{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/reasoning-to-defend-safety-aware-reasoning","title":"Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking","arxiv_id":"2502.12970","date":"2025-02-18","proceeding":null,"authors":["Junda Zhu","Lingyong Yan","Shuaiqiang Wang","Dawei Yin","Lei Sha"],"abstract":"The reasoning abilities of Large Language Models (LLMs) have demonstrated remarkable advancement and exceptional performance across diverse domains. However, leveraging these reasoning capabilities to enhance LLM safety against adversarial attacks and jailbreak queries remains largely unexplored. To bridge this gap, we propose Reasoning-to-Defend (R2D), a novel training paradigm that integrates safety reflections of queries and responses into LLMs' generation process, unlocking a safety-aware reasoning mechanism. This approach enables self-evaluation at each reasoning step to create safety pivot tokens as indicators of the response's safety status. Furthermore, in order to improve the learning efficiency of pivot token prediction, we propose Contrastive Pivot Optimization(CPO), which enhances the model's ability to perceive the safety status of dialogues. Through this mechanism, LLMs dynamically adjust their response strategies during reasoning, significantly enhancing their defense capabilities against jailbreak attacks. Extensive experimental results demonstrate that R2D effectively mitigates various attacks and improves overall safety, highlighting the substantial potential of safety-aware reasoning in strengthening LLMs' robustness against jailbreaks.","url_abs":"https://arxiv.org/abs/2502.12970v1","url_pdf":"https://arxiv.org/pdf/2502.12970v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"reasoning-to-defend-safety-aware-reasoning","repo_url":"https://github.com/chuhac/Reasoning-to-Defend","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2502.12970","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2502.12970"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/chuhac/Reasoning-to-Defend","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":3,"unverified":3},"by_repo_kind":{"official":{"samples":6,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6fa90dd36057918e","entry":"expand_experiment_configs","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"HarmBench/eval_utils.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/HarmBench/eval_utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6fa90dd36057918e"}},{"code_sha256_prefix":"914cce1bc1e0a0d8","entry":"parse_indexing_expression","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"HarmBench/eval_utils.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/HarmBench/eval_utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"914cce1bc1e0a0d8"}},{"code_sha256_prefix":"0393dcd85dc803dd","entry":"replace_model_parameters","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"HarmBench/eval_utils.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/HarmBench/eval_utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0393dcd85dc803dd"}},{"code_sha256_prefix":"090eed81a24d4b32","entry":"load_model_and_tokenizer","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"HarmBench/baselines/model_utils.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/HarmBench/baselines/model_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"090eed81a24d4b32"}},{"code_sha256_prefix":"0d79bfe766d28836","entry":"r2d_post_process","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"HarmBench/generate_completions.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/HarmBench/generate_completions.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0d79bfe766d28836"}},{"code_sha256_prefix":"0ea81c2966470a99","entry":"r2d_post_process","repo":"chuhac/Reasoning-to-Defend","repo_kind":"official","path":"jailbreakbench/jbb_response.py","file_url":"https://github.com/chuhac/Reasoning-to-Defend/blob/HEAD/jailbreakbench/jbb_response.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0ea81c2966470a99"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}