LaVGuard: Selective Decoding for Contextual Value Drift

Jiale Dai; Liuxian Ma; Hongcan Deng; Xiaoke Niu; Wenjing Zhang; Zhaoxiang Liu; Shiguo Lian; Guojie Song

cs.AIOct 21, 2026

LaVGuard: Selective Decoding for Contextual Value Drift

Authors: Jiale Dai, Liuxian Ma, Hongcan Deng, Xiaoke Niu, Wenjing Zhang, Zhaoxiang Liu, Shiguo Lian, Guojie Song

Organizations: State Key Laboratory of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University · College of Artificial Intelligence, Tsinghua University · University of Chinese Academy of Sciences · China United Network Communications Group Co., Ltd.

Abstract

A content-safe response can still promote priorities that conflict with its task: an assistant may demand compliance when asked to preserve autonomy. We study contextual value drift as a task-relative decoding problem with an explicit allowance for change. LaVGuard separates an authorized ten-dimensional profile from a frozen estimate of the values expressed in the visible prefix. A profile-relative density gate selects when to evaluate candidate continuations; their signed progress determines a logit tilt constrained by both changed-position and cumulative-KL budgets. We establish local surrogate improvement, pathwise budget feasibility, and a bound on response-distribution change. Profile conditioning raises boundary TPR at 5% FPR from .58 to .72. At the same .12 mean intervention ratio, the selection study reports risk-safety scores of .88 for LaVGuard and .72 for position-matched edits. The resulting interface makes task priorities actionable while keeping the extent of intervention explicit and bounded.

Figures & tables

Figure 1: Task-relative selective decoding. The authorized profile and the frozen probe’s visible-prefix state meet in the residual; the two-dimensional region illustrates the fitted geometry. Boundary exceedance and remaining position and KL allowances enable candidate evaluation. The paired continuations express contrasting priorities under a shared content guard. Along the decoding ribbon, cinnabar marks a changed sampling kernel, counted by

I_{t}

;

K_{t}

is that step’s conditional KL cost. Unchanged kernels consume neither allowance. The task, trajectory, responses, and ribbon are constructed illustrations; profile and state cells indicate dimensions.

Figure 2: One guarded decoding step. Four layer taps and a frozen probe yield the visible-prefix state. The external profile enters the residual; the mixture provides a gate and a posterior residual mean (star), translated and clipped into the scoring prototype. Boundary exceedance and remaining allowances enable evaluation of the top 32 candidate prefixes. Signed progress is scaled and clipped before a KL search selects the feasible tilt. Edited and unchanged kernels share one sampling path. The ledger records the kernel-change indicator

I_{t}

and conditional cost

K_{t}=D_{KL}(\tilde{p}_{t}^{H}\|p_{t}^{H})

before the sampled-prefix guard; a sample that triggers the guard retains its cost. Pre-step balances feed eligibility and KL search. Objects, bars, and geometry are schematic.

Method	AUPRC $\uparrow$	AUROC $\uparrow$	Macro-F1 $\uparrow$	Risk recall $\uparrow$	Benign FPR $\downarrow$	TPR@5% $\uparrow$	FPR@95% $\downarrow$
Content/output guard	.86 $\pm$ .025	.82 $\pm$ .025	.62 $\pm$ .03	.68 $\pm$ .03	.04 $\pm$ .01	.45 $\pm$ .04	.38 $\pm$ .04
Global boundary	.90 $\pm$ .02	.87 $\pm$ .02	.68 $\pm$ .025	.74 $\pm$ .025	.05 $\pm$ .01	.58 $\pm$ .035	.28 $\pm$ .035
Context-conditioned	.95 $\pm$ .015	.92 $\pm$ .015	.76 $\pm$ .025	.83 $\pm$ .02	.04 $\pm$ .01	.72 $\pm$ .03	.18 $\pm$ .03
LaVGuard	.96 $\pm$ .015	.93 $\pm$ .015	.79 $\pm$ .02	.86 $\pm$ .02	.04 $\pm$ .01	.76 $\pm$ .03	.15 $\pm$ .025

Table 1: Profile-relative boundary detection. TPR@5% and FPR@95% are ROC operating points; risk recall and benign FPR use the study’s deployed threshold. Entries are mean

\pm

s.d.

