already contains one such botnet example), and measure whether the unsafe response is still produced; a second, stronger test is to optimize an adversarial suffix specifically to minimize max cosine similarity to the negative-concept set while preserving the harmful completion, then compare attack success rates with and without the suffix.","supporting_citations":[],"review_version":1}