AlphaAlign: Incentivizing Safety Alignment with Extremely Simplified Reinforcement Learning
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Large language models (LLMs), despite possessing latent safety understanding from their vast pretraining data, remain vulnerable to generating harmful content and exhibit issues such as over-refusal and utility degradation after safety alignment. Current safety alignment methods often result in superficial refusal shortcuts or rely on intensive supervision for reasoning-based approaches, failing to fully leverage the model's intrinsic safety self-awareness. We propose AlphaAlign, a simple yet effective pure reinforcement learning (RL) framework with verifiable safety reward designed to incentivize this latent safety awareness through proactive safety reasoning. AlphaAlign employs a dual-reward system: a verifiable safety reward encourages correctly formatted and explicitly justified refusals for harmful queries while penalizing over-refusals, and a normalized helpfulness reward guides high-quality responses to benign inputs. This allows the model to develop proactive safety reasoning capabilities without depending on supervised safety-specific reasoning data. AlphaAlign demonstrates three key advantages: (1) Simplicity and efficiency, requiring only binary prompt safety labels and minimal RL steps for substantial improvements. (2) Breaking the safety-utility trade-off, by enhancing refusal of harmful content and reducing over-refusals, while simultaneously maintaining or even improving general task performance and robustness to unseen jailbreaks. (3) Deep alignment, fostering proactive safety reasoning that generates explicit safety rationales rather than relying on shallow refusal patterns.
Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 46 of its 50 references that are in the map. First posted on arXiv 20 Jul 2025.
Builds on
46 of 50 references.
Closest ancestors · 8
Same direction, newest first
- 2025Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety6 Mar
- 2024Rule Based Rewards for Language Model Safety2 Nov
- 2024Backtracking Improves Generation Safety22 Sep
- 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
- 2024Uncovering Safety Risks of Large Language Models through Concept Activation Vector18 Apr
- 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity3 Jan
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 38
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2017Proximal Policy Optimization Algorithmscited by 14,441
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 8,851
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2024Qwen2.5 Technical Reportcited by 4,713
- 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2024HybridFlow: A Flexible and Efficient RLHF Frameworkcited by 1,980
- 2015High-Dimensional Continuous Control Using Generalized Advantage Estimationcited by 1,916
26 more
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2025Kimi k1.5: Scaling Reinforcement Learning with LLMscited by 1,193
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2025Does Reinforcement Learning Really Incentivize Reasoning Capacity in LLMs Beyond the Base Model?cited by 948
- 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 865
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
- 2025Open-Reasoner-Zero: An Open Source Approach to Scaling Up Reinforcement Learning on the Base Modelcited by 450
- 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 394
- 2025Cognitive Behaviors that Enable Self-Improving Reasoners, or, Four Habits of Highly Effective STaRscited by 373
- 2024A StrongREJECT for Empty Jailbreakscited by 352
- 2023Iterative Preference Learning from Human Feedback: Bridging Theory and Practice for RLHF under KL-Constraintcited by 346
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
- 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 292
- 2024TrustLLM: Trustworthiness in Large Language Modelscited by 280
- 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
- 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
- 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 109
- 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 100
- 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
- 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 61
- 2024ALI-Agent: Assessing LLMs' Alignment with Human Values via Agent-based Evaluationcited by 46
- 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
- 2025Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoningcited by 11
- 2024Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Modelscited by 9
Built on by
Citing papers per year: 2025: 3; 2026: 11.
14 papers.
Sort:
By area:
- 2025TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewardscited by 11
- 2025Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimizationcited by 11
- 2025MLLMEraser: Achieving Test-Time Unlearning in Multimodal Large Language Models through Activation Steeringcited by 9
- 2026Internalizing Safety Understanding in Large Reasoning Models via Verificationcited by 3
- 2026LLM-enabled Applications Require System-Level Threat Monitoringcited by 2
- 2026RUBAS: Rubric-Based Reinforcement Learning for Agent Safetycited by 2
- 2026Self-ReSET: Learning to Self-Recover from Unsafe Reasoning Trajectoriescited by 1
- 2026Self-Evaluation Is Already There: Eliciting Latent Judge Calibration in Base LLMs with Minimal Datacited by 1
- 2026Inverting the Shield: Systematically Generating Safety Tests from Policy Specificationscited by 0
- 2026PolicyAlign: Direct Policy-Based Safety Alignment for Large Language Modelscited by 0
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Modelscited by 0
- 2026EOPSA: Efficient On-Policy Self-Distilled Safety Alignmentcited by 0
- 2026ReSI: Recursive Safety Improvement toward Resistant and Resilient AI8 Oct 2026
- 2026DeShortcut-Align: Decoupling Spurious Shortcuts for Robust Safety Alignment in Large Reasoning Models28 Sep 2026
- 2026EOPSA: Efficient On-Policy Self-Distilled Safety Alignment28 Sep 2026
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models4 Aug 2026
- 2026PolicyAlign: Direct Policy-Based Safety Alignment for Large Language Models24 Jun 2026
- 2026Self-Evaluation Is Already There: Eliciting Latent Judge Calibration in Base LLMs with Minimal Data3 Jun 2026
- 2026RUBAS: Rubric-Based Reinforcement Learning for Agent Safety2 Jun 2026
- 2026Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications24 May 2026
- 2026Self-ReSET: Learning to Self-Recover from Unsafe Reasoning Trajectories9 May 2026
- 2026Internalizing Safety Understanding in Large Reasoning Models via Verification9 May 2026
- 2026LLM-enabled Applications Require System-Level Threat Monitoring23 Feb 2026
- 2025Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimization12 Dec 2025
- 2026LLM-enabled Applications Require System-Level Threat Monitoringcited by 2
- 2026Self-Evaluation Is Already There: Eliciting Latent Judge Calibration in Base LLMs with Minimal Datacited by 1
- 2026Inverting the Shield: Systematically Generating Safety Tests from Policy Specificationscited by 0
- 2026ReSI: Recursive Safety Improvement toward Resistant and Resilient AIcited by 0
- 2026ReSI: Recursive Safety Improvement toward Resistant and Resilient AI8 Oct 2026
- 2026Self-Evaluation Is Already There: Eliciting Latent Judge Calibration in Base LLMs with Minimal Data3 Jun 2026
- 2026Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications24 May 2026
- 2026LLM-enabled Applications Require System-Level Threat Monitoring23 Feb 2026
Similar, not cited
Close in wording, no citation either way
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models
- 2026Towards Mitigating Deceptive Safety Alignment in Large Reasoning Models
- 2026BSO: Safety Alignment Is Density Ratio Matching
- 2025Beyond SFT: Reinforcement Learning for Safer Large Reasoning Models with Better Reasoning Ability
- 2025InvThink: Premortem Reasoning for Safer Language Models
- 2026THINKSAFE: Self-Generated Safety Alignment for Reasoning Models
- 2025Breaking the Safety-Capability Tradeoff: Reinforcement Learning with Verifiable Rewards Maintains Safety Guardrails in LLMs
- 2024Enhancing Safety in Reinforcement Learning with Human Feedback via Rectified Policy Optimization