Method	Single F1 $\uparrow$	Risk F1 $\uparrow$	Risk safety $\uparrow$	Risk pass $\uparrow$	Benign safety $\uparrow$	Over-refusal $\downarrow$	Token ratio $\downarrow$	Latency (ms) $\downarrow$
Base	.76 $\pm$ .03	.55 $\pm$ .025	.55 $\pm$ .03	.62 $\pm$ .035	.84 $\pm$ .015	.03 $\pm$ .008	.00 $\pm$ .00	720 $\pm$ 20
SafeInfer	.82 $\pm$ .025	.58 $\pm$ .025	.76 $\pm$ .025	.82 $\pm$ .025	.79 $\pm$ .02	.18 $\pm$ .015	.00 $\pm$ .00 †	760 $\pm$ 30
LaVGuard	.87 $\pm$ .02	.84 $\pm$ .02	.88 $\pm$ .02	.91 $\pm$ .02	.81 $\pm$ .018	.08 $\pm$ .01	.12 $\pm$ .012	830 $\pm$ 40

Table 2: Response outcomes and cost within the matched-decoding study (mean

\pm

s.d.).

\dagger

Token ratios retain the source reporting convention; SafeInfer’s zero does not establish an unchanged sampling kernel under Equation ( 2 ).

Method	Token prec. $\uparrow$	Token rec. $\uparrow$	Gain/token $\uparrow$	Risk safety $\uparrow$	Benign utility $\uparrow$	Token ratio $\downarrow$	Mean KL $\downarrow$
Random token	.18 $\pm$ .04	.20 $\pm$ .04	.015 $\pm$ .005	.70 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.04 $\pm$ .006
Position-matched	.22 $\pm$ .04	.24 $\pm$ .04	.020 $\pm$ .006	.72 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.04 $\pm$ .006
All-token	1.00 $\pm$ .00	1.00 $\pm$ .00	.035 $\pm$ .007	.89 $\pm$ .02	.68 $\pm$ .025	1.00 $\pm$ .00	.18 $\pm$ .015
Boundary only	.00 $\pm$ .00	.00 $\pm$ .00	.000 $\pm$ .000	.76 $\pm$ .025	.82 $\pm$ .02	.00 $\pm$ .00	.00 $\pm$ .00
Current key token	.45 $\pm$ .05	.52 $\pm$ .05	.060 $\pm$ .010	.82 $\pm$ .025	.80 $\pm$ .02	.15 $\pm$ .015	.05 $\pm$ .008
LaVGuard	.62 $\pm$ .04	.70 $\pm$ .04	.105 $\pm$ .012	.88 $\pm$ .02	.81 $\pm$ .018	.12 $\pm$ .012	.04 $\pm$ .006

Table 3: Complete token-selection comparison (mean

\pm

s.d.). Random, position-matched, and LaVGuard share a reported mean token ratio of

.12

. Benign utility and mean KL expose the cost of all-token intervention alongside risk safety and localization quality.

