Refusal-Gated Decoding: Preserving Refusal Behavior Under High-Temperature Sampling

Allen Roush; Amir Abdullah; Manikandan Ravikiran; Phillip Howard; Xin Su

REVIEW 5 major objections 4 minor 19 references

Refusal-gated decoding preserves a model's greedy refusal behavior under high-temperature sampling by decoding a few tokens greedily and returning the refusal if the opening matches a learned refusal-prefix set, otherwise restarting ordinar

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 09:21 UTC pith:FHTANONQ

load-bearing objection A practical, well-evaluated decoding-time safeguard that mostly delivers; the soft spots (no error bars, one sub-91% cell) are minor and fixable. the 5 major comments →

arxiv 2607.20791 v1 pith:FHTANONQ submitted 2026-07-22 cs.AI cs.CL

Refusal-Gated Decoding: Preserving Refusal Behavior Under High-Temperature Sampling

Phillip Howard , Xin Su , Allen Roush , Manikandan Ravikiran , Amir Abdullah This is my paper

classification cs.AI cs.CL

keywords refusal-gated decodinghigh-temperature samplingLLM safetyrefusal behaviordecoding-time interventionprefix compatibilityKV cache reusep-less sampling

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

High-temperature sampling, used to make language models more diverse, also flattens the token distribution and erodes refusal behavior: a harmful prompt the model would refuse under greedy decoding can slip through when sampled hot. The paper argues this tradeoff is avoidable. It introduces refusal-gated decoding, a two-stage procedure that briefly probes the greedy trajectory for a recognized refusal opening and, if one appears, returns that greedy refusal; otherwise it discards the probe and restarts high-temperature sampling from the original prompt. Across three models and three refusal benchmarks, the method preserves 91–99% of greedy-decoding refusals at temperatures up to 3.0 while adding only a few tokens of overhead on non-refusals. The claim is that diversity and safety can coexist without fine-tuning or auxiliary safety models.

Core claim

The paper establishes that a model's own greedy trajectory, within its first few tokens, carries enough information to decide whether the model would refuse a prompt, and that this signal can gate high-temperature sampling. Concretely, refusal-gated decoding learns a per-model set of refusal-prefix strings calibrated on a WildJailbreak split, runs a greedy compatibility probe of up to c=3 tokens, and returns the greedy refusal if the probe stays compatible with a known refusal prefix through a stop token or length cap; otherwise it discards the probe and samples at high temperature using p-less sampling from the cached prompt. This mechanism preserves 91–99% of WildGuard-judged greedy refusa

What carries the argument

The refusal-prefix compatibility gate. The set P of refusal prefixes combines a base JailbreakBench-style detector, hand-written refusal openings, and model-specific prefixes mined from WildGuard-confirmed refusals, filtered for 0.98 training/validation precision and capped at 64 prefixes per model. The predicate C(d(q), P) is true when the decoded greedy probe text is a prefix of (or extends) some known refusal opening. A short c-token greedy probe (c=3) checks compatibility after every token; incompatibility exits to high-temperature sampling, while survival through EOS or the length cap L=128 returns the greedy refusal. Prompt KV-cache reuse makes the probe cheap: measured non-refusal cos

Load-bearing premise

The learned refusal-prefix set must contain the first three tokens of every greedy refusal the model produces; an unseen refusal opening exits the gate to high-temperature sampling and the refusal is lost.

What would settle it

Construct a set of harmful prompts whose greedy refusals deliberately begin with non-canonical openings (e.g., a direct answer with no preamble, or a question). If refusal-gated decoding preserves fewer than about 80% of those greedy refusals at T=3.0, the gate's premise—that refusals are prefix-detectable within three tokens—is falsified.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

