Safety Context Injection: Inference-Time Safety Alignment via Static Filtering and Agentic Analysis

TL;DR

This paper introduces Safety Context Injection (SCI), a framework for inference-time safety alignment of large reasoning models by injecting external safety reports, improving safety without modifying model weights.

Contribution

The paper proposes SCI with two variants, Static Model Filtering and Dynamic Agents Filtering, to enhance safety during inference in black-box models.

Findings

Both variants reduce attack success rate and toxicity.

SMF provides a fast, low-latency safety guard.

DAF is more effective against disguised or dispersed harmful intent.

Abstract

Large Reasoning Models (LRMs) improve performance on complex tasks, but they also make safety control harder at deployment time. In black-box settings, defenders cannot modify model weights and must instead intervene at inference time. This setting creates three practical challenges: harmful intent may be hidden by educational or role-play framing, deep safety analysis can introduce non-trivial latency, and long adversarial contexts can dilute the local cues that simpler filters rely on. These challenges can expose an apparent thinking--output gap, where the model appears cautious during reasoning but still produces an unsafe final answer. To address this problem, we propose Safety Context Injection (SCI), an inference-time framework that separates safety assessment from task generation and prepends a structured external risk report as injected safety context for the protected model. The framework is instantiated in two complementary variants: Static Model Filtering (SMF), a lightweight one-pass guard for fast deployment, and Dynamic Agents Filtering (DAF), an agentic-loop-based analyzer that iteratively gathers and synthesizes evidence for ambiguous or long-context attacks. Across AdvBench and GPTFuzz, spanning base and reasoning models under five jailbreak families, both variants reduce attack success rate and toxicity in the evaluated settings. SMF offers an efficient low-latency option, while DAF is more effective when harmful intent is semantically disguised or dispersed across long contexts.