SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignment

TL;DR

SAFEPATH is a lightweight method that improves safety in large reasoning models by adding a short safety primer, effectively reducing harmful outputs and jailbreak success without compromising reasoning capabilities.

Contribution

Introduces SAFEPATH, a novel fine-tuning approach that inserts an 8-token safety primer to enhance safety in reasoning models with minimal performance trade-offs.

Findings

Reduces harmful responses by up to 90%

Blocks 83.3% of jailbreak attempts

Requires significantly less compute than existing methods

Abstract

Large Reasoning Models (LRMs) have become powerful tools for complex problem solving, but their structured reasoning pathways can lead to unsafe outputs when exposed to harmful prompts. Existing safety alignment methods reduce harmful outputs but can degrade reasoning depth, leading to significant trade-offs in complex, multi-step tasks, and remain vulnerable to sophisticated jailbreak attacks. To address this, we introduce SAFEPATH, a lightweight alignment method that fine-tunes LRMs to emit a short, 8-token Safety Primer at the start of their reasoning, in response to harmful prompts, while leaving the rest of the reasoning process unsupervised. Empirical results across multiple benchmarks indicate that SAFEPATH effectively reduces harmful outputs while maintaining reasoning performance. Specifically, SAFEPATH reduces harmful responses by up to 90.0% and blocks 83.3% of jailbreak attempts in the DeepSeek-R1-Distill-Llama-8B model, while requiring 295.9x less compute than Direct Refusal and 314.1x less than SafeChain. We further introduce a zero-shot variant that requires no fine-tuning. In addition, we provide a comprehensive analysis of how existing methods in LLMs generalize, or fail, when applied to reasoning-centric models, revealing critical gaps and new directions for safer AI.