High-temperature sampling for creative writing or self-consistency no longer has to trade away the model's baseline refusal rate: refusal-gated decoding restores 91–99% of greedy refusals at T=3.0.
Because the method returns the model's own greedy refusal rather than steering the token distribution, it preserves the original high-temperature output distribution for non-refusals.
No auxiliary safety classifier is needed at generation time, avoiding the extra resident model and its latency; the only added cost is a short greedy probe that reuses the prompt's KV cache.
The prefix set is per-model and calibrated on a WildJailbreak split, and the appendix shows a residual-stream linear classifier can skip the gate entirely for most safe prompts, reducing overhead to a single 37µs readout.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The 'greedy-probe-then-sample' pattern may generalize beyond refusals: any latent behavior that reliably appears within the first few greedy tokens—style, persona, tool-use intent—could be gated the same way.
The hard compatibility gate is a conservative default; the paper's soft-gate ablation suggests that on noisier prompt distributions, using top-K refusal-compatible probability mass could recover more refusals at the cost of more probe tokens.
If the residual-stream classifier's low latency transfers to other models and distributions, the incremental cost of refusal checking could drop from a few tokens to a single linear readout, making the safety check nearly invisible to users.
The 91–99% preservation figures are conditioned on WildGuard's refusal labels; a different judge or a jailbreak setting where refusals use non-canonical openings would change both measured preservation and the difficulty of mining prefix sets.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

A practical, well-evaluated decoding-time safeguard that mostly delivers; the soft spots (no error bars, one sub-91% cell) are minor and fixable.

read the letter

Phil, quick take on arXiv:2607.20791.

The paper does something genuinely useful: it gives a cheap way to keep a model's greedy refusal behavior when you decode at high temperatures. The core trick is a short greedy probe (up to 3 tokens) checked against a small set of learned refusal prefixes; if the probe looks like a refusal, keep going greedily and return the refusal; otherwise discard the probe and restart high-temperature sampling from the cached prompt prefill. The early-exit plus KV-cache reuse keeps overhead around 1.05–1.4x on non-refusals, which is the kind of number that makes a deployment engineer actually consider using it. I haven't seen this exact restart-based approach in the decoding-safety literature, and the paper does a thorough job: three models, three datasets, temperature sweeps, ablations, and a withheld WildJailbreak test split for the learned prefixes. The main preservation results are strong — 90.5–99.5% across the table, versus direct high-temp sampling that collapses to 23–37% for some models at T=3.0. The distribution-preservation claim for safe prompts is also logically sound, since the method restarts from the original prompt after discarding the probe.

The soft spots are real but minor. First, there are no error bars or seed repeats for the stochastic sampling results; some of the differences between methods at the low end are small enough that variance could matter. Second, the latency tables mix hardware and backends (SafeDecoding on PEFT/Transformers, Qwen3.6 on different GPUs), so cross-method latency ratios should be read with that caveat — though the refusal-gated vs direct high-temp comparisons on the same setup are fine. Third, the learned prefix set only covers a fraction of greedy refusals on some cells; on Qwen3.6 XSTest at T=3.0 the gate misses ~15% of greedy refusals at token 3, and most of those fall back to high-temp and are lost. That's the real reason preservation is 90.5% rather than higher, and the abstract's '91-99%' range is a hair off (90.52% appears in Table 1). The fixed-probe ablation in Appendix B shows you recover only ~0.5 points by decoding 32 tokens instead, so the limitation is more about refusal-prefix coverage than the early-exit design itself. It would be worth reporting per-cell prefix recall and running a couple of seeds to bound the noise.

Bottom line: this is a solid, practical contribution for anyone deploying high-temperature generation with safety requirements. The central claim holds up in the comparisons that matter. I'd send it to peer review — the right referees will push for error bars, code and learned-prefix release, and a slightly more careful statement of the preservation range, but the method is sound and the experiments are honest.

