Large Reasoning Models can reason their way into unsafe answers—existing methods impose a "safety tax" that degrades the chain-of-thought or generalize poorly under adversarial prompts. SAVeR² fixes this with four fine-grained verifiable reward signals and a gradient projection that eliminates first-order conflicts between safety and reasoning objectives.
Figure: SAVeR² three-stage pipeline. Safety warm-up instills a structured refusal pattern; difficulty-aware selection removes easy prompts; GRPO with four verifiable rewards and safety/reasoning gradient projection removes the safety tax.
SAVeR² (arXiv:2611.07482) trains Large Reasoning Models (LRMs) with four verifiable reward signals graded by LLM-as-judge: safety reasoning, non-maliciousness, reasoning–answer consistency, and usefulness. A difficulty-aware data selection stage discards prompts already handled well, Gaussian-weighting the rest around a scale-dependent target difficulty. During GRPO training, a reasoning-preserving gradient projection eliminates first-order conflicts between the safety gradient and the reasoning gradient, removing the alignment tax. At 7B parameters, average safety score reaches 92.80 vs. 83.50 for the best baseline (PPO). At 14B, 94.28 vs. 87.22 (STAR-1). Under adversarial attacks (GCG, PAIR, TAP on AdvBench), the 14B variant achieves 97.33% defense success—highest of four compared methods. The 671B variant reaches 98.80 Safe@1, near Claude-4-Sonnet's 98.98, while raising reasoning Think@1 from 37.98 (base R1-671B) to 72.99.
Prefill jailbreaks work by forcing a harmful assistant prefix—but why do they erode refusal so reliably? This paper uses the Jacobian lens to pinpoint the mechanism and fixes it at inference time with no additional training.
Figure: Prefill attacks cause "refusal-state erosion"—the refusal signal collapses while harmfulness stays elevated. J-Anchor records the assistant-header state as an anchor and restores depleted refusal components during generation, reducing ASR from ~65–83% to ≤2.5%.
J-Anchor (arXiv:2611.01342) diagnoses prefill attacks with the Jacobian lens: under a forced prefix, the refusal signal "progressively declines to the benign baseline by the end of the prefill" while the harmfulness signal stays elevated. The proposed defense is training-free: (1) record the pre-attack refusal state at the assistant-header token; (2) gate on a risk threshold τ=0.75 to avoid modifying benign requests; (3) rescale and restore the depleted refusal components during prefilling and generation. On StrongREJECT with fixed-prefix attacks, ASR drops from 65.2%→1.0% (Llama-3.1-8B), 82.7%→0.0% (Gemma-4-E4B-IT), 77.3%→0.3% (Qwen3.5-4B). Deep-prefill (k=500) is similarly neutralized: ASR ≤2.5% across all backbones, reaching 0.0% on Gemma. Benign over-refusal on XSTest remains within 4 pp of the clean model.
Standard unlearning methods can match the retrained model's outputs while still encoding the supposedly forgotten information—PINT attacks this at the representation level by minimizing a provably correct information-theoretic objective.
Figure: PINT combines an HSIC-based forget loss (provably bounding Exact Memorization leakage) with a representation-matching retain loss. It achieves the best forgetting-utility Pareto frontier of any tested method, scaling to 70B parameters.
PINT (arXiv:2611.03955) minimizes the Hilbert-Schmidt Independence Criterion (HSIC) between prefix representations and next tokens on the forget set, provably bounding Exact Memorization leakage (Theorem 3.2). A retain loss anchors final-layer representations on retain data close to the original model, borrowing the RMU idea but weaker: Proposition 3.3 shows RMU's objective upper-bounds PINT's, so PINT does not require collapsing representations. Average area under the forget-utility Pareto frontier: 0.95 for PINT vs. ≤0.90 for all baselines. On Gaussian poisons, PINT makes them undetectable while retaining 91% utility vs. 63% for the best baseline. Scales to Llama-3-70B: WMDP-Cyber falls from 53.0%→27.6% (guessing target ≈25%) with only 0.002 MMLU drop.
Figure: Expert reduction at ~2/3 of experts raises harmful compliance by up to 18.4 points; SafeStart (run all experts for prompt + first 8 tokens) reduces this to ≤1.3 points while retaining ≥85% of the speedup.
Running fewer experts in MoE serving speeds up inference 15–28% but raises attack success by 18.4 pp (Qwen1.5-MoE), 9.5 pp (OLMoE), and 6.6 pp (DeepSeek-V2-Lite) under jailbreaks, while MMLU falls ≤1.8 pp. SafeStart—a training-free Triton kernel patch that runs all experts for the prompt and first 8 tokens before switching to the reduced budget—restores safety to within 1.3 pp of the original model and retains ≥85% of the speedup at batch sizes 8 and 32. This paper shows that any MoE serving optimization must be safety-validated before production deployment.
