Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
The current paradigm for safety alignment of large language models (LLMs) follows a one-size-fits-all approach: the model refuses to interact with any content deemed unsafe by the model provider. This approach lacks flexibility in the face of varying social norms across cultures and regions. In addition, users may have diverse safety needs, making a model with static safety standards too restrictive to be useful, as well as too costly to be re-aligned. We propose Controllable Safety Alignment (CoSA), a framework designed to adapt models to diverse safety requirements without re-training. Instead of aligning a fixed model, we align models to follow safety configs -- free-form natural language descriptions of the desired safety behaviors -- that are provided as part of the system prompt. To adjust model safety behavior, authorized users only need to modify such safety configs at inference time. To enable that, we propose CoSAlign, a data-centric method for aligning LLMs to easily adapt to diverse safety configs. Furthermore, we devise a novel controllability evaluation protocol that considers both helpfulness and configured safety, summarizing them into CoSA-Score, and construct CoSApien, a human-authored benchmark that consists of real-world LLM use cases with diverse safety requirements and corresponding evaluation prompts. We show that CoSAlign leads to substantial gains of controllability over strong baselines including in-context alignment. Our framework encourages better representation and adaptation to pluralistic human values in LLMs, and thereby increasing their practicality.
Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 65 of its 76 references that are in the map. First posted on arXiv 11 Oct 2024.
Builds on
65 of 76 references.
Closest ancestors · 5
Same direction, newest first
- 2024Backtracking Improves Generation Safety22 Sep
- 2023Removing RLHF Protections in GPT-4 via Fine-Tuning9 Nov
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset10 Jul
Other references · 60
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,841
- 2022Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Themcited by 1,767
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
38 more
- 2022Super-NaturalInstructions: Generalization via Declarative Instructions on 1600+ NLP Taskscited by 858
- 2022BERTopic: Neural topic modeling with a class-based TF-IDF procedurecited by 779
- 2021Cross-Task Generalization via Natural Language Crowdsourcing Instructionscited by 696
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 484
- 2024Generative Verifiers: Reward Modeling as Next-Token Predictioncited by 465
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2023Towards Measuring the Representation of Subjective Global Opinions in Language Modelscited by 424
- 2023Fine-Grained Human Feedback Gives Better Rewards for Language Model Trainingcited by 399
- 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
- 2023Personalized Soups: Personalized Large Language Model Alignment via Post-hoc Parameter Mergingcited by 271
- 2023The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learningcited by 251
- 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
- 2023Rewarded soups: towards Pareto-optimal alignment by interpolating weights fine-tuned on diverse rewardscited by 232
- 2024Rewards-in-Context: Multi-objective Alignment of Foundation Models with Dynamic Preference Adjustmentcited by 171
- 2023Having Beer after Prayer? Measuring Cultural Bias in Large Language Modelscited by 153
- 2023Cultural Bias and Cultural Alignment of Large Language Modelscited by 149
- 2024Investigating Cultural Alignment of Large Language Modelscited by 140
- 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 135
- 2023Controlled Decoding from Language Modelscited by 133
- 2024Collective Constitutional AI: Aligning a Language Model with Public Inputcited by 120
- 2022ProsocialDialog: A Prosocial Backbone for Conversational Agentscited by 109
- 2023SteerLM: Attribute Conditioned SFT as an (User-Steerable) Alternative to RLHFcited by 107
- 2024Controllable Preference Optimization: Toward Controllable Multi-Objective Alignmentcited by 105
- 2023Value Kaleidoscope: Engaging AI with Pluralistic Human Values, Rights, and Dutiescited by 97
- 2024Social Choice Should Guide AI Alignment in Dealing with Diverse Human Feedbackcited by 95
- 2024Decoding-Time Language Model Alignment with Multiple Objectivescited by 90
- 2023Effective Prompt Extraction from Language Modelscited by 83
- 2023Reward-Augmented Decoding: Efficient Controlled Text Generation With a Unidirectional Reward Modelcited by 79
- 2023SimpleSafetyTests: a Test Suite for Identifying Critical Safety Risks in Large Language Modelscited by 72
- 2024PERSONA: A Reproducible Testbed for Pluralistic Alignmentcited by 71
- 2024The Multilingual Alignment Prism: Aligning Global and Local Preferences to Reduce Harmcited by 67
- 2022Re-contextualizing Fairness in NLP: The Case of Indiacited by 55
- 2024PAL: Pluralistic Alignment Framework for Learning from Heterogeneous Preferencescited by 53
- 2024CultureLLM: Incorporating Cultural Differences into Large Language Modelscited by 49
- 2021Ethical-Advice Taker: Do Language Models Understand Natural Language Interventions?cited by 46
- 2024From Distributional to Overton Pluralism: Investigating Large Language Model Alignmentcited by 33
50 most cited of 60 All 60 (JSON)
Built on by
Citing papers per year: 2025: 19; 2026: 16.
