mlsanityData to 7 Oct 2026

Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away

arXiv 2602.11096 ↗First posted 11 Feb 2026cs.CL cs.AIcited by 3

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Reinforcement learning (RL) based post-training for explicit chain-of-thought (e.g., GRPO) improves the reasoning ability of multimodal large-scale reasoning models (MLRMs). But recent evidence shows that it can simultaneously degrade safety alignment and increase jailbreak success rates. We propose SafeThink, a lightweight inference-time defense that treats safety recovery as a satisficing constraint rather than a maximization objective. SafeThink monitors the evolving reasoning trace with a safety reward model and conditionally injects an optimized short corrective prefix ("Wait, think safely") only when the safety threshold is violated. In our evaluations across six open-source MLRMs and four jailbreak benchmarks (JailbreakV-28K, Hades, FigStep, and MM-SafetyBench), SafeThink reduces attack success rates by 30-60% (e.g., LlamaV-o1: 63.33% to 5.74% on JailbreakV-28K, R1-Onevision: 69.07% to 5.65% on Hades) while preserving reasoning performance (MathVista accuracy: 65.20% to 65.00%). A key empirical finding from our experiments is that safety recovery is often only a few steering steps away: intervening in the first 1-3 reasoning steps typically suffices to redirect the full generation toward safe completions.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 57 of its 74 references that are in the map. First posted on arXiv 11 Feb 2026.

Builds on

57 of 74 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignment20 May
  2. 2025Think in Safety: Unveiling and Mitigating Safety Alignment Collapse in Multimodal Large Reasoning Model10 May
  3. 2025SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models9 Apr
  4. 2025Safety Tax: Safety Alignment Makes Your Large Reasoning Models Less Reasonable1 Mar
  5. 2025The Hidden Risks of Large Reasoning Models: A Safety Assessment of R118 Feb
  6. 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilities17 Feb
  7. 2025Safety Reasoning with Guidelines6 Feb
  8. 2024OpenAI o1 System Card21 Dec
  9. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan
  10. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  11. 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking16 Nov

Other references · 46

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  5. 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,722
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  8. 2023Multimodal Chain-of-Thought Reasoning in Language Modelscited by 740
  9. 2025Vision-R1: Incentivizing Reasoning Capability in Multimodal Large Language Modelscited by 653
  10. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  11. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  12. 2024LLaVA-CoT: Let Vision Language Models Reason Step-by-Stepcited by 446
34 more
  1. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  2. 2025Kimi-VL Technical Reportcited by 381
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 368
  4. 2025R1-Onevision: Advancing Generalized Multimodal Reasoning through Cross-Modal Formalizationcited by 364
  5. 2024MME-RealWorld: Could Your Multimodal LLM Challenge High-Resolution Real-World Scenarios that are Difficult for Humans?cited by 284
  6. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  7. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 255
  8. 2025LMM-R1: Empowering 3B LMMs with Strong Reasoning Abilities Through Two-Stage Rule-Based RLcited by 244
  9. 2025SFT or RL? An Early Investigation into Training R1-Like Reasoning Large Vision-Language Modelscited by 209
  10. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 208
  11. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  12. 2024Mulberry: Empowering MLLM with o1-like Reasoning and Reflection via Collective Monte Carlo Tree Searchcited by 171
  13. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 162
  14. 2024Video-of-Thought: Step-by-Step Video Reasoning from Perception to Cognitioncited by 151
  15. 2025LlamaV-o1: Rethinking Step-by-step Visual Reasoning in LLMscited by 145
  16. 2024Marco-o1: Towards Open Reasoning Models for Open-Ended Solutionscited by 142
  17. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  18. 2025Qwen3Guard Technical Reportcited by 125
  19. 2025OpenVLThinker: Complex Vision-Language Reasoning via Iterative SFT-RL Cyclescited by 122
  20. 2024Theoretical guarantees on the best-of-n alignment policycited by 116
  21. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 113
  22. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  23. 2024Weak-to-Strong Jailbreaking on Large Language Modelscited by 100
  24. 2024Attacking Large Language Models with Projected Gradient Descentcited by 91
  25. 2024Query-Based Adversarial Prompt Generationcited by 55
  26. 2024PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Railscited by 49
  27. 2024Variational Best-of-N Alignmentcited by 49
  28. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 46
  29. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  30. 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddingscited by 31
  31. 2023Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMscited by 26
  32. 2023Analyzing the Inherent Response Tendency of LLMs: Real-World Instructions-Driven Jailbreakcited by 22
  33. 2025Challenges in Ensuring AI Safety in DeepSeek-R1 Models: The Shortcomings of Reinforcement Learning Strategiescited by 11
  34. 2025Bounded Rationality for LLMs: Satisficing Alignment at Inference-Timecited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agentscited by 0
  2. 2026First Token Matters: Understanding Safety Collapse in Large Reasoning Modelscited by 0
  3. 2026Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Towards Safe Reasoning in Large Reasoning Models via Corrective Intervention
  2. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking
  3. 2025When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Models
  4. 2025Large Reasoning Models Learn Better Alignment from Flawed Thinking
  5. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning
  6. 2025Beyond SFT: Reinforcement Learning for Safer Large Reasoning Models with Better Reasoning Ability
  7. 2026THINKSAFE: Self-Generated Safety Alignment for Reasoning Models
  8. 2025SaFeR-VLM: Toward Safety-aware Fine-grained Reasoning in Multimodal Models