---
title: "How Should We Enhance the Safety of Large Reasoning Models:"
description: "This study asks which supervised fine-tuning (SFT) choices actually make them safer. 30 references, cited by 6 papers here."
authors: ["Zhexin Zhang", "Xian Qi Loye", "Victor Shea-Jay Huang", "Junxiao Yang", "Qi Zhu", "Shiyao Cui", "Fei Mi", "Lifeng Shang", "Yingkang Wang", "Hongning Wang", "Minlie Huang"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.936/"
doi: "10.18653/v1/2026.acl-long.936"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhang-2026-how-should-we-enhance-safety/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhang-2026-how-should-we-enhance-safety/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/3/) / How Should We Enhance the Safety of Large Reasoning Models: An Empirical Study

# How Should We Enhance the Safety of Large Reasoning Models: An Empirical Study

**Authors:** [Zhexin Zhang](https://md.research.elamur.ai/free/en/authors/zhexin-zhang/), Xian Qi Loye, Victor Shea-Jay Huang, [Junxiao Yang](https://md.research.elamur.ai/free/en/authors/junxiao-yang/), [Qi Zhu](https://md.research.elamur.ai/free/en/authors/qi-zhu/), [Shiyao Cui](https://md.research.elamur.ai/free/en/authors/shiyao-cui/), [Fei Mi](https://md.research.elamur.ai/free/en/authors/fei-mi/), [Lifeng Shang](https://md.research.elamur.ai/free/en/authors/lifeng-shang/), Yingkang Wang, [Hongning Wang](https://md.research.elamur.ai/free/en/authors/hongning-wang/) and [Minlie Huang](https://md.research.elamur.ai/free/en/authors/minlie-huang/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.936/) · [PDF](https://aclanthology.org/2026.acl-long.936.pdf) · [DOI 10.18653/v1/2026.acl-long.936](https://doi.org/10.18653/v1/2026.acl-long.936) · [OpenAlex](https://openalex.org/W4415025266)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · [6](https://md.research.elamur.ai/free/en/papers/zhang-2026-how-should-we-enhance-safety/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Large Reasoning Models (LRMs) are strong at maths and code, but their safety often stays the same or gets worse. This study asks which supervised fine-tuning (SFT) choices actually make them safer. The authors built training data by pairing 200 HarmBench questions with 20 jailbreak templates. They kept only responses that ReasoningShield judged safe and added benign XSTest queries.

The first finding is surprising: fine-tuning on safe responses distilled directly from DeepSeek-R1 helps very little. Analysing those traces, the authors found five risky reasoning patterns. One of them, "weak vacillation," gets past the safety filter. In this pattern, the model refuses the harmful core of a request but hesitates over harmless-looking context, such as a jailbreak persona.

Changing the distillation prompts to avoid these patterns greatly lowered attack success. Short or template-based reasoning traces turned out to be about as effective as long ones, which suggests safety may not need elaborate reasoning. Ablations on data size, learning rate, distillation source and benign-data mixing give practical guidance for safety-tuning LRMs without hurting reasoning ability.

## Key points
- **Models and benchmarks:** Four models were tested: DeepSeek-R1-Distill-Qwen-7B, DeepSeek-R1-Distill-Llama-8B, DeepSeek-R1-Distill-Qwen-32B and Qwen3-14B.
  - Reasoning was checked on MATH-500, AIME 2024 and LiveCodeBench.
  - Safety was measured as ASR (None, PAP and PAIR attacks) on 50 AdvBench queries, judged by LlamaGuard3 through AISafety-Lab.
- **Direct distillation fails:** Training on directly distilled "Default CoT" data only cut PAIR ASR from 66% to 54% on the 7B model.
- **Improved prompts work:** Prompts that remove the risky patterns reduced average PAIR ASR across the four models from 63.0% to 13.0%.
- **Data mix matters:** About 1,000 safety samples were enough. Training without the 100 benign samples gave very low ASR (1.3–2.0%) but over-refusal of up to 54.7%. Adding them gave ASR of 4.0–7.3% with much less over-refusal.
