DIESEL : A Lightweight Inference-Time Safety Enhancement for Language Models (2025)

Abstract: Large language models (LLMs) have demonstrated impressive performance across a wide range of tasks, including open-ended dialogue, driving advancements in virtual assistants and other interactive systems. However, these models often generate outputs misaligned with human values, such as ethical norms and safety constraints, resulting in potentially harmful or inappropriate responses. While several techniques have been proposed to address this problem, they typically involve computationally intensive training procedures or introduce substantial inference-time latency. In this paper, we present DIESEL, a lightweight inference-guidance technique that can be seamlessly integrated into any autoregressive LLM to semantically filter undesirable content during generation. DIESEL guides generation by reranking token candidates according to their semantic similarity to predefined negative concepts in the latent space. It can serve either as a standalone safeguard or as an auxiliary defense layer, enhancing response safety without requiring model fine-tuning or additional data. We demonstrate DIESEL’s effectiveness on state-of-the-art conversational models, including in adversarial jailbreak scenarios. Furthermore, we show that DIESEL generalizes beyond safety applications, enabling flexible and domain-specific response filtering.

## introduction large language models (llms), particularly those designed for conversational tasks, have achieved state-of-the-art performance across a wide range of applications, including open-ended dialogue, question answering, and personalized dialogue @xcite . these advancements have enabled llms to produce fluent, con-* equal contribution textually grounded responses, fostering more natural and adaptive user experiences. consequently, llms are now widely deployed in both personal and professional domains, serving as core components in tools such as virtual assistants, chatbots, and customer support systems. despite these impressive achievements and capabilities, llms remain susceptible to generating responses that may not align with human values, such as toxic content @xcite , malicious use cases @xcite , and vulnerabilities to adversarial jailbreak attacks @xcite . the increasing accessibility and deployment of these models amplifies the associated risks, heightening the potential for real-world harm. recent studies have explored alignment @xcite @xcite , filtering @xcite @xcite , and inference guidance @xcite @xcite to enhance llm safety. alignment techniques, such as reinforcement learning from human feedback (rlhf) @xcite , incorporate user preferences but suffer from scalability issues, incomplete value capture @xcite , robustness concerns @xcite @xcite , and susceptibility to poisoning attacks @xcite . these methods also require significant computational and human annotation costs. filtering approaches, both rule-based @xcite @xcite and model-based @xcite @xcite , focus on detecting and suppressing harmful responses by defaulting to generic refusals (e.g., "as an ai model, i cannot..."), which may interrupt conversational fluency. inference-guidance methods such as rain @xcite and safedecoding @xcite intervene during generation to steer outputs away from harmful content. however, rain incurs substantial inferencetime overhead due to its search-and-backward process, while safedecoding requires training an additional expert model. both methods rely on static safety definitions, which limits their adaptability to evolving safety standards and nuanced contexts. given the limitations of existing techniques, there is a growing need for methods that operate efficiently at inference time, offering practical solutions that can complement existing safeguards or serve as lightweight alternatives to traditional safety mechanisms. to address this gap, in this paper, we introduce diesel, a flexible and efficient inference-guidance technique that imposes minimal overhead and requires no additional model training. diesel enhances response safety by reranking the tokens proposed by the llm based on their similarity to predefined negative concepts, steering the generation process away from undesirable responses. additionally, diesel incorporates an immediate termination mechanism that halts response generation entirely if no sufficiently safe candidates are available at any step, preventing unsafe completions from being produced. an example is shown in figure 1 . importantly, diesel aims to maintain the flow of conversation by providing nuanced, "soft" responses rather than outright refusal, unless safety concerns necessitate termination. diesel consists of three steps: candidate selection, semantic latent space similarity to negative concepts, and token reranking. by us-ing a lightweight off-the-shelf sentence embedding model, diesel effectively guides the decoding process towards safer outputs based on simple textual descriptions of negative concepts. utilizing textual descriptions allows diesel to seamlessly adapt to evolving safety requirements by enabling the dynamic addition or removal of undesirable concepts without requiring specialized expertise, retraining, or modifications to the model. we conduct a comprehensive evaluation of diesel, analyzing its effectiveness across multiple state-of-the-art conversational llms (e.g., llama 3 (meta, 2024)), both as a standalone safeguard and as an additional layer of defense. furthermore, we assess diesel's resilience against jailbreaking attacks (e.g., gcg @xcite ), demonstrating its ability to mitigate adversarial manipulation effectively. to verify that diesel does not compromise the models' overall performance on benign prompts, we evaluate its impact using popular benchmarks (e.g., truthfulqa @xcite ). additionally, we assess diesel's generalization capabilities, specifically its effectiveness in filtering out concepts beyond conventional safety-related domains. our experiments show that diesel surpasses state-of-the-art techniques while achieving significant improvements in runtime efficiency, reducing computational overhead, and maintaining high response quality. our contributions can be summarized as follows: • we present diesel, a lightweight inferenceguidance technique that filters out undesired outputs; diesel can be easily integrated into any autoregressive llm without requiring any finetuning or additional data collection. ## conclusion in this paper, we introduced diesel, a novel and lightweight inference-guidance technique designed to enhance the safety of responses generated by llms. our results demonstrate that diesel effectively mitigates harmful outputs while preserving utility, making it a practical and efficient solution for real-world deployment. through extensive evaluations against state-of-the-art defenses, including other inference-guidance methods, we highlighted diesel's key advantages, notably its significantly lower runtime overhead, which ensures feasibility for real-time applications. additionally, we assessed diesel's robustness against jailbreak attacks, showing that it provides an additional layer of defense even in adversarial settings, reinforcing its effectiveness beyond standard safety mechanisms. a critical strength of diesel lies in its flexibility and ease of use: it relies solely on simple textual descriptions of negative concepts, making it adaptable, easily updated, and accessible to non-experts without requiring model fine-tuning or specialized expertise. future work could explore adaptive safety mechanisms that dynamically adjust negative concept representations based on context, as well as extensions to multi-turn dialogues where safety concerns may arise progressively over the course of a conversation.