How Does the Thinking Step Influence Model Safety? An Entropy-based Safety Reminder for LRMs

TL;DR

The paper tackles safety risks in large reasoning models that reveal their thinking steps by introducing SafeRemind, a decoding-time defense that injects safe-reminding phrases at entropy-based decision-locking points without any parameter updates. By grounding interventions in model entropy signals, SafeRemind can steer potentially unsafe reasoning trajectories toward safe refusals while preserving core reasoning capabilities. Across five LRMs and six benchmarks, SafeRemind yields substantial safety improvements, up to 45.5 percentage points in LG3 scores, with minimal degradation to reasoning tasks such as MATH-500 and GPQA. The approach is training-free, scalable, and generalizes across architectures, offering a practical, low-overhead method to enhance LRM safety in real-world deployments.

Abstract

Large Reasoning Models (LRMs) achieve remarkable success through explicit thinking steps, yet the thinking steps introduce a novel risk by potentially amplifying unsafe behaviors. Despite this vulnerability, conventional defense mechanisms remain ineffective as they overlook the unique reasoning dynamics of LRMs. In this work, we find that the emergence of safe-reminding phrases within thinking steps plays a pivotal role in ensuring LRM safety. Motivated by this finding, we propose SafeRemind, a decoding-time defense method that dynamically injects safe-reminding phrases into thinking steps. By leveraging entropy triggers to intervene at decision-locking points, SafeRemind redirects potentially harmful trajectories toward safer outcomes without requiring any parameter updates. Extensive evaluations across five LRMs and six benchmarks demonstrate that SafeRemind substantially enhances safety, achieving improvements of up to 45.5%p while preserving core reasoning utility.

Figures (11)

• Figure 1: LlamaGuard3 Score comparison between SafeRemind and various defense methods across different benchmarks. Our approach consistently outperforms others, achieving significantly higher safety performance with the target model DeepSeek-R1 7B.
• Figure 2: The running examples of SafeRemind. Given the same jailbreak query, the left side illustrates a failed defense, while the right side shows a successful defense enabled by inserting a safe-reminding phrase.
• Figure 3: The left bar chart shows the ratio of each label across safe responses and unsafe responses. The right pie chart shows the distribution of segment labels immediately preceding the first Safe-labeled segment.
• Figure 4: Safety evaluation of SafeRemind on diverse LRMs. Experiments conducted on the JailBreakBench benchmark, evaluated using LlamaGuard3.
• Figure 5: Sensitivity analysis of the entropy thresholds for safe-reminding phrases.