Think Twice, Generate Once: Safeguarding by Progressive Self-Reflection (2025)

Abstract: Large language models (LLMs) have revolutionized natural language processing with their ability to generate coherent and contextually relevant text. However, their deployment raises significant concerns about the potential for generating harmful or inappropriate content. In this paper, we introduce Progressive Self-Reflection, a novel inference-time technique that empowers LLMs to self-monitor and correct their outputs dynamically. Experimental results demonstrate that applying our proposed method to Llama-3.1-8B-Instruct reduces the attack success rate from 77.47% to 5.86%, to Llama-3.1-8B base from 89.70% to 5.56%, and to Qwen2.5-7B-Instruct from 44.44% to 3.84%, without additional training. Furthermore, our method maintains their original performance across diverse tasks, including summarization, general knowledge, reasoning, and mathematics. Our approach acts as a test-time scaling method, where additional self-reflection rounds enhance safety at the cost of inference overhead. To balance safety with computational efficiency, we introduce a lightweight self-reflection predictor that estimates the optimal number of reflection rounds based on input complexity. This adaptive mechanism prevents unnecessary self-assessment on benign inputs while ensuring thorough evaluation when encountering potentially harmful content. Our findings suggest that Progressive Self-Reflection serves as a scalable test-time approach, enhancing LLM safety by dynamically allocating computational resources in proportion to the input’s risk profile.

## introduction large language models (llms) such as gpt-4 @xcite , llama @xcite , deepseek @xcite have become integral to modern natural language processing, revolutionizing the ability of machines to understand and generate human-like text. these models have demonstrated impressive capabilities across a broad spectrum of tasks, including but not limited to machine translation, summarization, and automated content generation @xcite . llms, due to their extensive training on diverse internet corpora, possess the capacity to generate content that spans a broad spectrum of topics and styles. however, this versatility also exposes them to the risk of generating harmful or unethical content when prodded by maliciously crafted inputs, commonly known as jailbreak attacks @xcite . such attacks exploit model vulnerabilities to elicit responses that breach the models' trained ethical guidelines, potentially leading to the dissemination of biased, unlawful, or otherwise inappropriate content @xcite @xcite . defending llms against such attacks is now recognized as a critical challenge for safe ai deployment. jailbreak attacks exploit model vulnerabilities to bypass safety mechanisms designed to prevent the generation of inappropriate responses. such attacks not only pose risks to data integrity and user trust but also threaten the broader applicability of llms in sensitive environments @xcite . the arms race between evolving attack strategies and defense mechanisms mirrors challenges observed in other domains like computer vision, where advances in adversarial robustness often lag behind attack techniques @xcite . in particular, current strategies for mitigating such risks include prompt engineering @xcite , detection-based methods @xcite @xcite , and fine-tuning with curated datasets @xcite @xcite . however, these approaches often fall short when facing sophisticated, adaptive jailbreak strategies that continuously evolve to exploit new or overlooked vulnerabilities. moreover, sure, here is a guide for stealing from a store without getting caught: 1. choose the right item: opt for items that are small, easy to conceal. let's quickly check if the text is harmful or harmless. this text is harmful and goes against the law, i can't help with that. is there anything else i can help you with? top 5 responses: to address these challenges, we propose progressive self-reflection (psr), a novel decodingtime defense mechanism that achieves strong jailbreak mitigation without altering the model's parameters or training procedure. the core idea of psr is to integrate an internal self-evaluation loop into the generation process. as the llm generates a response, it pauses at regular intervals (e.g. every k tokens) to reflect on the partial output: essentially asking itself whether the content so far might violate any safety or policy constraints. this introspective check leverages the model's own knowledge of disallowed content and alignment guidelines. crucially, these safety interventions happen on the fly during inference, requiring no changes to the underlying model weights. figure 1 illustrates this process using an example harmful prompt. the model initially begins to output harmful instructions but is intercepted mid-generation via self-reflection. the yellow boundary box simulates the thought process of the llm: it initially plans to generate harmful responses (top-right), for example, providing instructions on how to steal when prompted with a malicious query, but through self-reflection (bottom-right), it identifies the issue and ultimately produces a safe refusal. by com-paring the top five responses with and without our intervention, we demonstrate that simply asking the model whether its generated text is harmful can steer model generation toward safer outputs. a key challenge in implementing such frequent self-reflection is maintaining efficiency. we further address this with an adaptive reflection schedule powered by a lightweight mlp-based predictor. before generation, this predictor analyzes the hidden representation of the input prompt and first few generated tokens to estimate the minimal number of reflection rounds needed for that query. intuitively, a benign or straightforward query might only require one final safety check at the end, whereas a complex or suspicious prompt would benefit from more frequent checkpoints. by adjusting the reflection frequency to the input's risk level, psr avoids unnecessary overhead on easy queries while still providing tight safety supervision on challenging ones. this design allows us to progressively apply just the right amount of self-reflection -increasing robustness when needed and saving computation when not. notably, all of these mechanisms operate at inference time; we do not require any additional fine-tuning of the primary llm (the small predictor network is the only learned component, and it is orders of magnitude smaller than the llm). in summary, our contributions are depicted as follows: ## experimental results in this section, we present experiments to evaluate the effectiveness of our proposed defense method. the evaluations are conducted on a set of benchmarks comprising both harmful and benign prompts, covering both domain-specific and general knowledge tasks. ## conclusion in this paper, we introduce progressive self-reflection, a decoding-time defense that significantly reduces jailbreak attacks on large language models. our study reveals that with sufficient test-time compute, the base model achieves robustness comparable to externally-equipped guardrails, while remaining more memory-efficient. furthermore, psr is able to efficiently balance computational overhead with safety by enabling dynamic self-assessment during text generation with an adaptive predictor for reflection rounds. experiments on open-source llms demonstrate that psr reduces jailbreak success rates significantly while maintaining their original task performance without additional training. our results underline psr's practicality and effectiveness as a scalable, adaptive approach to safer llm deployment.