Method	Risk F1 $\uparrow$	Risk safety $\uparrow$	Benign safety $\uparrow$	Benign FPR $\downarrow$	Token ratio $\downarrow$	Mean KL $\downarrow$
No boundary	.58 $\pm$ .03	.72 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.16 $\pm$ .015	.06 $\pm$ .008
Global boundary	.70 $\pm$ .025	.78 $\pm$ .025	.80 $\pm$ .02	.08 $\pm$ .012	.14 $\pm$ .015	.05 $\pm$ .008
No uncertainty	.76 $\pm$ .025	.81 $\pm$ .025	.78 $\pm$ .02	.07 $\pm$ .010	.15 $\pm$ .015	.06 $\pm$ .008
No token budget	.83 $\pm$ .02	.89 $\pm$ .02	.73 $\pm$ .025	.06 $\pm$ .010	.34 $\pm$ .030	.10 $\pm$ .012
No KL budget	.83 $\pm$ .02	.88 $\pm$ .02	.74 $\pm$ .025	.06 $\pm$ .010	.18 $\pm$ .020	.13 $\pm$ .015
Fixed target	.77 $\pm$ .025	.80 $\pm$ .025	.78 $\pm$ .02	.08 $\pm$ .012	.14 $\pm$ .015	.06 $\pm$ .008

Table 4: Complete component ablations (mean

\pm

s.d.). Token ratio and mean KL are study-level readouts. No-uncertainty and fast-scoring rows retain the source evaluation configurations; the reference specification uses a single frozen probe.

Figure 3: Selection and budget comparisons. (a) Safety–utility outcomes for six selection rules. (b) Precision versus gain for Random, Position-matched, and LaVGuard, matched on reported mean token ratio

.12

and mean KL

.04

. (c) Full control versus removal of either budget; lines compare configuration means, not trajectories. Whiskers show each coordinate’s reported standard deviation. Short method names follow Tables 3 and 4 .

Figure 4: Transfer, dialogue, and runtime in their respective studies. (a) Transfer risk F1 and worst-group score. (b) Earlier detection and lower cumulative risk lie toward the lower left; points are five method aggregates, not a trajectory. (c) Mean and P95 latency from the independent efficiency study, in seconds on a logarithmic axis. Lines join the two latency statistics; error bars throughout show reported standard deviations. “Full”/“Fast” denote LaVGuard/LaVGuard-fast; “Key token”/“Lookahead” abbreviate the methods in Tables 14 – 15 .

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Definition and role
$x,c_{obs},c$	Request, visible task context, and complete application contract.
$y_{<t},T,\mathcal{V}$	Generated prefix, padded generation horizon, and vocabulary.
$\boldsymbol{\pi}(c)\in[0,1]^{D}$	Authorized reference profile; $D=10$ in the documented configuration.
$\mathbf{q}_{<t},\bar{\mathbf{v}}_{<t}$	Normalized intensity annotation and predicted prefix state.
$\mathcal{L},W,P_{\ell}$	Probe tap layers, pooling window, and learned layer projections.
$\mathbf{r}_{<t}$	Profile-relative residual $\bar{\mathbf{v}}_{<t}-\boldsymbol{\pi}(c)$ .

Appendix

Table 5: Symbol index. A state, an annotation, a task profile, and a sampling distribution are separate objects throughout the derivations.

Component	Setting	Execution role
Backbone	Qwen2.5-7B-Instruct, frozen	Base logits and hidden states.
Probe taps	25, 50, 75, 100% depth; $W=16$	Pool the visible prefix.
Probe projections	Width 64 per tap; sigmoid output	Ten simultaneous intensity estimates.
Probe optimization	AdamW; $2\!\times\!10^{-4}$ ; batch 16; patience 10	Fit before boundary estimation.
Boundary	$K=2$ ; diagonal shrinkage $.10$	Density of admissible residuals.
Threshold	Maximum recall subject to validation benign FPR $\leq.05$	Select the activation rule.

Appendix

Table 6: Controller configuration. Probe fitting precedes boundary fitting, and both precede threshold selection and decoding.

Figure 5: Two exact mathematical examples. Left: the mixture in Proposition C.2 admits states near

.2

and

.8

at density threshold

1

, while its posterior-mean prototype at

.5

lies outside the set. Right: for

p=(.45,.40,.15)

and

d=(1,-1,.2)

, KL increases with the tilt scale. The marked endpoint is returned by 20 feasible-bracket bisections with cap

.02

. Curves are analytically computed functions, not empirical fits.

