让大模型自己发现危险并主动规避，无需人工标注安全数据。
Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models
- 用模型自身推理过程触发安全检测，自动识别有害请求
- 在不降低普通任务表现的前提下，使攻击成功率下降超36%
- 全由模型生成训练数据，适合希望提升安全性的部署者
大型推理模型（LRMs）虽擅长复杂任务，却易受高级越狱攻击和直接有害查询影响。现有方法依赖外部人工标注进行安全对齐，我们发现模型在重看原始问题及其自身推理轨迹时，可自发识别安全风险——这种能力称为潜在安全意识。为此，我们首先通过监督微调（SFT）显式引入安全标签，以触发对有害查询的分析与引导，同时保持通用查询的正常响应，实现自适应触发；随后使用直接偏好优化（DPO）进一步提升安全判断的准确性和稳定性。两阶段训练所需数据均由待优化模型自动生成。实验表明，该方法显著增强安全性：以DeepSeek-R1-Distill-Llama-8B为例，在有害和越狱基准上平均攻击成功率达24.65%和36.72%的降幅。最终，该方法几乎不影响通用性能或用户体验。
原文摘要 · Abstract (English)
While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。