<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="lu-etal-2026-geometry">
    <titleInfo>
        <title>The Geometry of Safety Drifts: Step-level Refusal-Subspace Monitoring for Reasoning Large Language Models</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Liming</namePart>
        <namePart type="family">Lu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Anan</namePart>
        <namePart type="family">Du</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Fanzhen</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hechang</namePart>
        <namePart type="family">Chen</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Shuchao</namePart>
        <namePart type="family">Pang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Reasoning large language models that produce explicit chains of thought are a new jailbreak surface: an adversary who shapes intermediate reasoning can hijack safety deliberation and elicit harmful answers the same model would refuse in a single forward pass. Defenses inherited from chat-style alignment monitor only the final response and intervene after the model has already committed to an unsafe trajectory. We argue that defending reasoning models requires looking inside the thinking phase itself, and we show that the refusal direction, previously characterized as a single linear direction in chat models, in fact evolves along the reasoning trajectory: sharp at onset, slowly drifting during long deliberation, and on hijacked traces collapsing at an identifiable step well before any harmful token is emitted. We propose RsMon, a step-level refusal-subspace monitor that tracks the projection of intermediate hidden states onto a calibrated refusal subspace and triggers a minimally invasive geometric intervention once drift exceeds a learned threshold. The monitor is purely inference-time, requires no retraining, and is compatible with any open-weight reasoning model. On three open reasoning models, five attack families, and four utility benchmarks, RsMon cuts mean attack success from 80.1% to 19.2%, a 4.2\times reduction, while keeping MATH-500, GPQA-Diamond, and HumanEval pass@1 within 0.7 absolute points of the undefended baseline. The same monitor produces a step-resolved diagnostic that pinpoints when and in which layer safety deliberation breaks down. Our code is available at https://github.com/llmnjust-afk/RsMon.</abstract>
    <identifier type="citekey">lu-etal-2026-geometry</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1162/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>26597</start>
            <end>26612</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T The Geometry of Safety Drifts: Step-level Refusal-Subspace Monitoring for Reasoning Large Language Models
%A Lu, Liming
%A Du, Anan
%A Liu, Fanzhen
%A Chen, Hechang
%A Pang, Shuchao
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F lu-etal-2026-geometry
%X Reasoning large language models that produce explicit chains of thought are a new jailbreak surface: an adversary who shapes intermediate reasoning can hijack safety deliberation and elicit harmful answers the same model would refuse in a single forward pass. Defenses inherited from chat-style alignment monitor only the final response and intervene after the model has already committed to an unsafe trajectory. We argue that defending reasoning models requires looking inside the thinking phase itself, and we show that the refusal direction, previously characterized as a single linear direction in chat models, in fact evolves along the reasoning trajectory: sharp at onset, slowly drifting during long deliberation, and on hijacked traces collapsing at an identifiable step well before any harmful token is emitted. We propose RsMon, a step-level refusal-subspace monitor that tracks the projection of intermediate hidden states onto a calibrated refusal subspace and triggers a minimally invasive geometric intervention once drift exceeds a learned threshold. The monitor is purely inference-time, requires no retraining, and is compatible with any open-weight reasoning model. On three open reasoning models, five attack families, and four utility benchmarks, RsMon cuts mean attack success from 80.1% to 19.2%, a 4.2\times reduction, while keeping MATH-500, GPQA-Diamond, and HumanEval pass@1 within 0.7 absolute points of the undefended baseline. The same monitor produces a step-resolved diagnostic that pinpoints when and in which layer safety deliberation breaks down. Our code is available at https://github.com/llmnjust-afk/RsMon.
%U https://aclanthology.org/2026.emnlp-main.1162/
%P 26597-26612

Markdown (Informal)

[The Geometry of Safety Drifts: Step-level Refusal-Subspace Monitoring for Reasoning Large Language Models](https://aclanthology.org/2026.emnlp-main.1162/) (Lu et al., EMNLP 2026)

• The Geometry of Safety Drifts: Step-level Refusal-Subspace Monitoring for Reasoning Large Language Models (Lu et al., EMNLP 2026)

ACL

• Liming Lu, Anan Du, Fanzhen Liu, Hechang Chen, and Shuchao Pang. 2026. The Geometry of Safety Drifts: Step-level Refusal-Subspace Monitoring for Reasoning Large Language Models. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 26597–26612, Budapest, Hungary. Association for Computational Linguistics.