Token	Base $p$	Signed $q_{.2}$	Positive $q_{.2}$
$w_{1}$	.400	.360	.449
$w_{2}$	.200	.199	.184
$w_{3}$	.250	.275	.230
$w_{4}$	.150	.165	.138
Tail mass	.400	.440	.367
Tail odds	$5{:}3$	$5{:}3$	$5{:}3$

Appendix

Table 7: Constructed tail redistribution with

q_{i}\propto p_{i}e^{.2d_{i}}

. Signed:

d=(-1,-\tfrac{1}{2},0,0)

; positive:

d=(1,0,0,0)

, as in Appendix H . Tokens

w_{3},w_{4}

are unscored. Values and totals are rounded independently; these are analytical probabilities.

Method	Accuracy $\uparrow$	Macro-F1 $\uparrow$	Risk recall $\uparrow$	Benign FPR $\downarrow$	ECE $\downarrow$	Spearman $\uparrow$
Prompt	.72 $\pm$ .03	.58 $\pm$ .03	.62 $\pm$ .035	.18 $\pm$ .015	.14 $\pm$ .01	.72 $\pm$ .025
SafeDecoding	.74 $\pm$ .03	.60 $\pm$ .03	.66 $\pm$ .035	.16 $\pm$ .015	.13 $\pm$ .01	.74 $\pm$ .025
Latent detector only	.82 $\pm$ .025	.74 $\pm$ .025	.80 $\pm$ .025	.09 $\pm$ .01	.08 $\pm$ .008	.86 $\pm$ .02
LaVGuard	.85 $\pm$ .02	.78 $\pm$ .02	.84 $\pm$ .02	.07 $\pm$ .008	.06 $\pm$ .006	.89 $\pm$ .015

Appendix

Table 8: Prefix prediction and calibration. Risk recall, benign FPR, ECE, and ordinal ranking retain their separate readouts. Cells show mean

\pm

standard deviation.

Method	AUPRC $\uparrow$	AUROC $\uparrow$	Macro-F1 $\uparrow$	Risk recall $\uparrow$	Benign FPR $\downarrow$	TPR@5 $\uparrow$	FPR@95 $\downarrow$
Content/output guard	.86 $\pm$ .025	.82 $\pm$ .025	.62 $\pm$ .03	.68 $\pm$ .03	.04 $\pm$ .01	.45 $\pm$ .04	.38 $\pm$ .04
Global boundary	.90 $\pm$ .02	.87 $\pm$ .02	.68 $\pm$ .025	.74 $\pm$ .025	.05 $\pm$ .01	.58 $\pm$ .035	.28 $\pm$ .035
Context-conditioned boundary	.95 $\pm$ .015	.92 $\pm$ .015	.76 $\pm$ .025	.83 $\pm$ .02	.04 $\pm$ .01	.72 $\pm$ .03	.18 $\pm$ .03
LaVGuard	.96 $\pm$ .015	.93 $\pm$ .015	.79 $\pm$ .02	.86 $\pm$ .02	.04 $\pm$ .01	.76 $\pm$ .03	.15 $\pm$ .025

Appendix

Table 9: Boundary discrimination and operating points. TPR@5 denotes TPR at 5% FPR; FPR@95 denotes FPR at 95% TPR. These curve-derived values are distinct from the deployed-threshold recall. Cells show mean

\pm

standard deviation.