- **Learning rate and limits:** A learning rate of 5×10⁻⁶ gave the best balance of safety and reasoning. Ablations were run only on the 7B model, and RL-based methods are left for future work. Code and data are available at github.com/thu-coai/LRM-Safety-Study.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Tsinghua University](https://md.research.elamur.ai/free/en/universities/tsinghua-university/) — University, Beijing, China · 415 works · 94,028 citations
- [Huawei Technologies](https://md.research.elamur.ai/free/en/companies/huawei-technologies/) — Company, Shenzhen, China · 96 works · 15,432 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works · [⚙️ Engineering](https://md.research.elamur.ai/free/en/shelves/engineering/) · 188 works · [⚙️ Safety, Risk, Reliability and Quality](https://md.research.elamur.ai/free/en/shelves/engineering/safety-risk-reliability-and-quality/) · 14 works

🧭 Topics (2): [🧮 Reasoning](https://md.research.elamur.ai/free/en/topics/reasoning/) · 1,685 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Zhexin Zhang, Xian Qi Loye, Victor Shea-Jay Huang, Junxiao Yang, Qi Zhu, Shiyao Cui, Fei Mi, Lifeng Shang, Yingkang Wang, Hongning Wang and Minlie Huang. 2026. How Should We Enhance the Safety of Large Reasoning Models: An Empirical Study. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhang2026how,
  title = {{How Should We Enhance the Safety of Large Reasoning Models: An Empirical Study}},
  author = {Zhexin Zhang, Xian Qi Loye, Victor Shea-Jay Huang, Junxiao Yang, Qi Zhu, Shiyao Cui, Fei Mi, Lifeng Shang, Yingkang Wang, Hongning Wang and Minlie Huang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.936},
  url = {https://doi.org/10.18653/v1/2026.acl-long.936}
}
```

- [← previous How Good is Your Wikipedia? Auditing Data Quality for Low-resource and Multilingual NLP](https://md.research.elamur.ai/free/en/papers/tatariya-2026-how-good-is-your-wikipedia/)
- [next → LAILA: A Large Trait-Based Dataset for Arabic Automated Essay Scoring](https://md.research.elamur.ai/free/en/papers/bashendy-2026-laila-large-trait-based-dataset/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/3/)

## References

30 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023a. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
2. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023b. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). CoRR, abs/2310.08419.
3. Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. 2023. [Safe rlhf: Safe reinforcement learning from human feedback](https://md.research.elamur.ai/free/en/papers/dai-2023-safe-rlhf-safe-reinforcement-learning/). arXiv preprint arXiv:2310.12773.
4. DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, and 81 others. 2025. [Deepseek-r1: Incentivizing reasoning capability in llm…](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/)
5. Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and Karthik Narasimhan. 2023. [Toxicity in chatgpt: Analyzing persona-assigned language models](https://md.research.elamur.ai/free/en/papers/deshpande-2023-toxicity-chatgpt-analyzing-persona-assigned/). CoRR, abs/2304.05335.
6. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, and 82 others. 2024… — [The Llama 3 Herd of Models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/)
7. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, Zachary Yahn, Yichang Xu, and Ling Liu. 2025. Safety tax: Safety alignment makes your large reasoning models less reasonable. CoRR, abs/2503.00555. — [arXiv:2503.00555](https://arxiv.org/abs/2503.00555) [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Furkan+Tekin%2C+Zachary+Yahn%2C+Yichang+Xu%2C+and+Ling+Liu%2E+2025%2E+Safety+tax%3A+Safety+alignment+makes+your+large+reasoning+models+less+reasonable%2E+CoRR%2C+abs%2F2503)
8. Naman Jain, King Han, Alex Gu, Wen-Ding Li, Fanjia Yan, Tianjun Zhang, Sida Wang, Armando Solar-Lezama, Koushik Sen, and Ion Stoica. 2025. [Livecodebench: Holistic and contamination free evaluation of large language models for code](https://md.research.elamur.ai/free/en/papers/jain-2024-livecodebench-holistic-contamination-free-evaluation/). In The Thirteenth International Conference on Learning Representatio…
9. Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. Safechain: Safety of language models with long chain-of-thought reasoning capabilities. arXiv preprint arXiv:2502.12025. [find](https://scholar.google.com/scholar?q=Fengqing+Jiang%2C+Zhangchen+Xu%2C+Yuetai+Li%2C+Luyao+Niu%2C+Zhen+Xiang%2C+Bo+Li%2C+Bill+Yuchen+Lin%2C+and+Radha+Poovendran%2E+2025%2E+Safechain%3A+Safety+of+language+models+with+long+chain%2Dof%2Dthought+reasoning+capabiliti)
10. Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R. Narasimhan. 2024. [Swe-bench: Can language models resolve real-world github issues?](https://md.research.elamur.ai/free/en/papers/jimenez-2024-swe-bench-can-language-models/) In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenRe…
