mlsanityData to 14 Oct 2026

Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking

arXiv 2502.12970 ↗First posted 18 Feb 2025cs.CLcited by 34

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Large Reasoning Models (LRMs) have recently demonstrated impressive performances across diverse domains. However, how the safety of Large Language Models (LLMs) benefits from enhanced reasoning capabilities against jailbreak queries remains unexplored. To bridge this gap, in this paper, we propose Reasoning-to-Defend (R2D), a novel training paradigm that integrates a safety-aware reasoning mechanism into LLMs' generation process. This enables self-evaluation at each step of the reasoning process, forming safety pivot tokens as indicators of the safety status of responses. Furthermore, in order to improve the accuracy of predicting pivot tokens, we propose Contrastive Pivot Optimization (CPO), which enhances the model's perception of the safety status of given dialogues. LLMs dynamically adjust their response strategies during reasoning, significantly enhancing their safety capabilities defending jailbreak attacks. Extensive experiments demonstrate that R2D effectively mitigates various attacks and improves overall safety, while maintaining the original performances. This highlights the substantial potential of safety-aware reasoning in improving robustness of LRMs and LLMs against various jailbreaks.

Key facts. Cited by 34 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 41 of its 64 references that are in the map. First posted on arXiv 18 Feb 2025.

Builds on

41 of 64 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025GuardReasoner: Towards Reasoning-based LLM Safeguards30 Jan
  2. 2024R2-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning8 Jul

Other references · 39

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  8. 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,371
  9. 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
  10. 2023Let's Verify Step by Stepcited by 3,789
  11. 2022FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awarenesscited by 3,673
  12. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,442
27 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  3. 2023FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioningcited by 2,598
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2025Kimi k1.5: Scaling Reinforcement Learning with LLMscited by 1,210
  8. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  9. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  10. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  11. 2023RLAIF vs. RLHF: Scaling Reinforcement Learning from Human Feedback with AI Feedbackcited by 625
  12. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  13. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  14. 2023Detecting Language Model Attacks with Perplexitycited by 431
  15. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  16. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
  17. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  18. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
  19. 2024ReFT: Reasoning with Reinforced Fine-Tuningcited by 239
  20. 2019A Study of BFLOAT16 for Deep Learning Trainingcited by 232
  21. 2022Distilling Reasoning Capabilities into Smaller Language Modelscited by 158
  22. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 156
  23. 2024Rule Based Rewards for Language Model Safetycited by 108
  24. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  25. 2024Intention Analysis Makes LLMs A Good Jailbreak Defendercited by 74
  26. 2024Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledgecited by 51
  27. 2024Safety Arithmetic: A Framework for Test-time Safety Alignment of Language Models by Steering Parameters and Activationscited by 32

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 23; 2026: 11.

34 papers.

Sort:

By area:

  1. 2025Towards Reasoning Era: A Survey of Long Chain-of-Thought for Reasoning Large Language Modelscited by 384
  2. 2025Safety in Large Reasoning Models: A Surveycited by 64
  3. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  4. 2025Reasoning as an Adaptive Defense for Safetycited by 23
  5. 2025Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Modelscited by 16
  6. 2025AlphaAlign: Incentivizing Safety Alignment with Extremely Simplified Reinforcement Learningcited by 15
  7. 2025Reasoning Model Unlearning: Forgetting Traces, Not Just Answers, While Preserving Reasoning Skillscited by 14
  8. 2025X-Guard: Multilingual Guard Agent for Content Moderationcited by 13
  9. 2025Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Trainingcited by 12
  10. 2025Towards Safe Reasoning in Large Reasoning Models via Corrective Interventioncited by 11
  11. 2025Refusal Falls off a Cliff: How Safety Alignment Fails in Reasoning?cited by 11
  12. 2025Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Cipherscited by 8
22 more
  1. 2025UnsafeChain: Enhancing Reasoning Model Safety via Hard Casescited by 7
  2. 2025CARE: Decoding Time Safety Alignment via Rollback and Introspection Interventioncited by 6
  3. 2025When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Modelscited by 6
  4. 2025Reasoning Up the Instruction Ladder for Controllable Language Modelscited by 5
  5. 2025Chain-of-Thought Driven Adversarial Scenario Extrapolation for Robust Language Modelscited by 4
  6. 2025ReasoningGuard: Safeguarding Large Reasoning Models with Inference-time Safety Aha Momentscited by 4
  7. 2025Mitigating Jailbreaks with Intent-Aware LLMscited by 4
  8. 2026Overview of PAN 2026: Voight-Kampff Generative AI Detection, Text Watermarking, Multi-Author Writing Style Analysis, Generative Plagiarism Detection, and Reasoning Trajectory Detectioncited by 4
  9. 2026RvB: Automating AI System Hardening via Iterative Red-Blue Gamescited by 3
  10. 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMscited by 2
  11. 2025Beyond SFT: Reinforcement Learning for Safer Large Reasoning Models with Better Reasoning Abilitycited by 2
  12. 2026LLM-enabled Applications Require System-Level Threat Monitoringcited by 2
  13. 2026Contrastive Reasoning Alignment: Reinforcement Learning from Hidden Representationscited by 2
  14. 2026Towards Safer Large Reasoning Models by Promoting Safety Decision-Making before Chain-of-Thought Generationcited by 2
  15. 2025Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoningcited by 1
  16. 2026Reasoning Structure Matters for Safety Alignment of Reasoning Modelscited by 1
  17. 2026Self-ReSET: Learning to Self-Recover from Unsafe Reasoning Trajectoriescited by 1
  18. 2025Replicating TEMPEST at Scale: Multi-Turn Adversarial Attacks Against Trillion-Parameter Frontier Modelscited by 0
  19. 2026Reasoning Traces Shape Outputs but Models Won't Say Socited by 0
  20. 2026Addressing Over-Refusal in LLMs with Competing Rewardscited by 0
  21. 2026Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safetycited by 0
  22. 2026EOPSA: Efficient On-Policy Self-Distilled Safety Alignmentcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Reasoned Safety Alignment: Ensuring Jailbreak Defense via Answer-Then-Check
  2. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning
  3. 2024Reasoning as a Weapon: Adaptive Dual-Path Jailbreak Attack on Large Language Models
  4. 2025Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoning
  5. 2025SafeBehavior: Simulating Human-Like Multistage Reasoning to Mitigate Jailbreak Attacks in Large Language Models
  6. 2025Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions
  7. 2026STAR-S: Improving Safety Alignment through Self-Taught Reasoning on Safety Rules
  8. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models