SafeDPO: A Simple Approach to Direct Preference Optimization with Enhanced Safety
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
Abstract (arXiv)
As Large Language Models (LLMs) are increasingly deployed in real-world applications, balancing helpfulness and safety has become a central challenge. A natural approach is to incorporate safety constraints into Reinforcement Learning from Human Feedback (RLHF), where recent studies have shown promising progress. However, these methods often rely on auxiliary networks or multi-stage pipelines, thereby increasing complexity. In this work, we revisit the original safety alignment objective and show that, under mild assumptions, it admits a closed-form optimal policy. We further derive a provably equivalent and tractable objective, enabling direct optimization. Building on this insight, we propose SafeDPO, a lightweight method that preserves the optimal solution of the underlying safety-constrained objective while requiring only one additional hyperparameter and minimal modifications to existing preference-based training methods. SafeDPO eliminates the need for reward models, cost models, and online sampling, relying only on preference data and safety indicators. Despite its simplicity, SafeDPO achieves competitive safety-helpfulness trade-offs compared to existing safety alignment methods. Experiments on the PKU-SafeRLHF-30K benchmark demonstrate that SafeDPO substantially improves safety while maintaining competitive helpfulness. Ablation studies further show that the additional hyperparameter provides a flexible mechanism to enhance safety while preserving the theoretical optimum, and confirm that SafeDPO scales reliably to LLMs with up to 13B parameters. Overall, our results highlight that a simple, theory-driven objective can provide a lightweight yet effective solution for safety alignment in practice.
Key facts. Cited by 37 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 37 of its 48 references that are in the map. First posted on arXiv 26 May 2025.
Builds on
37 of 48 references.
Closest ancestors · 2
Same direction, newest first
- 2024One-Shot Safety Alignment for Large Language Models via Optimal Dualization29 May
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedback19 Oct
Other references · 35
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2023GPT-4 Technical Reportcited by 18,396
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
- 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 9,379
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,326
- 2017Deep reinforcement learning from human preferencescited by 3,912
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
23 more
- 2020Learning to summarize from human feedbackcited by 2,588
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,150
- 2024Mixtral of Expertscited by 1,823
- 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,745
- 2022LaMDA: Language Models for Dialog Applicationscited by 1,220
- 2023A General Theoretical Paradigm to Understand Learning from Human Preferencescited by 912
- 2023AlpacaFarm: A Simulation Framework for Methods that Learn from Human Feedbackcited by 748
- 2022Improving alignment of dialogue agents via targeted human judgementscited by 531
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
- 2018Scalable agent alignment via reward modeling: a research directioncited by 447
- 2021PEBBLE: Feedback-Efficient Interactive Reinforcement Learning via Relabeling Experience and Unsupervised Pre-trainingcited by 302
- 2021Unsolved Problems in ML Safetycited by 292
- 2023AI Alignment: A Comprehensive Surveycited by 263
- 2022Is Reinforcement Learning (Not) for Natural Language Processing: Benchmarks, Baselines, and Building Blocks for Natural Language Policy Optimizationcited by 246
- 2023Beyond Reverse KL: Generalizing Direct Preference Optimization with Diverse Divergence Constraintscited by 174
- 2023Sociotechnical Safety Evaluation of Generative AI Systemscited by 157
- 2024Generalized Preference Optimization: A Unified Approach to Offline Alignmentcited by 157
- 2024Scaling Laws for Reward Model Overoptimization in Direct Alignment Algorithmscited by 143
- 2024Direct Preference Optimization with an Offsetcited by 122
- 2023Preference Transformer: Modeling Human Preferences using Transformers for RLcited by 79
- 2024Enhancing LLM Safety via Constrained Direct Preference Optimizationcited by 49
- 2024MetaAligner: Towards Generalizable Multi-Objective Alignment of Language Modelscited by 44
- 2024Stepwise Alignment for Constrained Language Model Policy Optimizationcited by 30
Built on by
Citing papers per year: 2025: 13; 2026: 24.
37 papers.
