REACT：通过干预思维链早期隐状态提升推理模型安全输出
REACT: Representational Early Analysis and Control of Chain-of-Thought Trajectories
这篇论文找到了干预思维链的最佳时机：开头两三个 token。在 DeepSeek-R1-Distill-8B 上把安全输出率从 29% 拉到 82%，权重还不用动。
arXiv 论文提出 REACT，一种条件性激活干预方法，从成对的安全与不安全思维链轨迹中学习安全方向，并在早期 CoT 隐状态上施加一次编辑，模型权重保持冻结。在 DeepSeek-R1-Distill-Llama-8B 上，该方法将 StrongREJECT-273 上完全安全输出的比例从 29.06% 提升到 82.05%，同时良性拒绝率和有用性接近基线。实验在三个蒸馏推理模型和三个生成种子上进行，发现最有效的干预集中在开头两到三个 token 的窗口；第四、五个 token 位置干预效果降至接近零，尽管这些位置的隐状态对风险的预测能力更强。论文由此区分了风险可读性与有效控制，指出干预时机必须通过其对后续生成的影响来评估。
REACT: Representational Early Analysis and Control of Chain-of-Thought Trajectories
Chain-of-thought (CoT) generation offers an opportunity to intervene before a reasoning model completes its answer. But does the point at which risk is easiest to detect also offer the most effective control? We study this question with REACT, a conditional activation intervention that learns a safety direction from paired safe and unsafe trajectories and applies it once to an early CoT hidden state. The model weights remain frozen, and all subsequent tokens are generated without further edits. To study timing, we train directions separately at each of the first five CoT positions and evaluate ungated edits with full post-edit regeneration. Across three distilled reasoning models and three generation seeds, the strongest gains concentrate in a two- to three-token early window; on DeepSeek-R1-Distill-Llama-8B, the effect falls to approximately zero at the fourth and fifth tokens, even though later states can be more predictive of risk. This separates risk readability from effective control: intervention timing must be evaluated through its effect on subsequent generation. On the same 8B model, REACT raises the rate of fully safe CoT-answer outputs on StrongREJECT-273 from 29.06% to 82.05%, while keeping benign refusal and usefulness near baseline. An anonymized implementation is available at https://anonymous.4open.science/r/REACT_official2-333B.