Towards Safety Reasoning in LLMs: AI-agentic Deliberation for Policy-embedded CoT Data Creation
On the map: LLM reasoning → Reasoning for agents, planning and code
also in 2 more
Abstract (arXiv)
Safety reasoning is a recent paradigm where LLMs reason over safety policies before generating responses, thereby mitigating limitations in existing safety measures such as over-refusal and jailbreak vulnerabilities. However, implementing this paradigm is challenging due to the resource-intensive process of creating high-quality policy-embedded chain-of-thought (CoT) datasets while ensuring reasoning remains accurate and free from hallucinations or policy conflicts. To tackle this, we propose AIDSAFE: Agentic Iterative Deliberation for Safety Reasoning, a novel data generation recipe that leverages multi-agent deliberation to iteratively expand reasoning on safety policies. A data refiner stage in AIDSAFE ensures high-quality outputs by eliminating repetitive, redundant, and deceptive thoughts. AIDSAFE-generated CoTs provide a strong foundation for supervised fine-tuning (SFT)-based safety training. Additionally, to address the need of preference data in alignment stages, such as DPO training, we introduce a supplemental recipe that uses belief augmentation to create distinct selected and rejected CoT samples. Our evaluations demonstrate that AIDSAFE-generated CoTs achieve superior policy adherence and reasoning quality. Consequently, we show that fine-tuning open-source LLMs on these CoTs can significantly improve safety generalization and jailbreak robustness while maintaining acceptable utility and over-refusal accuracy. AIDSAFE-generated CoT datasets can be found here: https://huggingface.co/datasets/AmazonScience/AIDSAFE
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 26 of its 31 references that are in the map. First posted on arXiv 27 May 2025.
Builds on
26 of 31 references.
Closest ancestors · 3
Same direction, newest first
- 2025Trading Inference-Time Compute for Adversarial Robustness31 Jan
- 2024OpenAI o1 System Card21 Dec
- 2024Deliberative Alignment: Reasoning Enables Safer Language Models20 Dec
Other references · 23
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Mistral 7Bcited by 3,164
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
- 2024Mixtral of Expertscited by 1,823
- 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,784
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 629
- 2024Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMscited by 570
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
11 more
- 2018AI safety via debatecited by 400
- 2024A StrongREJECT for Empty Jailbreakscited by 385
- 2023Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agentscited by 333
- 2024Debating with More Persuasive LLMs Leads to More Truthful Answerscited by 266
- 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 243
- 2022ROSCOE: A Suite of Metrics for Scoring Step-by-Step Reasoningcited by 177
- 2024Reinforcement Learning for LLM Post-Training: A Surveycited by 92
- 2024A Chain-of-Thought Is as Strong as Its Weakest Link: A Benchmark for Verifiers of Reasoning Chainscited by 65
- 2023AlpaGasus: Training A Better Alpaca with Fewer Datacited by 19
- 2024Data Advisor: Dynamic Data Curation for Safety Alignment of Large Language Modelscited by 13
- 2023JAB: Joint Adversarial Prompting and Belief Augmentationcited by 5
Built on by
Citing papers per year: 2026: 3.
3 papers.
Similar, not cited
Close in wording, no citation either way
- 2025RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards
- 2025A Concrete Roadmap towards Safety Cases based on Chain-of-Thought Monitoring
- 2026LPG: Balancing Efficiency and Policy Reasoning in Latent Policy Guardrails
- 2026DRAFT: Task Decoupled Latent Reasoning for Agent Safety
- 2026ConsisGuard: Aligning Safety Deliberation with Policy Enforcement in LLM Guardrails
- 2026AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails
- 2026Enhancing Agent Safety Judgment: Controlled Benchmark Rewriting and Analogical Reasoning for Deceptive Out-of-Distribution Scenarios
- 2026Reducing the Safety Tax in LLM Safety Alignment with On-Policy Self-Distillation