Sort:
By area:
- 2025DriveDPO: Policy Learning via Safety DPO For End-to-End Autonomous Drivingcited by 39
- 2025A Technical Survey of Reinforcement Learning Techniques for Large Language Modelscited by 21
- 2025Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimizationcited by 11
- 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoringcited by 11
- 2025The Geometry of Harmfulness in LLMs through Subconcept Probingcited by 7
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2025SPA: Achieving Consensus in LLM Alignment via Self-Priority Optimizationcited by 3
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agentscited by 2
- 2026Reducing Hallucinations in LLMs via Factuality-Aware Preference Learningcited by 2
- 2026NeST: Neuron Selective Tuning for LLM Safetycited by 2
- 2025A-IPO: Adaptive Intent-driven Preference Optimizationcited by 1
- 2026Reinforcing Real-world Service Agents: Balancing Utility and Cost in Task-oriented Dialoguecited by 1
25 more
- 2026Improving Safety Alignment via Balanced Direct Preference Optimizationcited by 1
- 2026Cat-DPO: Category-Adaptive Safety Alignmentcited by 1
- 2026PREFINE: Preference-Based Implicit Reward and Cost Fine-Tuning for Safety Alignmentcited by 1
- 2026DOG-DPO:Dynamic Optimization in Geometry for Safety Alignmentcited by 1
- 2026Safe Inference-Time Alignment via Lagrangian Reward Augmentationcited by 1
- 2025Provably Convergent Primal-Dual DPO for Constrained LLM Alignmentcited by 0
- 2025Don't Walk the Line: Boundary Guidance for Filtered Generationcited by 0
- 2025Reducing the Probability of Undesirable Outputs in Language Models Using Probabilistic Inferencecited by 0
- 2025Constrained Language Model Policy Optimization via Risk-aware Stepwise Alignmentcited by 0
- 2026Provable Last-Iterate Convergence for Multi-Objective Safe LLM Alignment via Optimistic Primal-Dualcited by 0
- 2026Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routingcited by 0
- 2026The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Trainingcited by 0
- 2026MGDA-Decoupled: Geometry-Aware Multi-Objective Optimisation for DPO-based LLM Alignmentcited by 0
- 2026Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generationcited by 0
- 2026BSO: Safety Alignment Is Density Ratio Matchingcited by 0
- 2026Selective Safety Steering via Value-Filtered Decodingcited by 0
- 2026SafeDiffusion-R1: Online Reward Steering for Safe Diffusion Post-Trainingcited by 0
- 2026Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attackscited by 0
- 2026Distributed Direct Preference Optimizationcited by 0
- 2026Curriculum Learning for Safety Alignmentcited by 0
- 2026Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Codecited by 0
- 2026Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Tracescited by 0
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Modelscited by 0
- 2026Suan: Rectifying Direct Preference Safety Alignment in Large Language Modelscited by 0
- 2026TRACE: Trajectory Return Attribution and Contrastive Erasure for Multi-Turn Safetycited by 0
- 2026TRACE: Trajectory Return Attribution and Contrastive Erasure for Multi-Turn Safety1 Oct 2026
- 2026Suan: Rectifying Direct Preference Safety Alignment in Large Language Models8 Sep 2026
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models3 Jul 2026
- 2026Safe Inference-Time Alignment via Lagrangian Reward Augmentation2 Jul 2026
- 2026Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces1 Jul 2026
- 2026Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Code10 Jun 2026
- 2026DOG-DPO:Dynamic Optimization in Geometry for Safety Alignment4 Jun 2026
- 2026Curriculum Learning for Safety Alignment25 May 2026
- 2026PREFINE: Preference-Based Implicit Reward and Cost Fine-Tuning for Safety Alignment20 May 2026
- 2026Distributed Direct Preference Optimization20 May 2026
- 2026Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks18 May 2026
- 2026SafeDiffusion-R1: Online Reward Steering for Safe Diffusion Post-Training18 May 2026
25 more
- 2026Selective Safety Steering via Value-Filtered Decoding14 May 2026
- 2026BSO: Safety Alignment Is Density Ratio Matching12 May 2026
- 2026Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generation11 May 2026
- 2026MGDA-Decoupled: Geometry-Aware Multi-Objective Optimisation for DPO-based LLM Alignment22 Apr 2026
- 2026Cat-DPO: Category-Adaptive Safety Alignment19 Apr 2026
- 2026The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Training9 Apr 2026
- 2026Improving Safety Alignment via Balanced Direct Preference Optimization24 Mar 2026
- 2026Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routing4 Mar 2026
- 2026Reinforcing Real-world Service Agents: Balancing Utility and Cost in Task-oriented Dialogue26 Feb 2026
- 2026Provable Last-Iterate Convergence for Multi-Objective Safe LLM Alignment via Optimistic Primal-Dual25 Feb 2026
- 2026NeST: Neuron Selective Tuning for LLM Safety18 Feb 2026
- 2026Reducing Hallucinations in LLMs via Factuality-Aware Preference Learning6 Jan 2026