Referee Report

5 major / 4 minor

Summary. The paper proposes refusal-gated decoding, a two-phase decoding procedure that first runs a short greedy compatibility gate against a learned set of refusal prefixes and, if the gate recognizes a refusal trajectory, returns the greedy refusal; otherwise it discards the probe and restarts ordinary high-temperature sampling from the cached prompt prefix. The method is evaluated on Qwen2.5-7B, Qwen3.6-27B, and Llama-3.1-8B across JBB, XSTest, and a withheld WildJailbreak split, with temperature sweeps up to T=3.0. The authors report that the method preserves 91-99% of greedy decoding refusals while adding only a few tokens of latency overhead, and they compare against direct high-temperature sampling, an online LlamaGuard-4 router, naive greedy-then-high-temperature decoding, and SafeDecoding. An appendix also investigates a residual-stream classifier as a cheaper alternative to the greedy gate.

Significance. If the results hold, the contribution is a lightweight, model-agnostic decoding-time intervention that preserves a model's own greedy refusal behavior under high-temperature sampling without modifying weights and without perturbing the high-temperature distribution on non-refusals. The paper is unusually thorough in experimental breadth: three models, three datasets, temperature sweeps, ablations of the compatibility gate and soft-gate variants, and a residual-classifier analysis. The method is simple and practical, and the use of KV-cache reuse and early exit is sensible. However, the central quantitative claim is not exactly supported by the reported tables, and the reliance on a small learned refusal-prefix set requires additional scrutiny before the preservation numbers can be taken at face value.

major comments (5)

[Abstract; §4.2, Table 1] The abstract and Section 1 claim preservation of '91-99%' of greedy refusal behavior, but Table 1 reports 90.52% for Qwen3.6-27B on XSTest at T=3.0, below the stated lower bound. Table 10 shows the same cell at T=2.5 is 91.47%, so the discrepancy is specific to T=3.0 but still contradicts the claimed range. Please either correct the claim to the actual observed range (e.g., 90.52-99.53%) or add the caveat that the lower bound is model/dataset dependent.
[§3, Algorithm 1; §4.2, Table 1] The preservation behavior is bounded by the recall of the learned refusal-prefix set P over the first c=3 greedy tokens. The paper never reports the recall or coverage of P on greedy refusals for each model/dataset. The Qwen3.6 XSTest cell (90.52% preservation vs 37.91% direct high-temperature preservation) implies roughly 15% of greedy refusals are not recognized as compatible within the gate and therefore revert to ordinary high-temperature sampling, where most are lost. This is a measurable safety-relevant gap and is load-bearing for the central claim. Please report the per-model, per-dataset coverage of P on greedy refusals, and discuss the transferability of prefixes learned on WildJailbreak to JBB and XSTest refusal styles.
[§4.1–§4.2, Tables 1–2, 10–11] All preservation and latency numbers come from a single evaluation run, with no error bars, confidence intervals, or repeated seeds. High-temperature sampling is stochastic, and the reported differences—for example, 90.52% vs 91.00% between refusal-gated and naive greedy—may be within run-to-run noise. Please provide standard errors from multiple seeds or at least binomial confidence intervals for the main preservation figures, and report latency measurements over repeated batches.
[Appendix B, Table 8] The text states that 'The prefix gate lowers non-refusal latency relative to the fixed-probe ablation across all dataset-model pairs.' This is contradicted by Table 8 for Qwen3.6-27B on JBB: the prefix gate uses 14 tokens and reports +73ms/1.383x, while the fixed probe uses 32 tokens but reports +40ms/1.207x. The prefix gate is both slower in absolute terms and has a higher latency ratio. This may be a measurement artifact, but as written it undermines the stated latency advantage. Please investigate, correct the claim, or explain the discrepancy.
[§3, Appendix D, §4.1 metric definition] WildGuard is used both as the labeler for mining and filtering the learned refusal-prefix set P on the calibration split and as the judge for the preservation metric on the test split. Because the same judge is used in training and evaluation, the reported preservation figures may overstate the method's performance relative to an independent assessment of refusal behavior. Please discuss this self-reference and, ideally, supplement the main results with an independent refusal judge (e.g., human annotation or a different classifier) on a subset of the evaluation data.

minor comments (4)