Method	Single F1 $\uparrow$	Risk F1 $\uparrow$	Risk safety $\uparrow$	Risk pass $\uparrow$	Benign safety $\uparrow$	Over- refusal $\downarrow$	Token ratio $\downarrow$	Latency (ms) $\downarrow$
Base	.76 $\pm$ .03	.55 $\pm$ .025	.55 $\pm$ .03	.62 $\pm$ .035	.84 $\pm$ .015	.03 $\pm$ .008	.00 $\pm$ .00	720 $\pm$ 20
SafeInfer	.82 $\pm$ .025	.58 $\pm$ .025	.76 $\pm$ .025	.82 $\pm$ .025	.79 $\pm$ .02	.18 $\pm$ .015	.00 $\pm$ .00 †	760 $\pm$ 30
LaVGuard	.87 $\pm$ .02	.84 $\pm$ .02	.88 $\pm$ .02	.91 $\pm$ .02	.81 $\pm$ .018	.08 $\pm$ .01	.12 $\pm$ .012	830 $\pm$ 40

Appendix

Table 10: Matched decoding comparison. Response-safety scores, risk pass rate, over-refusal, and intervention ratio retain their study readouts. Cells show mean

\pm

standard deviation.

\dagger

SafeInfer’s source-reported zero token ratio cannot be interpreted as zero changed-kernel intervention under Equation ( 2 ).

Method	Token prec. $\uparrow$	Token rec. $\uparrow$	Gain/ token $\uparrow$	Risk safety $\uparrow$	Benign utility $\uparrow$	Token ratio $\downarrow$	Mean KL $\downarrow$
Random token	.18 $\pm$ .04	.20 $\pm$ .04	.015 $\pm$ .005	.70 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.04 $\pm$ .006
Position-matched	.22 $\pm$ .04	.24 $\pm$ .04	.020 $\pm$ .006	.72 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.04 $\pm$ .006
All-token	1.00 $\pm$ .00	1.00 $\pm$ .00	.035 $\pm$ .007	.89 $\pm$ .02	.68 $\pm$ .025	1.00 $\pm$ .00	.18 $\pm$ .015
Boundary only	.00 $\pm$ .00	.00 $\pm$ .00	.000 $\pm$ .000	.76 $\pm$ .025	.82 $\pm$ .02	.00 $\pm$ .00	.00 $\pm$ .00
Current key token	.45 $\pm$ .05	.52 $\pm$ .05	.060 $\pm$ .010	.82 $\pm$ .025	.80 $\pm$ .02	.15 $\pm$ .015	.05 $\pm$ .008
LaVGuard	.62 $\pm$ .04	.70 $\pm$ .04	.105 $\pm$ .012	.88 $\pm$ .02	.81 $\pm$ .018	.12 $\pm$ .012	.04 $\pm$ .006

Appendix

Table 11: Token-localization controls. Token precision/recall and gain per token use the original reporting labels; Section F states the measurement conventions. Cells show mean

\pm

standard deviation.

Method	Risk F1 $\uparrow$	Risk safety $\uparrow$	Benign safety $\uparrow$	Benign FPR $\downarrow$	Token ratio $\downarrow$	Mean KL $\downarrow$
No boundary	.58 $\pm$ .03	.72 $\pm$ .03	.79 $\pm$ .02	.12 $\pm$ .015	.16 $\pm$ .015	.06 $\pm$ .008
Global boundary	.70 $\pm$ .025	.78 $\pm$ .025	.80 $\pm$ .02	.08 $\pm$ .012	.14 $\pm$ .015	.05 $\pm$ .008
No uncertainty	.76 $\pm$ .025	.81 $\pm$ .025	.78 $\pm$ .02	.07 $\pm$ .010	.15 $\pm$ .015	.06 $\pm$ .008
No token budget	.83 $\pm$ .02	.89 $\pm$ .02	.73 $\pm$ .025	.06 $\pm$ .010	.34 $\pm$ .030	.10 $\pm$ .012
No KL budget	.83 $\pm$ .02	.88 $\pm$ .02	.74 $\pm$ .025	.06 $\pm$ .010	.18 $\pm$ .020	.13 $\pm$ .015
Fixed target	.77 $\pm$ .025	.80 $\pm$ .025	.78 $\pm$ .02	.08 $\pm$ .012	.14 $\pm$ .015	.06 $\pm$ .008

Appendix

Table 12: Component ablations. The uncertainty and fast-scoring variants are evaluation configurations distinct from the single-probe reference specification. Cells show mean

\pm

standard deviation.

