这篇论文发现LRM自己就能识别风险，用SFT+DPO触发安全分析，让DeepSeek-R1的越狱成功率高降36%，还不用外部数据，挺实用的。
论文Safe Trigger提出利用大推理模型(LRM)自身的潜在安全意识进行安全对齐，无需外部人工标注。该方法先使用监督微调(SFT)为不安全查询注入安全标签触发安全分析，对一般查询保持原响应实现自适应；再通过直接偏好优化(DPO)提升安全分析的稳定性。实验显示，DeepSeek-R1-Distill-Llama-8B在有害和越狱基准上的攻击成功率(ASR)平均下降24.65%和36.72%，且通用性能几乎不受影响。
Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models
While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.