# Safety alignment, refusal and guardrails Area: [LLM safety and security](https://mlsanity.com/safety/index.md). HTML: https://mlsanity.com/safety/safety-alignment-refusal-and-guardrails/ ## Key facts - Safety alignment, refusal and guardrails: 1,071 papers on arXiv since 2022 (data through 14 Oct 2026). - 244 of its 1,071 mapped papers (23%) cite “Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!” (2023, arXiv 2310.03693). - 204 of its 1,071 mapped papers (19%) cite “Refusal in Language Models Is Mediated by a Single Direction” (2024, arXiv 2406.11717). - 58 new papers 24 Sep–14 Oct. ## Most cited here - [Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!](https://mlsanity.com/paper/2310.03693/) (2023), cited by 244 papers here - [Refusal in Language Models Is Mediated by a Single Direction](https://mlsanity.com/paper/2406.11717/) (2024), cited by 204 papers here - [Safety Alignment Should Be Made More Than Just a Few Tokens Deep](https://mlsanity.com/paper/2406.05946/) (2024), cited by 160 papers here - [WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs](https://mlsanity.com/paper/2406.18495/) (2024), cited by 149 papers here - [Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications](https://mlsanity.com/paper/2402.05162/) (2024), cited by 86 papers here - [Improving Alignment and Robustness with Circuit Breakers](https://mlsanity.com/paper/2406.04313/) (2024), cited by 86 papers here - [OR-Bench: An Over-Refusal Benchmark for Large Language Models](https://mlsanity.com/paper/2405.20947/) (2024), cited by 76 papers here - [PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preference](https://mlsanity.com/paper/2406.15513/) (2024), cited by 62 papers here - [LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B](https://mlsanity.com/paper/2310.20624/) (2023), cited by 58 papers here - [Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails](https://mlsanity.com/paper/2501.09004/) (2025), cited by 58 papers here ## New (24 Sep–14 Oct) - [Moral Combat: Exploiting Moral Foundations Theory to Jailbreak LLMs](https://mlsanity.com/paper/2610.19587/) (2026-10-14) - [DANGERLENS: Probing Dangerous Representations Hidden by Safety Alignment](https://mlsanity.com/paper/2610.19365/) (2026-10-14) - [Decomposing and Predicting Annotation Disagreement in Harmful Content Across Languages](https://mlsanity.com/paper/2610.18588/) (2026-10-13) - [Efficient Safety Guardrails through Latent Dual-Hypothesis Reasoning with On-Demand Trace Reconstruction](https://mlsanity.com/paper/2610.18304/) (2026-10-13) - [CompanionSafe: From Multi-turn Safety Evaluation to Guardrails for AI Companions](https://mlsanity.com/paper/2610.18095/) (2026-10-13) - [Cross-Lingual Transfer of Evil Vectors Is Directionally Asymmetric](https://mlsanity.com/paper/2610.17880/) (2026-10-13) - [REA: From Correct LLM Judgments to Safe Decision Delivery](https://mlsanity.com/paper/2610.17473/) (2026-10-12) - [Separating Prompt Harmfulness from Interaction Safety via Partial Generation](https://mlsanity.com/paper/2610.16761/) (2026-10-12) - [What the Model Cannot See: Covert and Provable Text Invisibility in LLMs](https://mlsanity.com/paper/2610.15883/) (2026-10-11) - [TRACE: Temporal Risk Assessment and Concept Editing for Safer Language Generation](https://mlsanity.com/paper/2610.15365/) (2026-10-11) - [Running Fewer Loops Removes Refusal Behaviour in Recurrent-Depth Language Models](https://mlsanity.com/paper/2610.15218/) (2026-10-10) - [Specification-Based Testing of Large Language Models](https://mlsanity.com/paper/2610.14443/) (2026-10-10) - [Attention Sees, MLP Refuses: Tracing the Attention-to-MLP Safety Pathway in LLMs](https://mlsanity.com/paper/2610.13078/) (2026-10-09) - [Same Outcome, Different Evidence: Intent Recovery in LLM Safety Evaluation](https://mlsanity.com/paper/2610.11766/) (2026-10-08) - [How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense](https://mlsanity.com/paper/2610.11005/) (2026-10-07) - [Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models](https://mlsanity.com/paper/2610.10625/) (2026-10-07) - [How to train your model organism](https://mlsanity.com/paper/2610.10203/) (2026-10-07) - [SafeEvo: Deciphering the Safety Alignment Mechanism and Evolution in Language Models](https://mlsanity.com/paper/2610.09600/) (2026-10-07) - [Quad-State Safety Evaluation of Open-Weight Large Language Models on Non-Canonical Inputs](https://mlsanity.com/paper/2610.09033/) (2026-10-06) - [AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails](https://mlsanity.com/paper/2610.08923/) (2026-10-06) - [Toward Alignment Scaling Laws: A Framework and First Preregistered Measurements](https://mlsanity.com/paper/2610.08540/) (2026-10-06) - [SIGMA: Self-Improving Alignment Generalization from a Model Spec](https://mlsanity.com/paper/2610.07935/) (2026-10-06) - [The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models](https://mlsanity.com/paper/2610.07723/) (2026-10-06) - [Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge](https://mlsanity.com/paper/2610.07532/) (2026-10-05) - [Dynamic Budget Allocation for LLM Evaluation under Hard Resource Constraints](https://mlsanity.com/paper/2610.07362/) (2026-10-05) - [SAFESHIELD: A Decision-Organization Framework for Deployment-Time Safety of Small Language Models](https://mlsanity.com/paper/2610.07276/) (2026-10-05) - [TrustMI: Causally controlling how assistants trust their users](https://mlsanity.com/paper/2610.06064/) (2026-10-05) - [Visual Grounding Safety in Vision-Language Models](https://mlsanity.com/paper/2610.05637/) (2026-10-05) - [Beyond Refusal Patterns: Safe-Role Internalization for Robust and Generalizable LLM Safety Alignment](https://mlsanity.com/paper/2610.07023/) (2026-10-04) - [Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential](https://mlsanity.com/paper/2610.05541/) (2026-10-04)