Method	Single F1 $\uparrow$	Risk F1 $\uparrow$	Risk safety $\uparrow$	Benign safety $\uparrow$	Worst group $\uparrow$	OOD drop $\downarrow$
Base	.74 $\pm$ .03	.52 $\pm$ .035	.50 $\pm$ .035	.82 $\pm$ .02	.45 $\pm$ .035	.05 $\pm$ .010
SafeInfer	.78 $\pm$ .03	.55 $\pm$ .035	.72 $\pm$ .03	.77 $\pm$ .025	.62 $\pm$ .035	.06 $\pm$ .012
LaVGuard	.82 $\pm$ .03	.78 $\pm$ .03	.83 $\pm$ .03	.79 $\pm$ .025	.74 $\pm$ .035	.05 $\pm$ .012

Appendix

Table 13: Transfer evaluation. OOD drop is the reported in-domain-relative difference; worst-group score preserves the original group-level summary. Cells show mean

\pm

standard deviation.

Method	First detect. $\downarrow$	Cumul. risk $\downarrow$	Turn recall $\uparrow$	Risk safety $\uparrow$	Benign utility $\uparrow$	Over- refusal $\downarrow$
Base	4.2 $\pm$ .50	.46 $\pm$ .04	.48 $\pm$ .04	.52 $\pm$ .035	.84 $\pm$ .015	.03 $\pm$ .008
SafeInfer	3.1 $\pm$ .45	.30 $\pm$ .03	.68 $\pm$ .03	.75 $\pm$ .025	.76 $\pm$ .025	.20 $\pm$ .015
Current key token	2.8 $\pm$ .40	.26 $\pm$ .03	.72 $\pm$ .03	.78 $\pm$ .025	.78 $\pm$ .025	.14 $\pm$ .015
LaVGuard-fast	2.3 $\pm$ .35	.21 $\pm$ .025	.79 $\pm$ .025	.83 $\pm$ .022	.80 $\pm$ .020	.10 $\pm$ .010
LaVGuard	2.0 $\pm$ .35	.18 $\pm$ .025	.83 $\pm$ .022	.86 $\pm$ .020	.80 $\pm$ .020	.08 $\pm$ .010

Appendix

Table 14: Multi-turn dialogue. First detection is expressed in turns; cumulative risk and turn recall retain their source aggregation labels. Cells show mean

\pm

standard deviation.

Method	Mean ms $\downarrow$	P95 ms $\downarrow$	$\Delta$ MB $\downarrow$	Extra passes $\downarrow$	Token ratio $\downarrow$	$\Delta$ utility $\uparrow$
Base	720 $\pm$ 20	900 $\pm$ 50	0 $\pm$ 0	0.0 $\pm$ 0.0	.00 $\pm$ .00	.00 $\pm$ .00
SafeInfer	760 $\pm$ 30	950 $\pm$ 60	200 $\pm$ 50	.2 $\pm$ .05	.00 $\pm$ .00 †	-.03 $\pm$ .008
All-token	1120 $\pm$ 80	1450 $\pm$ 100	1800 $\pm$ 200	1.0 $\pm$ .0	1.00 $\pm$ .00	-.10 $\pm$ .015
One-step lookahead	2800 $\pm$ 300	4200 $\pm$ 400	2500 $\pm$ 250	3.0 $\pm$ .20	.12 $\pm$ .012	-.02 $\pm$ .008
LaVGuard	920 $\pm$ 50	1200 $\pm$ 80	1200 $\pm$ 150	.8 $\pm$ .10	.12 $\pm$ .012	-.02 $\pm$ .008
LaVGuard-fast	820 $\pm$ 40	1050 $\pm$ 70	800 $\pm$ 120	.4 $\pm$ .05	.10 $\pm$ .012	-.01 $\pm$ .006

Appendix

Table 15: Runtime and resource efficiency. Memory is reported as a delta. These study-specific latency values are not substituted for those in the matched-decoding comparison. Cells show mean

\pm

standard deviation.