11. Changyi Li, Jiayi Wang, Xudong Pan, Geng Hong, and Min Yang. 2025. Reasoningshield: Content safety detection over reasoning traces of large reasoning models. CoRR, abs/2505.17244. — [arXiv:2505.17244](https://arxiv.org/abs/2505.17244) [find](https://scholar.google.com/scholar?q=Changyi+Li%2C+Jiayi+Wang%2C+Xudong+Pan%2C+Geng+Hong%2C+and+Min+Yang%2E+2025%2E+Reasoningshield%3A+Content+safety+detection+over+reasoning+traces+of+large+reasoning+models%2E+CoRR%2C+abs%2F2505%2E17244%2E+%E2%80%94+%5BarXiv%3A2505%2E17244%5D)
12. Yuhui Li, Fangyun Wei, Jinjing Zhao, Chao Zhang, and Hongyang Zhang. 2023. Rain: Your language models can align themselves without finetuning. arXiv preprint arXiv:2309.07124. — [arXiv:2309.07124](https://arxiv.org/abs/2309.07124) [find](https://scholar.google.com/scholar?q=Yuhui+Li%2C+Fangyun+Wei%2C+Jinjing+Zhao%2C+Chao+Zhang%2C+and+Hongyang+Zhang%2E+2023%2E+Rain%3A+Your+language+models+can+align+themselves+without+finetuning%2E+arXiv+preprint+arXiv%3A2309%2E07124%2E+%E2%80%94+%5BarXiv%3A2309%2E07124%5D%28htt)
13. Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. 2024. [Let’s verify step by step](https://md.research.elamur.ai/free/en/papers/lightman-2023-let-s-verify-step-step/). In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. Open-Rev…
14. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David A. Forsyth, and Dan Hendrycks. 2024a. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). In Forty-first International Conference…
15. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024b. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249.
16. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in Neural Information Processing Systems, 36:53728– 53741.
17. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. [Smoothllm: Defending large language models against jailbreaking attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/). arXiv preprint arXiv:2310.03684.
18. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. [Xstest: A test suite for identifying exaggerated safety behaviours in large language models](https://md.research.elamur.ai/free/en/papers/rottger-2023-xstest-test-suite-identifying-exaggerated/). In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational L…
19. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Mingchuan Zhang, Y. K. Li, Y. Wu, and Daya Guo. 2024. [Deepseekmath: Pushing the limits of mathematical reasoning in open language models](https://md.research.elamur.ai/free/en/papers/shao-2024-deepseekmath-pushing-limits-mathematical-reasoning/). CoRR, abs/2402.03300.
20. Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. 2020. Trl: Transformer reinforcement learning. [https://github.com/huggingface/trl](https://github.com/huggingface/trl). [↗](https://github.com/huggingface/trl)
21. Zijun Wang, Haoqin Tu, Yuhan Wang, Juncheng Wu, Jieru Mei, Brian R Bartoldson, Bhavya Kailkhura, and Cihang Xie. 2025. Star-1: Safer alignment of reasoning llms with 1k data. arXiv preprint arXiv:2504.01903. — [arXiv:2504.01903](https://arxiv.org/abs/2504.01903) [find](https://scholar.google.com/scholar?q=Zijun+Wang%2C+Haoqin+Tu%2C+Yuhan+Wang%2C+Juncheng+Wu%2C+Jieru+Mei%2C+Brian+R+Bartoldson%2C+Bhavya+Kailkhura%2C+and+Cihang+Xie%2E+2025%2E+Star%2D1%3A+Safer+alignment+of+reasoning+llms+with+1k+data%2E+arXiv+preprint+arXiv%3A2504)
22. Xianglin Yang, Gelei Deng, Jieming Shi, Tianwei Zhang, and Jin Song Dong. 2025. Enhancing model defense against jailbreaks with proactive safety reasoning. arXiv preprint arXiv:2501.19180. — [arXiv:2501.19180](https://arxiv.org/abs/2501.19180) [find](https://scholar.google.com/scholar?q=Xianglin+Yang%2C+Gelei+Deng%2C+Jieming+Shi%2C+Tianwei+Zhang%2C+and+Jin+Song+Dong%2E+2025%2E+Enhancing+model+defense+against+jailbreaks+with+proactive+safety+reasoning%2E+arXiv+preprint+arXiv%3A2501%2E19180%2E+%E2%80%94+%5BarXiv%3A25)
23. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
24. Yichi Zhang, Zihao Zeng, Dongbai Li, Yao Huang, Zhijie Deng, and Yinpeng Dong. 2025a. Realsafe-r1: Safety-aligned deepseek-r1 without compromising reasoning capability. arXiv preprint arXiv:2504.10081. — [arXiv:2504.10081](https://arxiv.org/abs/2504.10081) [find](https://scholar.google.com/scholar?q=Yichi+Zhang%2C+Zihao+Zeng%2C+Dongbai+Li%2C+Yao+Huang%2C+Zhijie+Deng%2C+and+Yinpeng+Dong%2E+2025a%2E+Realsafe%2Dr1%3A+Safety%2Daligned+deepseek%2Dr1+without+compromising+reasoning+capability%2E+arXiv+preprint+arXiv%3A2504%2E10081)
25. Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. 2023a. [Safetybench: Evaluating the safety of large language models](https://md.research.elamur.ai/free/en/papers/zhang-2023-safetybench-evaluating-safety-large/) with multiple choice questions. CoRR, abs/2309.07045.
