Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge

2026-10-05

AI Summary

This study addresses the security-utility trade-off and architecture dependency inherent in existing decoding-stage defenses for large language models (LLMs) by proposing a cross-model universal defense method based on first-token dark knowledge. The approach mines latent safety signals within dark knowledge, constructing a model-agnostic defense direction through Top-k extraction and tokenizer mapping, while employing k-nearest neighbor (kNN) classification for jailbreak attack detection. Experimental results demonstrate that this framework significantly reduces attack success rates across diverse LLMs, effectively overcoming architecture-specific limitations and achieving an optimal balance between security and utility.

Abstract

LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect and defend against attacks including defenses at decoding stage that leverage models' hidden states. However, existing decoding-stage defenses suffer from two limitations. First, they introduce a trade-off between safety and over-refusal, where strengthening safety degrades the model's helpfulness on benign queries. Second, many of these methods rely on internal hidden states and are thus restricted to specific architectures, incurring substantial overhead and limited generalization across models. To address these limitations, we introduce LADE (Latent Safety Signals for Defense), which leverages latent safety signals extracted by contrasting harmful and benign queries from dark knowledge (i.e., information carried by the output probability distribution beyond its argmax) in the first-token output probability distribution. Our key insight is that, beyond surface-level refusal tokens, the dark knowledge in the first-token distribution contains latent safety signals, defined as tokens whose probabilities differ sharply between harmful and benign queries. We show that these signals consistently align across LLMs, forming a model-agnostic direction that emerges from safety alignment. LADE consists of three components: (1) Extracting Latent Safety Signals from Dark Knowledge, which selects top-k safety-discriminative tokens from the first-token probability distribution; (2) Tokenizer Mapping, which maps these tokens across different tokenizers to enable model-agnostic application; and (3) kNN-based Discrimination, which classifies queries via a k-Nearest Neighbors search over the mapped tokens. Across diverse LLMs and benchmarks, LADE is robust against a wide range of jailbreak attacks and lowers attack success rates while maintaining a competitive safety-utility trade-off.

Problem

• LLM safety
• decoding-stage defense
• over-refusal
• model-agnostic
• dark knowledge

Innovation

• Dark Knowledge
• Model-Agnostic
• Latent Safety Signals
• Decoding-stage Defense
• Tokenizer Mapping