Elamur Research⌕
☰
home / papers / 2026 / More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters

More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters

Paper · 2026 · Guan Wang, Xuehai Tang, Biyu Zhou et al.

Summary

Explicit Safety-oriented Chain-of-Thought (SCoT) helps LLMs resist jailbreaks. However, the visible reasoning trace creates its own risks: it can leak harmful details before the model reaches a refusal, and it shows attackers how the model's safety logic works. The authors ask whether the protection of deliberative safety can be kept while the reasoning text is never produced. Their framework, HIAR (Hierarchical Internalization of Adversarially-Guided Reasoning), builds on two analyses. Causal tracing shows that SCoT's corrective effect acts mainly in the FFN layers. An SVD of the hidden-state shifts that SCoT induces shows these shifts are low-rank. HIAR therefore uses layer-wise LoRA adapters on the FFNs, so the model reaches a safe answer in one forward pass with no reasoning text. The adapters can be trained by fine-tuning or computed in closed form. Across several LLMs, HIAR cuts jailbreak Attack Success Rate (ASR) by 43% relative to strong baselines. This points to models that are safe by default without exposing how their safety decisions are made.

Key points

  • Where the correction happens: In causal tracing, the clean SCoT state was restored at either the post-attention or the post-FFN point.
    • Restoring the FFN output in middle-to-late layers brought ASR (judged by GPT-4) close to the level of the SCoT-guided run.
    • Restoring the post-attention state had a much weaker effect.
  • Low-rank structure: In the SCoT-induced state deviation matrix ∆H, the top-10 singular vectors explain over 96% of the variance. Random contextual perturbations instead give a flat, high-rank spectrum.
  • Closed-form initialization: Starting fine-tuning from the closed-form LoRA solution begins at a much lower loss. It reaches the convergence threshold about 4× faster than standard fine-tuning.
  • Rapid patching of new attacks: Two attack families were held out to simulate unseen threats: a multi-round attack (Russinovich et al., 2025) and artprompt. A closed-form patch applied after the first breach reduced ASR as follows:
    • multi-round attack: from over 80% to 12.5%;
    • artprompt: from 75% to 15.2%;
    • the extra compute cost was under 3%.
  • Scope and availability: Testing includes DeepSeek-R1, but the non-reasoning models are mostly below 13B parameters. The authors list composing many LoRA patches and catastrophic forgetting as open issues. Code and data are promised for release upon acceptance.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏛️Chinese Academy of SciencesBeijing · China194 works · 23,906 citations🎓University of Chinese Academy of SciencesBeijing · China147 works · 8,480 citations🔬Institute of Information EngineeringBeijing · China30 works · 1,411 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 3Research subjects and languages the work is about.Language models & pretraining · 3,320 worksReasoning · 1,426 worksBias, fairness & safety · 517 works

Cite

Cite as Guan Wang, Xuehai Tang, Biyu Zhou, Jizhong Han and Songlin Hu. 2026. More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1572

@inproceedings{wang2026more,
  title = {{More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters}},
  author = {Guan Wang, Xuehai Tang, Biyu Zhou, Jizhong Han and Songlin Hu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1572},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1572}
}

References

22 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, and 29 others. 2023. Qwen technical report. Preprint, arXiv:2309.16609.
  2. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, and 32 others. 20… — Constitutional AI: Harmlessness from AI Feedback
  3. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. ArXiv, abs/2310.08419.
  4. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. Preprint, arXiv:2110.14168.
  5. DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Jun-Mei Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiaoling Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, and 179 others. 2025. Deepseek-r1: Incentivizing reasoning capability i…
  6. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  7. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR).
  8. Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. Safechain: Safety of language models with long chain-of-thought reasoning capabilities. Preprint, arXiv:2502.12025. find
  9. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. Artprompt: Ascii art-based jailbreak attacks against aligned llms. In Annual Meeting of the Association for Computational Linguistics.
  10. Xuechen Li, Ganda Jerfel, Smith Mirchandani, Banghua Wang, Yichong Li, Hitu Tang, Tianle Yu, Yan Zhou, Feodor Kirstein, S. Chaudhary, and 1 others. 2023. Alpacaeval: An automatic evaluator of instruction-following models. GitHub repository. find
  11. Quan Liu, Zhenhong Zhou, Longzhu He, Yi Liu, Wei Yichi Zhang, Siyuan Zhang, Yao Huang, Zeyu Xia, Zheng-Zhang, and Sen Su. 2024. Alignment-enhanced de-wei Fang, Xiao Yang, Ranjie Duan, Dong Yan, Yin-coding: Defending jailbreaks via token-level adaptive peng Dong, and Jun Zhu. 2025. Stair: Improving r… — [arXiv:2502.02384](https://arxiv.org/abs/2502.02384) find
  12. Guanghao Zhou, Panjia Qiu, Cen Chen, Hongyu Li, Jason Chu, Xin Zhang, and Jun Zhou. 2025. LSSF: Safety Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei alignment for large language models through low-rank Xiao. 2023. Autodan: Generating stealthy jailbreak safety subspace fusion. In Proceedings of the 6…
  13. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, OpenAI. 2023. Gpt-4 technical report.
  14. Preprint, J. Zico Kolter, and Matt Fredrikson. 2023. Universal arXiv:2303.08774. and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, A Experiment Setup Sandhini…
  15. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024. Safety alignment should be made more than just a few tokens deep. Preprint, arXiv:2406.05946. find
  16. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2025. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. Preprint, arXiv:2404.01833. find
  17. Llama Team. 2024. Meta llama guard 2. https://github.com/meta-llama/PurpleLlama/blob/ main/Llama-Guard2/MODEL_CARD.md. ↗
  18. NovaSky Team. 2025a. Sky-t1: Fully open-source reasoning model with o1-preview performance in 450budget. https : //novasky − ai.github.io/posts/sky − t1. Accessed : 2025 − 01 − 09. find
  19. Qwen Team. 2025b. Qwq-32b: Embracing the power of reinforcement learning. find
  20. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Ed Chi, Quoc Le, and Denny Zhou. 2022. Chain-of-thought prompting elicits reasoning in large language models. arXiv preprint arXiv:2201.11903.
  21. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. Preprint, arXiv:2402.08983.
  22. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. Preprint, arXiv:2401.06373.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/wang-2026-more-thinking-less-talking-internalizing/