[Abstract / §1] The '91-99%' range should be revised to match the data, as noted above. If the authors intend to round 90.52% to 91%, this should be stated explicitly, but the abstract currently reads as exact.
[Footnote 2] Typo: 'safety epert checkpoints' should be 'safety expert checkpoints'.
[Appendix A] The relationship between the 'soft-prefix detector' used in Table 3 (base + 33 fixed refusal phrases) and the learned refusal-prefix set P used in the main method is unclear. Clarify whether the soft-prefix detector is a simplified variant of P or a separate construction, since the learned prefixes are trained on WildJailbreak and not mentioned in this appendix.
[Appendix C] The abbreviation 'RGD' is introduced in Table 9 without being defined in the main text; define it at first use in the main body or when the soft-gate ablation is first described.

Circularity Check

0 steps flagged

No significant circularity: refusal-gated decoding is an empirical method evaluated on withheld and out-of-distribution splits.

full rationale

The paper's central claim is that refusal-gated decoding preserves 91-99% of greedy-decoding refusal behavior at high temperatures. This is an empirical measurement, not a quantity derived from the method's own construction. The refusal-prefix set P is calibrated on a disjoint WildJailbreak training split (500 harmful + 500 benign prompts) and then evaluated on the withheld WildJailbreak test split plus out-of-distribution JBB and XSTest prompts. Preservation is computed by comparing WildGuard labels of greedy outputs with WildGuard labels of the method's outputs on prompts not used for calibration. The method does not use the high-temperature outputs of the test prompts to tune the gate, and the early-exit compatibility predicate is a fixed rule, not a fitted predictor of the reported preservation numbers. The Appendix A residual classifier is likewise trained only on a WildJailbreak train split and evaluated on held-out and OOD data; its comparison against the soft-prefix detector is at a matched false-positive rate, and the combined method's preservation is reported on withheld data. The only mild shared component is that WildGuard serves both as the source of labels for mining/validating prefixes and as the judge for the preservation metric, so systematic WildGuard errors are inherited by both the calibration and the evaluation. This is a measurement-dependence caveat common to refusal benchmarks, not a circular derivation step. Self-citations (p-less sampling, min-p) are used as backbone samplers and are not load-bearing for the refusal-preservation claim. No step in the derivation reduces by construction to its own inputs, and no fitted parameter is renamed as a prediction. Therefore the paper is self-contained against external benchmarks for its main claim.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The central claim rests on a fitted refusal-prefix set and several evaluation assumptions. No new physical entities are introduced.

free parameters (7)

c (greedy gate length) = 3
Number of initial greedy tokens checked against the refusal-prefix set before committing to full greedy completion. Chosen by hand (Appendix D: 'we used c=3 and L=128 throughout'). No reported ablation over c.
L (max refusal-probe length) = 128
Maximum tokens for the greedy refusal probe, equal to the max generation length. Chosen by hand.
refusal-prefix precision threshold = 0.98
Prefixes retained only if training/validation precision ≥0.98 against WildGuard labels (Appendix D). Chosen by hand.
max learned prefixes per model = 64
Cap on cached prefixes after ranking (Appendix D). Chosen by hand.
minimum prefix support = max(2, ceil(0.01 n))
Minimum number of source refusals a mined prefix must appear in (Appendix D). Chosen by hand.
learned refusal-prefix set P = 2 (Qwen2.5), 4 (Llama-3.1), 8 (Qwen3.6) prefixes
Mined from WildJailbreak calibration completions and filtered by WildGuard labels. This is the core fitted object of the method; without it the gate cannot recognize refusal openings.
residual-classifier skip threshold θ (Appendix A) = ≈4e-3 (Qwen2.5-7B); ≈1e-5 (Llama-3.1-8B)
Calibrated on validation to the largest value that leaks no held-out refusals; used only in the residual-classifier variant, not the main gated method.

