Contrastive Reasoning Alignment: Reinforcement Learning from Hidden Representations

Abstract

We propose CRAFT, a red-teaming alignment framework that leverages model reasoning capabilities and hidden representations to improve robustness against jailbreak attacks. Unlike prior defenses that operate primarily at the output level, CRAFT aligns large reasoning models to generate safety-aware reasoning traces by explicitly optimizing objectives defined over the hidden state space. Methodologically, CRAFT integrates contrastive representation learning with reinforcement learning to separate safe and unsafe reasoning trajectories, yielding a latent-space geometry that supports robust, reasoning-level safety alignment. Theoretically, we show that incorporating latent-textual consistency into GRPO eliminates superficially aligned policies by ruling them out as local optima. Empirically, we evaluate CRAFT on multiple safety benchmarks using two strong reasoning models, Qwen3-4B-Thinking and R1-Distill-Llama-8B, where it consistently outperforms state-of-the-art defenses such as IPO and SafeKey. Notably, CRAFT delivers an average 79.0% improvement in reasoning safety and 87.7% improvement in final-response safety over the base models, demonstrating the effectiveness of hidden-space reasoning alignment.

Figures (5)

• Figure 1: Comparison of reasoning-level safety behaviors under a jailbreak prompt. The base model exhibits superficial safety alignment, where harmful expressions appear in reasoning despite a safe refusal. An aligned baseline reduces explicit toxicity but still retains risky reasoning patterns. CRAFT aligns reasoning at the latent level, avoiding explicit harmful expressions and guiding the reasoning process toward positive value-oriented, safety-consistent interpretations while producing a safe refusal.
• Figure 2: Latent separation of reasoning traces.Left: PCA projection of hidden states from DeepSeek-R1-Distill-Llama-8B reveals a clear geometric separation between safe and unsafe reasoning traces, with rethink traces forming a distinct transitional subspace. Right: PCA projection of hidden states from Qwen3-4B-Thinking exhibits the same separation pattern, indicating model-agnostic latent structure.
• Figure 3: Overall pipeline of CRAFT. The framework integrates Latent Contrastive Learning for Reasoning (LCLR) with Reinforcement over Reasoning Latents ($\mathbf{R}^2\mathbf{L}$). LCLR geometrically structures the latent space of reasoning traces by separating safe, unsafe, and rethink states into distinct regions, yielding a stable and interpretable safety representation. Building on this structure, $\mathbf{R}^2\mathbf{L}$ applies latent-aware reinforcement to steer reasoning trajectories toward safe regions while preserving alignment between internal reasoning dynamics and final outputs.
• Figure 4: CRAFT performance under advanced jailbreak attacks. We evaluate CRAFT against two strong jailbreak methods, GPTFuzzer and AutoDAN. Performance is measured using the StrongReject score on final responses and the safety rate of intermediate reasoning traces. Across settings, CRAFT achieves substantial safety improvements, with gains of 72.1% in reasoning-trace safety and 85.9% in final-response safety, demonstrating robustness under aggressive jailbreak conditions.
• Figure 5: Prompt used for reasoning-trace safety evaluation.

Theorems & Definitions (3)

• Definition 5.1: Superficial Safety Alignment
• Theorem 5.1: Elimination of SSA
• proof