Safety alignment is verified on a computation that is not the one eventually deployed. Refusal training, preference optimization, and red-team evaluation are all performed against a reference forward pass: full precision, one pass per token, a fixed depth, an uncompressed cache. What actually serves users is an inference stack built for throughput — speculative drafting and verification, recursive or looped depth with per-token halting, KV cache eviction and reuse, low-bit quantization, and increasingly a self-improvement loop that writes back into the weights. Every one of these changes the computation that produces the tokens. A safety guarantee established on the reference pass is therefore a guarantee about a program that is never run, and the gap between the two is both an attack surface for an adversary and a silent-degradation surface for an honest operator who only wanted the model to be faster.
The gap is easy to underestimate because efficiency methods are usually introduced with correctness arguments, and those arguments are about the wrong quantity. Speculative decoding is called lossless, but losslessness holds for exact rejection sampling against the target distribution, while deployed systems use relaxed or typical acceptance, tree-structured drafts, and self-drafting branches whose statistics differ from the target's; meanwhile the acceptance rate is data-dependent, which turns decode latency into an observable channel on both prompt and output. Quantization is justified by perplexity, which is an average over tokens and says nothing about the small set of tokens where a refusal is decided. Looped and recursive-depth models allocate compute per token at run time, so inference depth becomes an adversary-controllable resource: an input that induces early halting on safety-critical positions, or that pushes the loop beyond the depth seen during training, moves the hidden state off the trajectory on which alignment was fitted, and refusal behavior is not known to be invariant to that shift. Recursive self-improvement compounds the problem across time rather than within a single pass, since the system supplies its own training signal and any safety drift is fed back as data.
Existing work falls into three broad classes, none of which covers this. Model-level alignment improves the weights, but its guarantees are stated for the reference forward pass and are not carried through to a modified one. External guardrails wrap the system with input and output classifiers; they are stack-agnostic by design, which means they cannot see failures manufactured inside the stack, and the latency they add pushes operators toward exactly the acceleration techniques that break the assumptions. Efficiency-method analyses bound approximation error — acceptance probabilities, quantization error, eviction error — but bound it in distribution or in aggregate loss, and distributional closeness does not imply behavioral equivalence on the rare, high-consequence tokens that safety is about.
We study safety as a property of the deployed stack rather than of the weights alone, and treat the serving configuration — draft model and acceptance rule, loop count and halting policy, cache and quantization policy, self-improvement cadence — as part of the specification that alignment must hold under. Concretely: method-specific attacks and defenses for speculative decoding, covering both the external-draft setting, where the drafter is a smaller and often unaligned or third-party model, and the self-speculative setting, where draft and target share weights so that a perturbation to the draft branch is not independent of the verifier; safety under adaptive depth in looped transformers, including halting manipulation, depth-extrapolation drift, and the interaction with cross-loop KV reuse; and the stability of recursive self-improvement loops, where the question is not whether a single cycle is safe but whether safety is a fixed point of the loop or a quantity that decays monotonically across cycles. The organizing goal is an invariant: a statement of what the system refuses that holds across the configuration space, together with a measurement procedure that can certify it for a given deployment rather than for an idealized model.