axioms (6)

domain assumption WildGuard provides accurate refusal labels (treated as ground truth for training and evaluation).
All preservation, cost, and accuracy metrics are computed from WildGuard judgments (§4.1 'Metrics'). If WildGuard is systematically wrong, the reported preservation and safety numbers shift.
domain assumption Greedy decoding is a meaningful baseline for a model's refusal behavior.
The method defines preservation relative to the greedy response (Section 3). This assumes greedy decoding reflects the model's aligned refusal behavior.
domain assumption The learned refusal-prefix set transfers from the WildJailbreak calibration split to JBB and XSTest.
Prefixes are learned on WildJailbreak training/validation data only (Appendix D), but evaluated on JBB and XSTest as well. The method's success on those datasets depends on transfer.
domain assumption p-less sampling avoids degeneration at high temperatures and does not itself alter refusal behavior beyond temperature.
The high-temperature branch uses p-less sampling (Tan et al., 2026) to prevent degeneration. The paper relies on the cited sampler's properties; its effect on refusal is part of the measured 'high temp' baseline.
domain assumption vLLM automatic prefix caching correctly reuses the prompt KV cache across the greedy probe and high-temperature restart.
The efficiency claim depends on not re-prefilling the prompt (Section 3). Any divergence in KV-cache states between the discarded probe and the clean restart would break the approach.
domain assumption The base JailbreakBench refusal-prefix detector together with hand-written openings covers common refusal styles.
The refusal-prefix set combines these sources with learned prefixes (Section 3). If a model's refusal openings are not covered, the gate exits early and the refusal is lost.

pith-pipeline@v1.3.0-alltime-deepseek · 16613 in / 12913 out tokens · 119373 ms · 2026-08-01T09:21:41.844471+00:00 · methodology

0 comments

read the original abstract

High-temperature sampling is one of the primary mechanisms for increasing diversity in LLMs. Recent advances in truncation-based sampling techniques have helped mitigate drawbacks of high-temperature sampling such as neural text degeneration, thereby enabling greater diversity in LLM outputs without sacrificing coherence. However, increasing the entropy of the token probability distribution via high temperatures has also been shown to weaken model guardrails by reducing the model's refusal response in the presence of harmful prompts. Despite the potential benefits of high-temperature sampling and the importance of maintaining model safety, there is a lack of existing solutions for maintaining the refusal behavior of LLMs under a higher entropy regime. To address this gap, we systematically study how temperature influences refusal behavior in LLMs and propose an efficient sequential decoding approach which preserves a model's greedy decoding refusal response at high temperatures while incurring minimal additional latency. Through extensive experiments, we show that our approach preserves 91-99% of the greedy decoding refusal behavior across three benchmark datasets without compromising the model's high-temperature response for safe prompts. Our work demonstrates how refusal behavior can be maintained in an efficient manner for applications which require high-temperature sampling.

Figures

Figures reproduced from arXiv: 2607.20791 by Allen Roush, Amir Abdullah, Manikandan Ravikiran, Phillip Howard, Xin Su.

**Figure 1.** Figure 1: Direct high-temperature sampling increasingly fails to preserve greedy refusal behavior as temperature rises. Through comprehensive experiments, we show that refusal-gated decoding outperforms alternative approaches based on prompt safety classifiers and safety-focused decoding techniques in refusal preservation at high temperatures, achieving 91-99% consistency with baseline greedy decoding across three… view at source ↗

**Figure 2.** Figure 2: Illustration of our approach. If greedy decoding remains compatible with a learned [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Figure 3: Adaptive refusal-gating pipeline. For this analysis, we utilize (and compare against) a “soft-labeled” version of the prefix detector, which adds 33 fixed refusal phrases; e.g. “I cannot”, “I’m unable”, and “I must decline”. It incorporates these phrases via an acknowledgment-then-decline rule that fires on openers such as “I understand . . . , but I cannot . . . ”. We measure the accuracy of this soft-pre… view at source ↗

discussion (0)

Reference graph

Works this paper leans on

19 extracted references · 8 linked inside Pith

[1]

Safeinfer: Context adaptive decoding time safety alignment for large language models

