mlsanityData to 7 Oct 2026

Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety

arXiv 2503.05021 ↗First posted 6 Mar 2025cs.CL cs.CRcited by 38

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 2 more
Abstract (arXiv)

Large Language Models (LLMs) are vulnerable to jailbreak attacks that exploit weaknesses in traditional safety alignment, which often relies on rigid refusal heuristics or representation engineering to block harmful outputs. While they are effective for direct adversarial attacks, they fall short of broader safety challenges requiring nuanced, context-aware decision-making. To address this, we propose Reasoning-enhanced Finetuning for interpretable LLM Safety (Rational), a novel framework that trains models to engage in explicit safe reasoning before response. Fine-tuned models leverage the extensive pretraining knowledge in self-generated reasoning to bootstrap their own safety through structured reasoning, internalizing context-sensitive decision-making. Our findings suggest that safety extends beyond refusal, requiring context awareness for more robust, interpretable, and adaptive responses. Reasoning is not only a core capability of LLMs but also a fundamental mechanism for LLM safety. Rational employs reasoning-enhanced fine-tuning, allowing it to reject harmful prompts while providing meaningful and context-aware responses in complex scenarios.

Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 48 of its 61 references that are in the map. First posted on arXiv 6 Mar 2025.

Builds on

48 of 61 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilities17 Feb
  2. 2025Safety Reasoning with Guidelines6 Feb
  3. 2025STAIR: Improving Safety Alignment with Introspective Reasoning4 Feb
  4. 2025GuardReasoner: Towards Reasoning-based LLM Safeguards30 Jan
  5. 2024Deliberative Alignment: Reasoning Enables Safer Language Models20 Dec
  6. 2024R2-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning8 Jul
  7. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan

Other references · 41

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  4. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
  5. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  9. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  10. 2022Red Teaming Language Models with Language Modelscited by 983
  11. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
29 more
  1. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  2. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
  3. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  4. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  6. 2022ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detectioncited by 419
  7. 2023Detecting Language Model Attacks with Perplexitycited by 411
  8. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  9. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  10. 2024Alignment faking in large language modelscited by 316
  11. 2020AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Promptscited by 246
  12. 2023Camels in a Changing Climate: Enhancing LM Adaptation with Tulu 2cited by 227
  13. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 224
  14. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  15. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 202
  16. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 193
  17. 2024Programming Refusal with Conditional Activation Steeringcited by 191
  18. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 185
  19. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 160
  20. 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 100
  21. 2024Attacking Large Language Models with Projected Gradient Descentcited by 91
  22. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 89
  23. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  24. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defensescited by 68
  25. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attackscited by 48
  26. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 46
  27. 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 44
  28. 2025Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attackscited by 20
  29. 2024SafetyAnalyst: Interpretable, Transparent, and Steerable Safety Moderation for AI Behaviorcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 15; 2026: 23.

38 papers.

Sort:

By area:

  1. 2025VChain: Chain-of-Visual-Thought for Reasoning in Video Generationcited by 31
  2. 2025Reasoning as an Adaptive Defense for Safetycited by 22
  3. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 22
  4. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 18
  5. 2025AlphaAlign: Incentivizing Safety Alignment with Extremely Simplified Reinforcement Learningcited by 14
  6. 2025Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safetycited by 10
  7. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
  8. 2025KnowRL: Teaching Language Models to Know What They Knowcited by 5
  9. 2026Beyond Simulations: What 20,000 Real Conversations Reveal About Mental Health AI Safetycited by 4
  10. 2026Minimizing Collateral Damage in Activation Steeringcited by 4
  11. 2025MedRiskEval: Medical Risk Evaluation Benchmark of Language Models, On the Importance of User Perspectives in Healthcare Settingscited by 2
  12. 2025How Catastrophic is Your LLM? Certifying Risk in Conversationcited by 2
26 more
  1. 2025Strong but Brittle: Simple Attacks Subvert Reasoning-based Safety Guardrailscited by 2
  2. 2025EASE: Practical and Efficient Safety Alignment for Small Language Modelscited by 2
  3. 2026STAR-S: Improving Safety Alignment through Self-Taught Reasoning on Safety Rulescited by 2
  4. 2026Alignment-Weighted DPO: A principled reasoning approach to improve safety alignmentcited by 2
  5. 2026Visual Self-Fulfilling Alignment: Shaping Safety-Oriented Personas via Threat-Related Imagescited by 2
  6. 2026CorrectionPlanner: Self-Correction Planner with Reinforcement Learning in Autonomous Drivingcited by 2
  7. 2025LatentGuard: Controllable Latent Steering for Robust Refusal of Attacks and Reliable Response Generationcited by 1
  8. 2025Think-Reflect-Revise: A Policy-Guided Reflective Framework for Safety Alignment in Large Vision Language Modelscited by 1
  9. 2026RefusalGuard: Geometry-Preserving Fine-Tuning for Safety in LLMscited by 1
  10. 2025From Rogue to Safe AI: The Role of Explicit Refusals in Aligning LLMs with International Humanitarian Lawcited by 0
  11. 2025Self-Guided Adaptive Safety Alignment: Synthesizing and Internalizing Guidelines in Reasoning Modelscited by 0
  12. 2026Alignment Drift in Multimodal LLMs: A Two-Phase, Longitudinal Evaluation of Harm Across Eight Model Releasescited by 0
  13. 2026CR4T: Rewrite-Based Guardrails for Adolescent LLM Safetycited by 0
  14. 2026Same Model, Different Weakness: How Language and Modality Reshape the Jailbreak Attack Surface in Frontier MLLMscited by 0
  15. 2026Dialectics of Alignment: Harnessing Unsafe Knowledge for Dynamic Safety Routingcited by 0
  16. 2026Does Reasoning Preserve Alignment? On the Trustworthiness of Large Reasoning Modelscited by 0
  17. 2026SHARD: Safe and Helpful Alignment via Self-Reframing Distillationcited by 0
  18. 2026Addressing Over-Refusal in LLMs with Competing Rewardscited by 0
  19. 2026How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributionscited by 0
  20. 2026Robust Critics: Defending LLMs Against Multi-Turn Attackscited by 0
  21. 2026Analysing Self-Harm Representations in Language Models: a Cross-Architecture Studycited by 0
  22. 2026Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safetycited by 0
  23. 2026CLEAR: Continuous Latent Adapter Routing for Utility-Preserving LLM Safety Alignmentcited by 0
  24. 2026ALTSTEER: Selective Safety Steering for Moving Beyond Hard Refusals to Constructive Alternativescited by 0
  25. 2026Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusalcited by 0
  26. 2026Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning
  2. 2025Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoning
  3. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
  4. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking
  5. 2026Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models
  6. 2025Refusal Falls off a Cliff: How Safety Alignment Fails in Reasoning?
  7. 2025Are Smarter LLMs Safer? Exploring Safety-Reasoning Trade-offs in Prompting and Fine-Tuning
  8. 2024Reasoning as a Weapon: Adaptive Dual-Path Jailbreak Attack on Large Language Models