{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2608-09542","title":"Dual-Adversarial Safety Alignment: Cultivating Intrinsic Threat Comprehension in LRMs","arxiv_id":"2608.09542","date":"2026-08-10","proceeding":null,"authors":["Hongli Shen","Shaopeng Fu","Qinbo Zhang","Jian Li","Di Wang"],"abstract":"Large reasoning models (LRMs) achieve remarkable success on complex tasks but remain vulnerable to harmful prompts that induce unsafe outputs. Recent methods align LRMs using direct refusals or safety rationales, yet often focus on prompt patterns rather than intrinsic attack mechanisms. As a result, these pattern-centric alignments struggle to generalize across diverse jailbreaks, compromising adversarial robustness and reasoning utility. We propose AdvSafe, a dual-adversarial framework that enables LRMs to internalize unsafety knowledge by explicitly deconstructing adversarial mechanisms. This moves beyond pattern-dependent traces, fostering robust cognitive defense without compromising reasoning utility. Our pipeline operates via a two-phase adversarial game. First, in adversarial synthesis, an autonomous agent dynamically crafts deceptive jailbreak prompts, adapting its strategies to breach a strong teacher model. Second, in adversarial extraction, the breached teacher executes a cognitive counter-attack. For every successful jailbreak, the teacher unmasks the camouflage, explaining why the attack succeeds and how such prompts can be identified and mitigated. This dual-adversarial process yields a compact reasoning dataset capturing rich, generalizable unsafety knowledge. Student models trained on this dataset implicitly acquire safety alignment through intrinsic threat comprehension. Experiments show that with only 1K synthesized samples, AdvSafe-aligned LRMs achieve significantly stronger jailbreak robustness than existing baselines, with almost no utility degradation. Furthermore, AdvSafe improves robustness against out-of-distribution prompts, demonstrating that learning unsafety knowledge enables a superior robustness-utility trade-off and generalizes beyond seen attack patterns.","url_abs":"https://arxiv.org/abs/2608.09542","url_pdf":"https://arxiv.org/pdf/2608.09542","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2608.09542","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2608.09542"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/renmiamu/AdvSafe","reach":null}],"summary":{"ran":20,"unverified":2},"by_repo_kind":{"found_in_text":{"samples":22,"ran":20,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"afb3b36b47de3899","entry":"AuthorityAppealsStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"afb3b36b47de3899"}},{"code_sha256_prefix":"65234b068cc07894","entry":"CombinedStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"65234b068cc07894"}},{"code_sha256_prefix":"d9566eed63a2436e","entry":"ComparisonStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d9566eed63a2436e"}},{"code_sha256_prefix":"41c2a8097bc9918a","entry":"ContextualCloakingStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"41c2a8097bc9918a"}},{"code_sha256_prefix":"54c7ee2c7899bf8b","entry":"EmotionalManipulationStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"54c7ee2c7899bf8b"}},{"code_sha256_prefix":"d8f79c4d92a0405c","entry":"FewShotStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d8f79c4d92a0405c"}},{"code_sha256_prefix":"27986bf6e69a7bd5","entry":"FormattingInjectionStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"27986bf6e69a7bd5"}},{"code_sha256_prefix":"e86b1fce03c8d6b7","entry":"GradualEscalationStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e86b1fce03c8d6b7"}},{"code_sha256_prefix":"f170414dd48b82ff","entry":"HypotheticalStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f170414dd48b82ff"}},{"code_sha256_prefix":"37afd5aaa8c641ee","entry":"JSONMemory","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"37afd5aaa8c641ee"}},{"code_sha256_prefix":"d235e4183fa16ed2","entry":"JailbreakPrefixStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d235e4183fa16ed2"}},{"code_sha256_prefix":"fe03951fae0fb28c","entry":"LLMScorer","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fe03951fae0fb28c"}},{"code_sha256_prefix":"b7e59478261e5937","entry":"LanguageEncodingStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b7e59478261e5937"}},{"code_sha256_prefix":"3373b8875dc0609f","entry":"LogicalReasoningStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3373b8875dc0609f"}},{"code_sha256_prefix":"1dcaa4468ebbb2aa","entry":"ObfuscationStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1dcaa4468ebbb2aa"}},{"code_sha256_prefix":"94187201f6e9af1c","entry":"OpenAITarget","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"94187201f6e9af1c"}},{"code_sha256_prefix":"edcbb3c7c178876d","entry":"PrivilegeEscalationStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"edcbb3c7c178876d"}},{"code_sha256_prefix":"3b2e3df111630101","entry":"RefusalSuppressionStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3b2e3df111630101"}},{"code_sha256_prefix":"a21833303528f157","entry":"RolePlayStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a21833303528f157"}},{"code_sha256_prefix":"db17e19be6c4da48","entry":"SplitQueryStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"db17e19be6c4da48"}},{"code_sha256_prefix":"8ef6051a08fe0db1","entry":"AttackStrategy","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8ef6051a08fe0db1"}},{"code_sha256_prefix":"528b86b6bc65a5ae","entry":"Attacker","repo":"renmiamu/AdvSafe","repo_kind":"found_in_text","path":"src/agent/attacker.py","file_url":"https://github.com/renmiamu/AdvSafe/blob/HEAD/src/agent/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"528b86b6bc65a5ae"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,264 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9581,"papers_checked":6264},"entries":[],"not_placed":{"boards":3,"rejected_by_independent_check":2,"refused_by_a_rule":1,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}