Somnath Banerjee, Sayan Layek, Soham Tripathy, Shanu Kumar, Animesh Mukherjee, and Rima Hazra. Safeinfer: Context adaptive decoding time safety alignment for large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp.\ 27188--27196, 2025

2025
[2]

Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In NeurIPS Datasets and Benchmarks Track, 2024

2024
[3]

Hierarchical neural story generation, 2018

Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation, 2018. URL https://arxiv.org/abs/1805.04833

Pith/arXiv arXiv 2018
[4]

Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms

Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in neural information processing systems, 37: 0 8093--8131, 2024

2024
[5]

Manning, and Percy Liang

John Hewitt, Christopher D. Manning, and Percy Liang. Truncation sampling as language model desmoothing, 2022. URL https://arxiv.org/abs/2210.15191

Pith/arXiv arXiv 2022
[6]

The curious case of neural text degeneration, 2020

Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration, 2020. URL https://arxiv.org/abs/1904.09751

Pith/arXiv arXiv 2020
[7]

Catastrophic jailbreak of open-source llms via exploiting generation, 2023

Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source llms via exploiting generation, 2023. URL https://arxiv.org/abs/2310.06987

Pith/arXiv arXiv 2023
[8]

Llama guard: Llm-based input-output safeguard for human-ai conversations

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023

Pith/arXiv arXiv 2023
[9]

Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models

Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, et al. Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. Advances in Neural Information Processing Systems, 37: 0 47094--47165, 2024

2024
[10]

Gonzalez, Hao Zhang, and Ion Stoica

Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023. URL https://arxiv.org/abs/2309.06180

Pith/arXiv arXiv 2023
[11]

Locally typical sampling

Clara Meister, Tiago Pimentel, Gian Wiher, and Ryan Cotterell. Locally typical sampling. Transactions of the Association for Computational Linguistics, 11: 0 102--121, 2023

2023
[12]

Llama guard 4 model card, 2025

Meta . Llama guard 4 model card, 2025. URL https://huggingface.co/meta-llama/Llama-Guard-4-12B

2025
[13]

Turning up the heat: Min-p sampling for creative and coherent llm outputs, 2025

Minh Nhat Nguyen, Andrew Baker, Clement Neo, Allen Roush, Andreas Kirsch, and Ravid Shwartz-Ziv. Turning up the heat: Min-p sampling for creative and coherent llm outputs, 2025. URL https://arxiv.org/abs/2407.01082

arXiv 2025
[14]

Is temperature the creativity parameter of large language models?, 2024

Max Peeperkorn, Tom Kouwenhoven, Dan Brown, and Anna Jordanous. Is temperature the creativity parameter of large language models?, 2024. URL https://arxiv.org/abs/2405.00492

Pith/arXiv arXiv 2024
[15]

Xstest: A test suite for identifying exaggerated safety behaviours in large language models

Paul R \"o ttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pap...

2024
[16]

p-less sampling: A robust hyperparameter-free approach for LLM decoding

Runyan Tan, Shuang Wu, and Phillip Howard. p-less sampling: A robust hyperparameter-free approach for LLM decoding. In The Fourteenth International Conference on Learning Representations, 2026. URL https://openreview.net/forum?id=ItFuNJQGH4

2026
[17]

Self-consistency improves chain of thought reasoning in language models, 2023

Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-consistency improves chain of thought reasoning in language models, 2023. URL https://arxiv.org/abs/2203.11171

Pith/arXiv arXiv 2023
[18]

Safedecoding: Defending against jailbreak attacks via safety-aware decoding

Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp.\ 5587--5605, 2024

2024
[19]

Safety alignment of large language models via contrasting safe and harmful distributions

Xiaoyun Zhang, Zhengyue Zhao, Wenxuan Shi, Kaidi Xu, Di Huang, and Xing Hu. Safety alignment of large language models via contrasting safe and harmful distributions. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pp.\ 34827--34835, 2026

2026

[1] [1]

Safeinfer: Context adaptive decoding time safety alignment for large language models