\dagger

The SafeInfer zero is the source-reported token ratio, not a measurement of unchanged sampling kernels under Equation ( 2 ).

Decision quantity	Workshop	Replication
Squared residual norm	$.02$	$.50$
Boundary excess	$-.53125$	$5.46875$
Candidate evaluation	no	yes
Selected scale	$0$	$.838114$
Probability of $w_{1}$	$.450000$	$.389721$
Probability of $w_{2}$	$.400000$	$.468422$

Appendix

Table 16: Constructed paired decision trace. All displayed quantities follow from the assigned profiles, states, and probabilities. The final KL entry is rounded; the feasible value before rounding is

.0299999848

LLM Alignment

Large language model alignment studies methods for making models follow human intentions, values, and safety constraints across contexts.

See all 611 papers

Jul 15, 2026

SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing

LLM agents act on real-world environments through tool calls, and a single misjudged action can cause irreversible harm. The standard safeguard is a guard model that labels each proposed action as safe or unsafe, but this binary view conflates two distinct decisions: whether the action is harmful in itself, and whether it is appropriate given the user's context. It also operates at the granularity of action categories rather than individual instances, producing routine interruptions that erode autonomy and train users to wave through the most consequential alerts. We reframe the problem as a per-instance three-way routing decision over {EXECUTE, ASK, REFUSE} and instantiate it with Safety Sentry, a lightweight guard model whose inference reduces to a single decoding call. A single decoding-time threshold lets one fixed checkpoint be re-positioned across deployments of differing risk tolerance without retraining. Safety Sentry outperforms a broad set of open-weight and frontier closed-source baselines on overall accuracy and safety-related recall, while controlling both directional error rates simultaneously.Code and data are available at https://github.com/safesentry/SAFETY-SENTRY

Tianyu Chen, Chujia Hu, Wenjie Wang

ShanghaiTech University, Shanghai, China

Language Model Safety Evaluation LLM Guardrails Human-in-the-Loop AI Safety Filtering LLM Agent Safety

Ask PDF

May 14, 2026

Selective Safety Steering via Value-Filtered Decoding

While large language models (LLMs) are trained to align with human values, their generations may still violate safety constraints. A growing line of work addresses this problem by modifying the model's sampling policy at decoding time using a safety reward. However, existing decoding-time steering methods often intervene unnecessarily, modifying generations that would have been safe under the base model. Such unnecessary interventions are undesirable, as they can distort key properties of the base model such as helpfulness, fluency, style, and coherence. We propose a new test-time steering method designed to reduce such unnecessary interventions while improving the safety of unsafe responses. Our approach filters tokens using a value-based safety criterion and provides an explicit bound on the probability of false interventions. A single threshold hyperparameter controls this bound, allowing practitioners to trade off higher rates of unnecessary intervention for better output safety. Across multiple datasets and experiments, we show that our value-filtered decoding method outperforms existing baselines, achieving better trade-offs between safety, helpfulness, and similarity to the base model.

Bat-Sheva Einbinder, Hen Davidov, Yee Whye Teh +2

Department of Electrical and Computer Engineering, Technion IIT, Israel · Department of Statistics, University of Oxford, Oxford, UK · OATML, Department of Computer Science, University of Oxford, Oxford, UK +1

Language Model Decoding Language Model Steering Safety Filtering LLM Safety

Ask PDF

Mar 28, 2026

SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do

When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.

Aditya Dhodapkar, Farhaan Pishori

Rensselaer Polytechnic Institute Department of Computer Science · Santa Clara University Department of Engineering

AI Agent Safety LLM Agent Safety LLM Safety Monitoring AI Agent Monitoring

Ask PDF

Abstract

LLM Alignment

Explore similar work

SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing

Selective Safety Steering via Value-Filtered Decoding

SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do