Self-Guard: Defending Large Reasoning Models via enhanced self-reflection

TL;DR

Self-Guard tackles safety in Large Reasoning Models by closing the awareness–compliance gap through two latent interventions that operate at inference time. Safety-oriented prompting activates latent safety awareness, while safety activation steering amplifies a computed safety direction in the hidden-state space, yielding a final representation $\mathbf{h}''(x) = \mathbf{h}'(x) + \lambda \cdot \mathbf{v}_{\text{safety}}$. Across multiple Qwen3 backbones and standard safety and utility benchmarks, Self-Guard matches or surpasses state-of-the-art baselines without sacrificing general reasoning performance, and demonstrates robustness against jailbreak attempts and unseen risks. The approach generalizes across model scales and relies on a single, compact safety vector extracted from a small harmful-data set, suggesting a universal safety-reflection direction. This work highlights the feasibility of a training-free, representation-level defense with potential extensions to other alignment tasks like reducing hallucinations and improving reasoning consistency.

Abstract

The emergence of Large Reasoning Models (LRMs) introduces a new paradigm of explicit reasoning, enabling remarkable advances yet posing unique risks such as reasoning manipulation and information leakage. To mitigate these risks, current alignment strategies predominantly rely on heavy post-training paradigms or external interventions. However, these approaches are often computationally intensive and fail to address the inherent awareness-compliance gap, a critical misalignment where models recognize potential risks yet prioritize following user instructions due to their sycophantic tendencies. To address these limitations, we propose Self-Guard, a lightweight safety defense framework that reinforces safety compliance at the representational level. Self-Guard operates through two principal stages: (1) safety-oriented prompting, which activates the model's latent safety awareness to evoke spontaneous reflection, and (2) safety activation steering, which extracts the resulting directional shift in the hidden state space and amplifies it to ensure that safety compliance prevails over sycophancy during inference. Experiments demonstrate that Self-Guard effectively bridges the awareness-compliance gap, achieving robust safety performance without compromising model utility. Furthermore, Self-Guard exhibits strong generalization across diverse unseen risks and varying model scales, offering a cost-efficient solution for LRM safety alignment.

Figures (7)

• Figure 1: Overview of Self-Guard.$\mathcal{G}$ builds safety alignment for a target LRM $\mathcal{R}$ through two sequential latent interventions: (1) Safety-oriented prompting ($\mathcal{G}_{\text{prompt}}$), where $\mathcal{G}$ augments the input query $x_i$ with a safety-oriented instruction $s$, inducing a shift of the hidden state $\mathbf{h}(x_i)$ to a safety-oriented state $\mathbf{h}'(x_i) = \mathbf{h}(x_i \oplus s)$; (2) Safety activation steering ($\mathcal{G}_{\text{steer}}$), where this latent shift is extracted as a steering vector $\mathbf{v}_{\text{safety}}$ and injected to $\mathbf{h}'(x_i)$ to fortify $\mathcal{R}$'s safety awareness, yielding the final aligned hidden state $\mathbf{h}"(x_i) = \mathbf{h}'(x_i) + \lambda \cdot \mathbf{v}_{\text{safety}}$.
• Figure 2: Self-Guard narrows the Awareness-Compliance Gap. Dashed bars represent Safety Awareness ($P_{\text{aware}}$), while solid bars represent Safety Compliance ($P_{\text{compliance}}$). Red arrows highlight the gap where models detect risks but fail to refuse them. Self-Reminder denotes the safety prompt baseline (i.e., Self-Guard without vector enhancement).
• Figure 3: Microscopic analysis of refusal probability enhancement. The heatmap shows the mean log-ratios ($\Delta_{\log}$) of Self-Guard against Self-Reminder. Results demonstrate that Self-Guard's safety vector enhancement consistently increases the refusal probabilities across all model scales and attack types once safety awareness is triggered.
• Figure 4: Case study on medical misinformation. While Self-Reminder triggers initial safety awareness, it fails to maintain it, eventually rationalizing the request to fulfill the query. Conversely, Self-Guard ensures that recognized risks directly lead to a refusal response.
• Figure 5: Self-Guard narrows the Awareness-Compliance Gap on Qwen3-4B crosses full safety benchmarks. Dashed bars represent Safety Awareness ($P_{\text{aware}}$), while solid bars represent Safety Compliance ($P_{\text{compliance}}$). Red arrows highlight the gaps where models detect risks but fail to refuse them.