Research map / Large language models / Reasoning and chain of thought

Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away

ICML 2026 · Large language models › Reasoning and chain of thought · approach: RL with verifiable rewards for reasoning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SafeThink, an inference-time defense that monitors reasoning steps with a safety reward model and injects the prefix "Wait, think safely" only when a step violates a safety threshold, cutting jailbreak ASR on multimodal reasoning models while preserving MathVista accuracy.

Problem

RL post-training for explicit chain-of-thought improves multimodal reasoning but degrades safety alignment, raising jailbreak success rates in multimodal large reasoning models (MLRMs).

Approach

Treat safety as a satisficing threshold constraint rather than a maximization objective; conditionally inject a short optimized steering prefix ("Wait, think safely") only when a monitored reasoning step falls below the safety threshold, and show that steering only the first 1-3 steps usually suffices.

Key results

• On JailbreakV-28K, SafeThink reduces LlamaV-o1 ASR from 63.33% to 5.74%, and on Hades reduces R1-Onevision ASR from 69.07% to 5.65%.
• SafeThink keeps MathVista accuracy near the original model (63.46% vs 63.51% average) while LessThink drops accuracy by about 15-18% on some models.
• Average ASR across five models in the efficiency table falls to 5.30% versus 44.01% for the original models.

Surprising findings

• Generic steering phrases without explicit safety language (e.g., 'Wait, think again') yield low safety success probability, while explicit safety cues work much better.
• Truncation-based defenses (ZeroThink, LessThink) leave substantial ASR and degrade reasoning accuracy.

Limitations

• Effectiveness depends on the quality of the safety reward model used for monitoring.
• Evaluation limited to 7B-scale open-source MLRMs and four jailbreak benchmarks.
• Oracle safety judge is GPT-4, and ASR counts a jailbreak if any of three samples is flagged.

Experimental setup

Datasets: JailbreakV-28K HADES FigStep MM-SafetyBench MathVista

Benchmarks: JailbreakV-28K HADES FigStep MM-SafetyBench MathVista

Metrics: attack success rate reasoning accuracy average generation time

Baselines: ZeroThink LessThink ZS-SafePath AdaShield

Builds on: GRPO AdaShield ZS-SafePath LessThink ZeroThink

Closest papers by meaning

• Towards Safe Reasoning in Large Reasoning Models via Corrective Intervention (ICLR 2026 · similarity 0.92)
• SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignment (NeurIPS 2025 · similarity 0.91)
• AlphaAlign: Incentivizing Safety Alignment with Extremely Simplified Reinforcement Learning (ICLR 2026 · similarity 0.91)
• Contrastive Reasoning Alignment: Reinforcement Learning from Hidden Representations (ICML 2026 · similarity 0.91)
• Reasoning as an Adaptive Defense for Safety (NeurIPS 2025 · similarity 0.90)
• Towards Mitigating Deceptive Safety Alignment in Large Reasoning Models (NeurIPS 2026 · similarity 0.90)