35 papers.
Sort:
By area:
- 2025DynaGuard: A Dynamic Guardian Model With User-Defined Policiescited by 16
- 2025Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Modelscited by 14
- 2025On Almost Surely Safe Alignment of Large Language Models at Inference-Timecited by 13
- 2025Is Safety Standard Same for Everyone? User-Specific Safety Evaluation of Large Language Modelscited by 10
- 2025The Alignment Waltz: Jointly Training Agents to Collaborate for Safetycited by 10
- 2025Optimizing Diversity and Quality through Base-Aligned Model Collaborationcited by 8
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
- 2026Many-Tier Instruction Hierarchy in LLM Agentscited by 6
- 2025Standardizing Intelligence: Aligning Generative AI for Regulatory and Operational Compliancecited by 5
- 2025OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Modelscited by 5
- 2025Reasoning Up the Instruction Ladder for Controllable Language Modelscited by 5
23 more
- 2026PluriHarms: Benchmarking the Full Spectrum of Human Judgments on AI Harmcited by 5
- 2025NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMscited by 3
- 2026Steering to Say No: Configurable Refusal via Activation Steering in Vision Language Modelscited by 3
- 2026AI Alignment Breaks at the Edgecited by 3
- 2025Aligning VLM Assistants with Personalized Situated Cognitioncited by 2
- 2025PICACO: Pluralistic In-Context Value Alignment of LLMs via Total Correlation Optimizationcited by 2
- 2025AURA: Affordance-Understanding and Risk-aware Alignment Technique for Large Language Modelscited by 2
- 2025A Survey on Training-free Alignment of Large Language Modelscited by 2
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuningcited by 2
- 2025Personalized Constitutionally-Aligned Agentic Superego: Secure AI Behavior Aligned to Diverse Human Valuescited by 1
- 2026COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMscited by 1
- 2026MOSAIC: Composable Safety Alignment with Modular Control Tokenscited by 1
- 2026Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMscited by 1
- 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignmentcited by 0
- 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policiescited by 0
- 2026Beyond Static Alignment: Hierarchical Policy Control for LLM Safety via Risk-Aware Chain-of-Thoughtcited by 0
- 2026Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routingcited by 0
- 2026BARRED: Synthetic Training of Custom Policy Guardrails via Asymmetric Debatecited by 0
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolutioncited by 0
- 2026A Roadmap to Impactful Pluralistic Alignment Researchcited by 0
- 2026Nemotron 3.5 Content Safety Moderator: A Compact Multimodal, Multilingual, and Reasoning Enabled Content Safety Moderatorcited by 0
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMscited by 0
- 2026Minimally Invasive Steering of Language Modelscited by 0
- 2026Minimally Invasive Steering of Language Models24 Sep 2026
- 2026Nemotron 3.5 Content Safety Moderator: A Compact Multimodal, Multilingual, and Reasoning Enabled Content Safety Moderator27 Aug 2026
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs26 Aug 2026
- 2026A Roadmap to Impactful Pluralistic Alignment Research24 Jul 2026
- 2026Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMs22 May 2026
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution13 May 2026
- 2026BARRED: Synthetic Training of Custom Policy Guardrails via Asymmetric Debate28 Apr 2026
- 2026Many-Tier Instruction Hierarchy in LLM Agents10 Apr 2026
- 2026MOSAIC: Composable Safety Alignment with Modular Control Tokens17 Mar 2026
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning10 Mar 2026
- 2026Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routing4 Mar 2026
- 2026AI Alignment Breaks at the Edge23 Feb 2026
23 more
- 2026Beyond Static Alignment: Hierarchical Policy Control for LLM Safety via Risk-Aware Chain-of-Thought6 Feb 2026
- 2026Steering to Say No: Configurable Refusal via Activation Steering in Vision Language Models31 Jan 2026
- 2026PluriHarms: Benchmarking the Full Spectrum of Human Judgments on AI Harm13 Jan 2026
- 2026COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMs5 Jan 2026
- 2025Optimizing Diversity and Quality through Base-Aligned Model Collaboration7 Nov 2025
- 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policies7 Nov 2025
- 2025Reasoning Up the Instruction Ladder for Controllable Language Models30 Oct 2025
- 2025The Alignment Waltz: Jointly Training Agents to Collaborate for Safety9 Oct 2025
- 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMs5 Oct 2025
- 2025DynaGuard: A Dynamic Guardian Model With User-Defined Policies2 Sep 2025
- 2025NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMs13 Aug 2025
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Training12 Aug 2025
- 2025A Survey on Training-free Alignment of Large Language Models12 Aug 2025
- 2025AURA: Affordance-Understanding and Risk-aware Alignment Technique for Large Language Models8 Aug 2025
- 2025PICACO: Pluralistic In-Context Value Alignment of LLMs via Total Correlation Optimization22 Jul 2025
- 2025Personalized Constitutionally-Aligned Agentic Superego: Secure AI Behavior Aligned to Diverse Human Values8 Jun 2025
- 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment7 Jun 2025