- 2025Constrained Language Model Policy Optimization via Risk-aware Stepwise Alignment30 Dec 2025
- 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring12 Dec 2025
- 2025Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimization12 Dec 2025
- 2025SPA: Achieving Consensus in LLM Alignment via Self-Priority Optimization9 Nov 2025
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agents5 Nov 2025
- 2025Reducing the Probability of Undesirable Outputs in Language Models Using Probabilistic Inference24 Oct 2025
- 2025Don't Walk the Line: Boundary Guidance for Filtered Generation13 Oct 2025
- 2025A-IPO: Adaptive Intent-driven Preference Optimization11 Oct 2025
- 2025Provably Convergent Primal-Dual DPO for Constrained LLM Alignment7 Oct 2025
- 2025DriveDPO: Policy Learning via Safety DPO For End-to-End Autonomous Driving22 Sep 2025
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Training12 Aug 2025
- 2025The Geometry of Harmfulness in LLMs through Subconcept Probing23 Jul 2025
- 2025A Technical Survey of Reinforcement Learning Techniques for Large Language Models5 Jul 2025
- 2025Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimizationcited by 11
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2025SPA: Achieving Consensus in LLM Alignment via Self-Priority Optimizationcited by 3
- 2026Reducing Hallucinations in LLMs via Factuality-Aware Preference Learningcited by 2
- 2026NeST: Neuron Selective Tuning for LLM Safetycited by 2
- 2025A-IPO: Adaptive Intent-driven Preference Optimizationcited by 1
- 2026Improving Safety Alignment via Balanced Direct Preference Optimizationcited by 1
- 2026Cat-DPO: Category-Adaptive Safety Alignmentcited by 1
- 2026PREFINE: Preference-Based Implicit Reward and Cost Fine-Tuning for Safety Alignmentcited by 1
- 2026DOG-DPO:Dynamic Optimization in Geometry for Safety Alignmentcited by 1
- 2026Safe Inference-Time Alignment via Lagrangian Reward Augmentationcited by 1
- 2025Provably Convergent Primal-Dual DPO for Constrained LLM Alignmentcited by 0
12 most cited of 23 All 23 (JSON)
- 2026TRACE: Trajectory Return Attribution and Contrastive Erasure for Multi-Turn Safety1 Oct 2026
- 2026Suan: Rectifying Direct Preference Safety Alignment in Large Language Models8 Sep 2026
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models3 Jul 2026
- 2026Safe Inference-Time Alignment via Lagrangian Reward Augmentation2 Jul 2026
- 2026DOG-DPO:Dynamic Optimization in Geometry for Safety Alignment4 Jun 2026
- 2026Curriculum Learning for Safety Alignment25 May 2026
- 2026PREFINE: Preference-Based Implicit Reward and Cost Fine-Tuning for Safety Alignment20 May 2026
- 2026Distributed Direct Preference Optimization20 May 2026
- 2026BSO: Safety Alignment Is Density Ratio Matching12 May 2026
- 2026MGDA-Decoupled: Geometry-Aware Multi-Objective Optimisation for DPO-based LLM Alignment22 Apr 2026
- 2026Cat-DPO: Category-Adaptive Safety Alignment19 Apr 2026
- 2026The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Training9 Apr 2026
12 newest of 23 All 23 (JSON)
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agentscited by 2
- 2026Reinforcing Real-world Service Agents: Balancing Utility and Cost in Task-oriented Dialoguecited by 1
- 2026Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Tracescited by 0
- 2026Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces1 Jul 2026
- 2026Reinforcing Real-world Service Agents: Balancing Utility and Cost in Task-oriented Dialogue26 Feb 2026
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agents5 Nov 2025
- 2025The Geometry of Harmfulness in LLMs through Subconcept Probingcited by 7
- 2025Don't Walk the Line: Boundary Guidance for Filtered Generationcited by 0
- 2025Reducing the Probability of Undesirable Outputs in Language Models Using Probabilistic Inferencecited by 0
- 2026Selective Safety Steering via Value-Filtered Decodingcited by 0
- 2026Selective Safety Steering via Value-Filtered Decoding14 May 2026
- 2025Reducing the Probability of Undesirable Outputs in Language Models Using Probabilistic Inference24 Oct 2025
- 2025Don't Walk the Line: Boundary Guidance for Filtered Generation13 Oct 2025
- 2025The Geometry of Harmfulness in LLMs through Subconcept Probing23 Jul 2025
Similar, not cited
Close in wording, no citation either way
- 2024Enhancing Safety in Reinforcement Learning with Human Feedback via Rectified Policy Optimization
- 2025Efficient Safety Alignment of Large Language Models via Preference Re-ranking and Representation-based Reward Modeling
- 2025Reinforcement Learning from Human Feedback with High-Confidence Safety Constraints
- 2023Beyond One-Preference-Fits-All Alignment: Multi-Objective Direct Preference Optimization
- 2024AlphaDPO: Adaptive Reward Margin for Direct Preference Optimization
- 2025Safe RLHF-V: Safe Reinforcement Learning from Multi-modal Human Feedback
- 2025MPO: Multilingual Safety Alignment via Reward Gap Optimization
- 2025A Survey of Direct Preference Optimization