🤖 AI

Exploring and Developing a Pre-Model Safeguard with Draft Models

This paper proposes a pre-model safeguard that leverages the transferability of jailbreak attacks from large language models to smaller draft models to generate draft responses, thereby enabling existing guards to more accurately detect unsafe prompts before target model inference while avoiding the high computational costs of post-model auditing.

Original authors: Hongyu Cai, Arjun Arunasalam, Yiming Liang, Antonio Bianchi, Z. Berkay Celik

Published 2026-05-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hongyu Cai, Arjun Arunasalam, Yiming Liang, Antonio Bianchi, Z. Berkay Celik

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Security Guard" vs. The "Master of Disguise"

Imagine you have a very powerful, intelligent robot (a Large Language Model, or LLM) that can write stories, solve math problems, and answer questions. You want this robot to be helpful but safe—it shouldn't write hate speech, give instructions on how to build bombs, or spread lies.

To keep it safe, you hire a Security Guard (a "Pre-model Guard") to stand at the door. The guard looks at every question (prompt) the user asks before letting the robot see it. If the question looks dangerous, the guard stops it.

The Flaw:
Bad actors (hackers) have learned how to dress up their dangerous questions in innocent-looking clothes. They use clever tricks called "jailbreaks" to trick the Security Guard.

Analogy: Imagine a criminal trying to sneak a weapon into a bank. Instead of carrying a gun, they hide it inside a box labeled "Birthday Cake." The Security Guard sees "Birthday Cake," thinks it's safe, and lets it through. Once inside, the robot opens the box, finds the weapon, and does something harmful.

The paper notes that these "Pre-model Guards" often miss these disguised attacks because they only look at the question, not the answer the robot might give.

The Alternative: The "Slow and Expensive" Check

There is another way to check for safety: Let the robot answer the question first, and then have a second guard check the answer.

Analogy: Let the robot bake the cake, then have a second guard taste it to see if there's poison inside.
The Problem: This is very slow and expensive. If the robot is huge (like a 70-billion-parameter model), baking the cake takes a long time and uses a lot of electricity. Even if the second guard says, "Stop! This is poison," you've already wasted all that time and money baking the cake.

The New Solution: The "Small Draft Model"

The authors propose a clever middle ground. They suggest using a tiny, fast robot (a "Small Language Model" or SLM) to act as a "draft" or a "test run" before the big robot ever sees the question.

Here is how their new system works, step-by-step:

1. The "Shadow" Test

When a user asks a question, instead of sending it directly to the big robot, the system first sends it to the tiny robot.

Analogy: Before the big chef cooks a complex dish, a tiny, fast sous-chef tries to make a tiny, rough version of it in a test kitchen.

2. The Magic of "Transferability"

The paper discovered something surprising: Bad questions that trick the big robot also tend to trick the tiny robot.

The Discovery: If a hacker writes a question designed to make the big robot say something evil, that same question will often make the tiny robot say something evil too.
Analogy: If a specific lock-pick tool works on the heavy, expensive front door of a bank, it will likely also work on the flimsy, cheap back door of the same building. The "weakness" transfers from the big door to the small one.

3. The "Batch" Strategy

The system doesn't just ask the tiny robot once. It asks it many times (like asking 20 different tiny robots to try the same question).

Analogy: Imagine asking 20 different small sous-chefs to try to bake that "Birthday Cake." Even if the cake looks innocent, if 5 of the 20 tiny chefs accidentally spill poison while trying to bake it, you know the recipe is dangerous.

4. The Decision

The system looks at the answers from the tiny robots.

If the tiny robots generate safe answers, the system assumes the question is safe and lets the Big Robot answer.
If the tiny robots generate unsafe answers (or even just one unsafe answer out of many), the system blocks the question immediately. The Big Robot never sees it, saving time and money.

Why This is Better

The paper tested this idea against the old methods and found:

It catches more bad guys: The old "Security Guard" (Pre-model) missed about 32% of the disguised attacks. This new "Tiny Robot" method catches almost all of them because the tiny robot reveals the hidden danger in the question.
It's much faster: The "Slow and Expensive" method (Post-model) takes a long time because it waits for the Big Robot to finish. This new method is nearly as fast as the old Security Guard because the tiny robot is super quick.
- Result: It reduced the time it takes to get a safe answer by 97% compared to the slow method.
It doesn't block good people: For normal, safe questions (like "How do I make a sandwich?"), the tiny robot behaves just like the big one. The system blocks almost no innocent questions, keeping the experience smooth for regular users.

Summary

The paper introduces a security system that uses a small, fast "test robot" to predict if a question is dangerous. Because bad questions tend to break both small and big robots, the small robot acts as a sensitive "canary in the coal mine." If the small robot gets confused or says something bad, we know the question is a trap, and we stop it before the big, expensive robot ever has to try. This makes AI safer without slowing it down.

