Research map / Large language models / Reasoning and chain of thought

SafeSpec: Fast and Safe LLM via Dynamic Reflective Sampling

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Speculative decoding · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SafeSpec, a speculative-decoding framework that adds a lightweight safety head on the target LLM and uses rollback plus reflective multi-sampling to recover safe continuations under jailbreaks.

Problem

Speculative decoding accelerates LLM inference but offers no safety guarantees, and existing jailbreak defenses either add computation or break the draft-verify loop.

Approach

Attach a frozen-backbone safety head to the target model that scores safety at the candidate-step boundary in the same forward pass used for quality scoring; when unsafe, roll back, insert a self-reflection prompt, and draw K draft samples, selecting the safest candidate instead of hard refusal.

Key results

• On Qwen3-32B (draft 1.7B), SafeSpec reaches average ASR 0.07 vs 0.65 for No Defense, with XSTest over-refusal 0.10 and 2.06x speedup on benign workloads.
• On DeepSeek-R1-Distill-Llama-70B (draft 8B), SafeSpec reaches average ASR 0.07 with XSTest over-refusal 0.12 and 1.76x speedup.
• Hard refusal variant drives ASR to 0.01 but raises XSTest over-refusal to 0.73 on Qwen3-32B, showing the multi-sampling recovery is needed.

Surprising findings

• SafeSpec's speedup on jailbreak inputs falls to 0.87x because frequent safety-mode triggers (3.81 per prompt) add recovery cost.
• Removing the reflection prompt raises average ASR to 0.44 on Qwen3-32B, indicating multi-sampling alone does not find safe paths.

Limitations

• Safety head has a high false-positive rate, so the method relies on resampling to compensate for detector noise.
• Speedup drops below 1x on jailbreak inputs, and the paper reports benign speedup separately.
• Training data is small (about 1,000 malicious prompts) and labels come from another guard model, and the evaluation uses the authors' own attack construction.

Experimental setup

Datasets: AdvBench DeepInception XSTest JailbreakBench GSM8K MATH GPQA-diamond

Benchmarks: JailbreakBench-derived attacks (ABJ, Attention Shifting, CodeChameleon, DeepInception, ReNeLLM, Mousetrap, H-CoT) XSTest GSM8K MATH GPQA-diamond

Metrics: attack success rate over-refusal rate accuracy inference speedup

Baselines: Spec-Decoding Specreason Self-Reminder RPO SafeDecoding SecDecoding Specreason+SR Specreason+RPO Guard+Hard Refusal

Builds on: Speculative decoding Specreason SafeDecoding SecDecoding Self-Reminder RPO

Closest papers by meaning

• Training-Free Loosely Speculative Decoding: Accepting Semantically Correct Drafts Beyond Exact Match (ICLR 2026 · similarity 0.90)
• TriSpec: Ternary Speculative Decoding via Lightweight Proxy Verification (NeurIPS 2026 · similarity 0.90)
• SPEED-Bench: A Unified and Diverse Benchmark for Speculative Decoding (ICML 2026 · similarity 0.90)
• Judge Decoding: Faster Speculative Sampling Requires Going Beyond Model Alignment (ICLR 2025 · similarity 0.89)
• A Theoretical Perspective for Speculative Decoding Algorithm (NeurIPS 2024 · similarity 0.89)
• Performance-Driven Policy Optimization for Speculative Decoding with Adaptive Windowing (NeurIPS 2026 · similarity 0.89)