Safe Transformer: An Explicit Safety Bit For Interpretable And Controllable Alignment

TL;DR

Safe Transformer introduces an explicit safety bit within language models, enabling interpretability and controllability of safety judgments, significantly reducing attack success rates in safety benchmarks.

Contribution

It proposes a modular safety mechanism with an explicit safety bit, allowing transparent safety decisions and manual control without retraining the entire model.

Findings

Achieves near-zero attack success rate in safety benchmarks.

Outperforms baseline models and safety fine-tuning methods.

Maintains generation capabilities while providing interpretability.

Abstract

Current safety alignment methods encode safe behavior implicitly within model parameters, creating a fundamental opacity: we cannot easily inspect why a model refuses a request, nor intervene when its safety judgments fail. We propose Safe Transformer, a modular approach that augments pre-trained language models by inserting a discrete information bottleneck containing an explicit safety bit between transformer layers. The safety bit serves as both an interpretable signal of the model's safety classification and a controllable switch: through contrastive training, the model learns disentangled representations where the safety bit governs the behavioral mode - producing helpful responses when $s=1$ and refusals when $s=0$ - while additional unsupervised bits $u$ encode semantic content for generation. Additional unsupervised bits in the information bottleneck allow semantic information to flow through, preserving the model's generation capabilities. This design achieves both interpretability (the safety decision is directly readable) and controllability (the safety bit can be manually overridden), requiring only lightweight fine-tuning without pre-training from scratch. In red-team benchmarks, Safe Transformer achieves near-zero Attack Success Rate, substantially outperforming base models and safety fine-tuning baselines.