Technical Summary: Exploring and Developing a Pre-Model Safeguard with Draft Models

Problem Statement

Large Language Models (LLMs) remain vulnerable to jailbreak attacks, which are designed to elicit unsafe or harmful responses that violate ethical and operational guidelines. Current defense mechanisms generally fall into two categories, each with significant limitations:

Pre-model guards: These audit prompts before they reach the target LLM. While computationally efficient, they suffer from high false-negative rates because they lack the context of the model's generated response. For instance, LlamaGuard 2 in pre-model mode detects only 71.6% of adversarial prompts generated by the AutoDAN attack against Llama-3-70B.
Post-model guards: These audit both the prompt and the generated response. While they offer higher detection accuracy by leveraging response context, they incur high computational costs (increased token usage and latency) because they require the target model to fully generate a response before the guard can intervene.

The core challenge is to design a defense system that achieves the high detection rates of post-model guards without incurring their computational overhead, while improving upon the detection rates of pre-model guards.

Methodology

The authors propose a safeguard design that leverages the transferability of jailbreak attacks from Large Language Models (LLMs) to Small Language Models (SLMs). The central hypothesis is that jailbreak prompts crafted for a large target model will often induce unsafe responses in smaller "draft" models. By using these draft models to generate speculative responses, the system can assess prompt safety before invoking the expensive target model.

Key Components of the Design

Systematic Study of Transferability:
- The authors conducted an empirical investigation into the transferability of jailbreak prompts from LLMs (e.g., Llama-3-70B, Qwen1.5-72B, Phi-3) to SLMs (e.g., OPT-125M, SmolLM-135M, Qwen2.5-0.5B).
- They evaluated three jailbreak generation systems: GCG, AutoDAN, and PAIR.
- Key Finding: While raw transferability rates vary, the distribution of unsafe response ratios is distinguishable. Benign prompts yield an unsafe response ratio near zero in SLMs, whereas malicious prompts induce a "long-tail" distribution with non-zero unsafe ratios. This statistical gap serves as a defense signal.
Speculative Inference Safeguard:
The proposed system operates in two phases:
- Phase A: Speculative Inference (Pre-Target):
  - Response Generation: Upon receiving a prompt, a small draft model generates a batch of $b$ draft responses (e.g., $b=20$ ) using stochastic sampling (beam search and top-p).
  - Classification: These draft responses, along with the original prompt, are fed into an existing safety classifier (e.g., LlamaGuard in post-model mode).
  - Aggregation: The system aggregates the classification labels. If the proportion of draft responses flagged as unsafe exceeds a threshold $\tau$ , the prompt is deemed malicious, and a refusal is returned.
- Phase B: Target Model Inference:
  - If the prompt passes the speculative check, it is forwarded to the target LLM for final generation. No post-model guard is required for these passed prompts.

Key Contributions

Empirical Investigation: The paper provides a systematic study of jailbreak transferability from LLMs to SLMs, identifying that while transferability is not perfect, the distribution of unsafe responses for malicious prompts is statistically distinguishable from benign prompts.
Novel Defense Architecture: The authors introduce a pre-model defense mechanism that utilizes speculative inference with SLMs. This approach transforms transferability from an attack vector into a defensive asset.
Performance Optimization: The design achieves a low Defense Failure Rate (DFR) and significantly reduces prompt-to-response time compared to existing post-model guards, while maintaining high accuracy on benign prompts.
Open Source: The safeguard design and code are made available for public validation.

Experimental Results

The evaluation was conducted against three jailbreak systems (GCG, AutoDAN, PAIR) and three target models (Llama-3-70B, Qwen1.5-72B, Phi-3), comparing the proposed design (using OPT-125M or SmolLM-135M as draft models) against LlamaGuard 2 (pre- and post-model modes) and PerplexityGuard.

Defense Failure Rate (DFR):
- Compared to pre-model guards, the proposed design reduced the DFR by an average of 32.4% (specifically 32.37% for the OPT-based version).
- Compared to post-model guards, the proposed design reduced the DFR by an average of 17.38%.
Efficiency (Prompt-to-Response Time):
- Relative to post-model guards, the proposed design reduced the time required to detect and block attacks by 97.07% (e.g., reducing detection time for AutoDAN attacks on Llama-3 from ~101 seconds to under 1 second).
- The time overhead compared to pre-model guards was minimal, with an increase of only 0.59%.
Benign Accuracy:
- The safeguard maintained an accuracy of 98% on benign prompts, matching the performance of both pre- and post-model guard baselines.
- In contrast, PerplexityGuard showed lower accuracy (0.88) on benign prompts.

Significance and Claims

The paper claims that the transferability of jailbreak attacks, traditionally viewed as a vulnerability allowing attackers to bypass safety filters across different models, can be effectively repurposed as a defensive mechanism. By leveraging smaller, faster models to "probe" the safety of a prompt via speculative inference, the proposed safeguard offers a practical solution that bridges the gap between the efficiency of pre-model guards and the accuracy of post-model guards.

The authors emphasize that their approach does not require the draft model to be a perfect detector; rather, it relies on the statistical distinguishability of unsafe response distributions. This allows for a robust defense system that significantly lowers the risk of harmful content generation without the prohibitive computational costs associated with full target-model inference for every request. The work suggests that future defense strategies can move beyond simple prompt analysis to include lightweight, speculative response generation to enhance safety alignment.