Exploring and developing draft-model-based pre-guardrails

The researchers propose a guardrail design executed before target model inference that uses a small draft model to generate candidate responses to assist in judging prompt safety, and the authors report that it reduces the false negative rate of pre-guardrails. The authors first systematically study the transferability of jailbreak attacks from large language models to small language models (SLMs), identify key factors affecting transfer, and observe that jailbreak prompts constructed for LLMs often also trigger SLMs to generate misaligned responses. Based on this, the design uses speculative inference to have the SLM generate a set of draft responses, then feeds the original prompt together with these drafts into an existing guardrail to predict safety. The authors report that this approach reduces the false negative rate of pre-guardrails and provides an alternative to post-guardrails, which require auditing both the prompt and the response after target model inference.