通过早期干预纠正推理模型安全问题，效果显著且不影响推理能力。
Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away
- 在推理时检测安全风险，仅在必要时插入简短修正前缀。
- 攻击成功率降低30%-60%，如LlamaV-o1在JailbreakV-28K上从63.33%降至5.74%。
- 只需干预前1-3步即可实现安全恢复，适合部署在实际系统中。
基于强化学习的后训练方法（如GRPO）虽提升了多模态大模型的推理能力，但可能导致安全对齐下降和越狱成功率升高。本文提出SafeThink，一种轻量级推理时防御机制，将安全恢复视为满足性约束而非最大化目标。该方法利用安全奖励模型监控推理过程，仅在安全阈值被突破时，注入一个优化过的简短修正前缀（“Wait, think safely”）。在六种开源多模态大模型和四个越狱基准（JailbreakV-28K、Hades、FigStep、MM-SafetyBench）上的评估显示，SafeThink使攻击成功率降低30%-60%（例如，LlamaV-o1在JailbreakV-28K上从63.33%降至5.74%，R1-Onevision在Hades上从69.07%降至5.65%），同时保持推理性能稳定（MathVista准确率从65.20%降至65.00%）。实验发现，安全恢复通常只需数个引导步骤：在前1-3步内干预即可有效引导生成走向安全结果。
原文摘要 · Abstract (English)
Reinforcement learning (RL) based post-training for explicit chain-of-thought (e.g., GRPO) improves the reasoning ability of multimodal large-scale reasoning models (MLRMs). But recent evidence shows that it can simultaneously degrade safety alignment and increase jailbreak success rates. We propose SafeThink, a lightweight inference-time defense that treats safety recovery as a satisficing constraint rather than a maximization objective. SafeThink monitors the evolving reasoning trace with a safety reward model and conditionally injects an optimized short corrective prefix ("Wait, think safely") only when the safety threshold is violated. In our evaluations across six open-source MLRMs and four jailbreak benchmarks (JailbreakV-28K, Hades, FigStep, and MM-SafetyBench), SafeThink reduces attack success rates by 30-60% (e.g., LlamaV-o1: 63.33% to 5.74% on JailbreakV-28K, R1-Onevision: 69.07% to 5.65% on Hades) while preserving reasoning performance (MathVista accuracy: 65.20% to 65.00%). A key empirical finding from our experiments is that safety recovery is often only a few steering steps away: intervening in the first 1-3 reasoning steps typically suffices to redirect the full generation toward safe completions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。