- 2025Aligning VLM Assistants with Personalized Situated Cognition1 Jun 2025
- 2025OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models27 May 2025
- 2025Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Models26 May 2025
- 2025Is Safety Standard Same for Everyone? User-Specific Safety Evaluation of Large Language Models20 Feb 2025
- 2025Standardizing Intelligence: Aligning Generative AI for Regulatory and Operational Compliance3 Feb 2025
- 2025On Almost Surely Safe Alignment of Large Language Models at Inference-Time3 Feb 2025
- 2025On Almost Surely Safe Alignment of Large Language Models at Inference-Timecited by 13
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
- 2025NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMscited by 3
- 2026AI Alignment Breaks at the Edgecited by 3
- 2025PICACO: Pluralistic In-Context Value Alignment of LLMs via Total Correlation Optimizationcited by 2
- 2025AURA: Affordance-Understanding and Risk-aware Alignment Technique for Large Language Modelscited by 2
- 2025A Survey on Training-free Alignment of Large Language Modelscited by 2
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuningcited by 2
- 2026MOSAIC: Composable Safety Alignment with Modular Control Tokenscited by 1
- 2026Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMscited by 1
- 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignmentcited by 0
12 most cited of 14 All 14 (JSON)
- 2026A Roadmap to Impactful Pluralistic Alignment Research24 Jul 2026
- 2026Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMs22 May 2026
- 2026MOSAIC: Composable Safety Alignment with Modular Control Tokens17 Mar 2026
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning10 Mar 2026
- 2026Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routing4 Mar 2026
- 2026AI Alignment Breaks at the Edge23 Feb 2026
- 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMs5 Oct 2025
- 2025NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMs13 Aug 2025
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Training12 Aug 2025
- 2025A Survey on Training-free Alignment of Large Language Models12 Aug 2025
- 2025AURA: Affordance-Understanding and Risk-aware Alignment Technique for Large Language Models8 Aug 2025
- 2025PICACO: Pluralistic In-Context Value Alignment of LLMs via Total Correlation Optimization22 Jul 2025
12 newest of 14 All 14 (JSON)
- 2025DynaGuard: A Dynamic Guardian Model With User-Defined Policiescited by 16
- 2025Is Safety Standard Same for Everyone? User-Specific Safety Evaluation of Large Language Modelscited by 10
- 2025OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Modelscited by 5
- 2026BARRED: Synthetic Training of Custom Policy Guardrails via Asymmetric Debatecited by 0
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolutioncited by 0
- 2026Nemotron 3.5 Content Safety Moderator: A Compact Multimodal, Multilingual, and Reasoning Enabled Content Safety Moderatorcited by 0
- 2026Nemotron 3.5 Content Safety Moderator: A Compact Multimodal, Multilingual, and Reasoning Enabled Content Safety Moderator27 Aug 2026
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution13 May 2026
- 2026BARRED: Synthetic Training of Custom Policy Guardrails via Asymmetric Debate28 Apr 2026
- 2025DynaGuard: A Dynamic Guardian Model With User-Defined Policies2 Sep 2025
- 2025OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models27 May 2025
- 2025Is Safety Standard Same for Everyone? User-Specific Safety Evaluation of Large Language Models20 Feb 2025
- 2025Optimizing Diversity and Quality through Base-Aligned Model Collaborationcited by 8
- 2025Standardizing Intelligence: Aligning Generative AI for Regulatory and Operational Compliancecited by 5
- 2026PluriHarms: Benchmarking the Full Spectrum of Human Judgments on AI Harmcited by 5
- 2026COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMscited by 1
- 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policiescited by 0
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMscited by 0
- 2026Minimally Invasive Steering of Language Modelscited by 0
- 2026Minimally Invasive Steering of Language Models24 Sep 2026
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs26 Aug 2026
- 2026PluriHarms: Benchmarking the Full Spectrum of Human Judgments on AI Harm13 Jan 2026
- 2026COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMs5 Jan 2026
- 2025Optimizing Diversity and Quality through Base-Aligned Model Collaboration7 Nov 2025
- 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policies7 Nov 2025
- 2025Standardizing Intelligence: Aligning Generative AI for Regulatory and Operational Compliance3 Feb 2025
Similar, not cited
Close in wording, no citation either way
- 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patching
- 2024Safety Arithmetic: A Framework for Test-time Safety Alignment of Language Models by Steering Parameters and Activations
- 2026PolicyAlign: Direct Policy-Based Safety Alignment for Large Language Models
- 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflection
- 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
- 2026Can Safety Emerge from Weak Supervision? A Systematic Analysis of Small Language Models
- 2026SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignment
- 2024Superficial Safety Alignment Hypothesis