Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models
This work addresses safety alignment for LRMs, reducing reliance on external data annotation, but the approach is incremental as it builds on existing fine-tuning techniques.
Large Reasoning Models (LRMs) are vulnerable to jailbreaks and harmful queries. The authors propose a method that leverages the models' own latent safety awareness via supervised fine-tuning and direct preference optimization, reducing attack success rates by up to 36.72% on jailbreak benchmarks without harming general performance.
While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.