26. Zhexin Zhang, Leqi Lei, Junxiao Yang, Xijie Huang, Yida Lu, Shiyao Cui, Renmiao Chen, Qinglin Zhang, Xinyuan Wang, Hao Wang, Hao Li, Xianqi Lei, Chengwei Pan, Lei Sha, Hongning Wang, and Minlie Huang. 2025b. Aisafetylab: A comprehensive framework for AI safety evaluation and improvement. CoRR, abs/2… — [arXiv:2502.16776](https://arxiv.org/abs/2502.16776) [find](https://scholar.google.com/scholar?q=Zhexin+Zhang%2C+Leqi+Lei%2C+Junxiao+Yang%2C+Xijie+Huang%2C+Yida+Lu%2C+Shiyao+Cui%2C+Renmiao+Chen%2C+Qinglin+Zhang%2C+Xinyuan+Wang%2C+Hao+Wang%2C+Hao+Li%2C+Xianqi+Lei%2C+Chengwei+Pan%2C+Lei+Sha%2C+Hongning+Wang%2C+and+Minlie+Huang%2E)
27. Zhexin Zhang, Jiaxin Wen, and Minlie Huang. 2023b. ETHICIST: targeted training data extraction through loss smoothed soft prompting and calibrated confidence estimation. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2023, Toro… [find](https://scholar.google.com/scholar?q=Zhexin+Zhang%2C+Jiaxin+Wen%2C+and+Minlie+Huang%2E+2023b%2E+ETHICIST%3A+targeted+training+data+extraction+through+loss+smoothed+soft+prompting+and+calibrated+confidence+estimation%2E+In+Proceedings+of+the+61st+Ann)
28. Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chujie Zheng, Hongning Wang, and Minlie Huang. 2024a. Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks. arXiv preprint arXiv:2407.02855. — [arXiv:2407.02855](https://arxiv.org/abs/2407.02855) [find](https://scholar.google.com/scholar?q=Zhexin+Zhang%2C+Junxiao+Yang%2C+Pei+Ke%2C+Shiyao+Cui%2C+Chujie+Zheng%2C+Hongning+Wang%2C+and+Minlie+Huang%2E+2024a%2E+Safe+unlearning%3A+A+surprisingly+effective+and+generalizable+solution+to+defend+against+jailbreak+a)
29. Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chujie Zheng, Hongning Wang, and Minlie Huang. 2024b. Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks. CoRR, abs/2407.02855. — [arXiv:2407.02855](https://arxiv.org/abs/2407.02855) [find](https://scholar.google.com/scholar?q=Zhexin+Zhang%2C+Junxiao+Yang%2C+Pei+Ke%2C+Shiyao+Cui%2C+Chujie+Zheng%2C+Hongning+Wang%2C+and+Minlie+Huang%2E+2024b%2E+Safe+unlearning%3A+A+surprisingly+effective+and+generalizable+solution+to+defend+against+jailbreak+a)
30. Zhexin Zhang, Junxiao Yang, Pei Ke, and Minlie Huang. 2023c. [Defending large language models against jailbreaking attacks through goal prioritization](https://md.research.elamur.ai/free/en/papers/zhang-2024-defending-large-language-models-against/). CoRR, abs/2311.09096.

*Updated 2 November 2026*