Somnath Banerjee, Sayan Layek, Soham Tripathy, Shanu Kumar, Animesh Mukherjee, and Rima Hazra. Safeinfer: Context adaptive decoding time safety alignment for large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp.\ 27188--27196, 2025

2025

[2] [2]

Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In NeurIPS Datasets and Benchmarks Track, 2024

2024

[3] [3]

Hierarchical neural story generation, 2018

Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation, 2018. URL https://arxiv.org/abs/1805.04833

Pith/arXiv arXiv 2018

[4] [4]

Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms

Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in neural information processing systems, 37: 0 8093--8131, 2024

2024

[5] [5]

Manning, and Percy Liang

John Hewitt, Christopher D. Manning, and Percy Liang. Truncation sampling as language model desmoothing, 2022. URL https://arxiv.org/abs/2210.15191

Pith/arXiv arXiv 2022

[6] [6]

The curious case of neural text degeneration, 2020

Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration, 2020. URL https://arxiv.org/abs/1904.09751

Pith/arXiv arXiv 2020

[7] [7]

Catastrophic jailbreak of open-source llms via exploiting generation, 2023

Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source llms via exploiting generation, 2023. URL https://arxiv.org/abs/2310.06987

Pith/arXiv arXiv 2023

[8] [8]

Llama guard: Llm-based input-output safeguard for human-ai conversations

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023

Pith/arXiv arXiv 2023

[9] [9]

Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models

Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, et al. Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. Advances in Neural Information Processing Systems, 37: 0 47094--47165, 2024

2024

[10] [10]

Gonzalez, Hao Zhang, and Ion Stoica

Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023. URL https://arxiv.org/abs/2309.06180

Pith/arXiv arXiv 2023

[11] [11]

Locally typical sampling

Clara Meister, Tiago Pimentel, Gian Wiher, and Ryan Cotterell. Locally typical sampling. Transactions of the Association for Computational Linguistics, 11: 0 102--121, 2023

2023

[12] [12]

Llama guard 4 model card, 2025

Meta . Llama guard 4 model card, 2025. URL https://huggingface.co/meta-llama/Llama-Guard-4-12B

2025

[13] [13]

Turning up the heat: Min-p sampling for creative and coherent llm outputs, 2025

Minh Nhat Nguyen, Andrew Baker, Clement Neo, Allen Roush, Andreas Kirsch, and Ravid Shwartz-Ziv. Turning up the heat: Min-p sampling for creative and coherent llm outputs, 2025. URL https://arxiv.org/abs/2407.01082

arXiv 2025

[14] [14]

Is temperature the creativity parameter of large language models?, 2024

Max Peeperkorn, Tom Kouwenhoven, Dan Brown, and Anna Jordanous. Is temperature the creativity parameter of large language models?, 2024. URL https://arxiv.org/abs/2405.00492

Pith/arXiv arXiv 2024

[15] [15]

Xstest: A test suite for identifying exaggerated safety behaviours in large language models

Paul R \"o ttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pap...

2024

[16] [16]

p-less sampling: A robust hyperparameter-free approach for LLM decoding

Runyan Tan, Shuang Wu, and Phillip Howard. p-less sampling: A robust hyperparameter-free approach for LLM decoding. In The Fourteenth International Conference on Learning Representations, 2026. URL https://openreview.net/forum?id=ItFuNJQGH4

2026

[17] [17]

Self-consistency improves chain of thought reasoning in language models, 2023

Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-consistency improves chain of thought reasoning in language models, 2023. URL https://arxiv.org/abs/2203.11171

Pith/arXiv arXiv 2023

[18] [18]

Safedecoding: Defending against jailbreak attacks via safety-aware decoding

Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp.\ 5587--5605, 2024

2024

[19] [19]

Safety alignment of large language models via contrasting safe and harmful distributions

Xiaoyun Zhang, Zhengyue Zhao, Wenxuan Shi, Kaidi Xu, Di Huang, and Xing Hu. Safety alignment of large language models via contrasting safe and harmful distributions. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pp.\ 34827--34835, 2026

2026