Figure: All 7 multimodal models are vulnerable; pooled ASR ranges from 7.1% to 34.5%. Adding multimodal content raises average ASR from 19.9% → 29.2% even as proactive verification rises.
Multimodal-SEA provides 608 expert-designed tasks from real-world fraud cases (14 domains, 152 scenarios, 4 difficulty levels), with outcomes verified against tool execution logs. All 7 tested models are vulnerable (ASR 7.1%–34.5%). Adding multimodal attack content raises average ASR from 19.9% → 29.2% even as agent verification coverage improves (54.7% → 65.1%)—agents verify more but still miss deceptive content. Multimodal deception miss rates reach 70.9%. Safety prompts halved attack success on GPT-5.6-Sol but raised miss rate from 50.4% → 63.5%.
Figure: A lightweight decision model screens retrieved passages before they reach the main LLM, cutting injection ASR from 27.9% to 5.7% at 76 ms per passage.
Open-weight decision models (Kev-4B) that answer typed questions about retrieved passages reduce prompt injection attack success from 27.9% → 5.7% (vs. 13.6% with published mitigations only) at 76 ms/passage with only 4 false positives out of 186 benign instruction pages. On retrieval pollution (200 queries, 2/3 fake pages), gating the full candidate pool holds accuracy at 83% and limits fake-page exposure to 0.5% vs. 28% without defense. HTML input outperforms plain text. Large LLM judges reach AUROC 0.99 vs. 0.94 for the gate but cost ~10× more.
Figure: None of 11 unlearning methods satisfies all four evaluation axes. The GapWiden + GapVeil two-stage add-on achieves oracle-level auditability and leakage for every tested method on TOFU.
Across 11 unlearning methods on TOFU, MUSE, and RWKU, none satisfies all four axes (forget quality, retain quality, membership-inference resistance, and the new auditability axis). The proposed GapWiden (post-training hinge loss, margin m=6) widens the audit gap; GapVeil (inference-time rejection sampler, budget K) suppresses leakage. With both, auditability and leakage reach oracle parity for every method on TOFU. On MUSE, average auditability improves from 0.84→0.99 (News) and 0.81→0.99 (Books). Attacker advantage with GapVeil falls to 0.11–0.15 vs. 0.10–0.37 without it.
Figure: Among probes with equal accuracy (competitive extractors), nuisance sensitivity (CFN) is uncorrelated with decodability. Selecting by Conflict score (circled) identifies low-CFN probes at a cost of ≤0.012 AUROC.
Across four target–nuisance settings on Qwen2.5-7B and Gemma-2-9B, probes with statistically equivalent AUROC differ up to several-fold in counterfactual nuisance sensitivity in three of four settings. Decodability rank-correlates with nuisance sensitivity with a sign that changes across settings—making it an unreliable proxy. The effect follows the probe's training data, not the natural association: uncorrelated first-person framing is absorbed as much as negation. Selecting extractors by Conflict score (nuisance-aware development diagnostic) lowers CFN wherever the default is sensitive at ≤0.012 AUROC cost. Direct implication: safety probes validated only by accuracy metrics may be detecting a spurious correlate rather than the target concept.
Figure: A valid signature proves who published a pack but not that vectors match the text; an attacker within cosine tolerance can rank attacker documents first for 25% of targets. Verifying quantization codes instead of raw cosines closes the gap.
Offline RAG packs carry pre-computed embeddings alongside text; a valid signature proves provenance but not vector-text correspondence. On a FAISS PQ index over 57,638 documents, tampered vectors passing audit ranked the attacker's document first for 25% of targets. On a Raspberry Pi 5, the attack drops correct answers from 0.75 → 0.39. The fix verifies quantization codes (with a calibrated guard band and canonicalization) rather than raw cosines, accepting 100% of honest vectors across three platforms, while closing the attack surface.
Figure: METR's independent assessment found Anthropic's capability progress accelerated ~1.9–2× relative to Mar 2024–Oct 2025, with a majority likely attributable to AI being used in AI R&D itself.
METR conducted a high-access assessment at Anthropic (Aug–Oct 2026) and found that progress on well-specified tasks is running at approximately 1.9–2× the March 2024–October 2025 pace (range: 1.3×–3× not ruled out), with a majority of acceleration attributed to AI being used in AI R&D itself. METR notes the public version has a majority of its most informative evidence redacted by Anthropic, requiring readers to rely more on METR's judgment than it would prefer. This is the first independent quantitative assessment of AI-accelerated AI development—a key threshold in Anthropic's Responsible Scaling Policy.