Large reasoning models (LRMs) are strong multi-step problem solvers, yet their long reasoning traces may gradually drift into unsafe compliance when exposed to harmful or adversarial prompts. Existing safety alignment methods can reduce harmful outputs; however, they often rely on broad refusal or supervision over full safe reasoning traces, which may weaken the reasoning behavior that makes LRMs useful. We introduce Intent–Risk–Decision (IRD), a lightweight prefix-tuning method that steers only the beginning of the reasoning trace: the model first emits a prompt-intent tag, a risk statement, and a compliance decision, and then continues under its original reasoning policy. Across three LRMs and evaluations covering harmfulness, jailbreak robustness, over-refusal, and reasoning ability, IRD substantially reduces unsafe outputs while preserving reasoning performance. In particular, IRD lowers average harmfulness to 1.2–7.4% across the evaluated backbones and keeps near-lossless reasoning performance, %within 0.2 average points of the base models, showing that targeted early steering can improve safety without supervising complete safe traces or full model fine-tuning. Code and data are available at https://github.com/ReXT9527/IRD.

Recent advances in large reasoning models (LRMs) have made machine unlearning more challenging, as protected facts or unsafe rationales may surface in intermediate chain-of-thought (CoT) traces before the final answer is produced. Existing unlearning objectives typically suppress the target content or redirect internal representations, but they never specify how the post-forgetting trajectory should continue, which can lead to hallucinated substitutes, malformed boundaries, or repetitive outputs. We argue that LRM unlearning should instead learn a natural forgetting trajectory: a coherent non-disclosing CoT followed by a stable refusal-style answer that replace the original disclosure. To this end, we propose Guided Answer-Reasoning Distillation (GUARD), which converts model-generated unsafe disclosures into safe-exit trajectories, aligns a frozen LRM via guidance tokens, and distills the guided behavior into model parameters.To address the lack of metrics for replacement quality beyond leakage, we further introduce Natural Forgetting Reasoning Score (NFRS), which captures structural stability, fluency, and unsupported substitutes in forgotten outputs. Extensive experiments on R-TOFU and a STAR-1-derived harmful-intent setting show that GUARD substantially reduces unsafe and privacy disclosures across two widely adopted distilled LRMs while preserving reasoning utility. Codes are available at https://github.com/zeyu-Yan/GUARD

Jailbreaks against multimodal large language models (MLLMs) typically operate through image-text inputs. After each target response, the attacker must decide how the new feedback should shape the next image-text query: which clues should be stated in the text, which should appear as visual evidence, and how the text should refer to the image.Existing multimodal attacks typically rely on fixed image-text pairs or candidate search, limiting their ability to adapt across turns.Text-only multi-turn attacks can adapt to prior responses, but they do not decide how response-derived clues should be expressed across image and text.In this paper, we formulate this missing step as trace-to-query realization and propose  ̲Memory- ̲Augmented  ̲Visual  ̲Querying (MAViQ), a black-box framework that converts response-derived clues into visual and textual constraints, refines the query after observing the generated image, and propagates feedback to subsequent turns.Extensive experiments on two benchmarks across six target MLLMs show that MAViQ achieves average attack success rates (ASRs) of 70.60% on MM-SafetyBench and 82.13% on JailbreakV-mini, outperforming the strongest baseline by 5.90% and 8.32%, respectively. Our code is available at https://github.com/jixingtian/Maviq.

The safety mechanisms of large language models (LLMs) exhibit notable fragility, as even fine-tuning on datasets without harmful content may still undermine their safety capabilities. Meanwhile, existing safety alignment methods predominantly rely on the fine-tuning process, which inadvertently leads to the increased complexity and computational resources required. To address these issues, we introduce LSSF, a novel safety re-alignment framework with Low-Rank Safety Subspace Fusison. Our proposed method exploits the low-rank characteristics of safety information in LLMs by constructing a low-rank projection matrix to extract the principal components of safety vectors. Notably, this projection matrix represents the low-rank safety subspace of the LLMs, which we have observed to remain stable during fine-tuning process and is isolated from the model’s general capabilities. These principal components are used to effectively restore safety alignment when combined with fine-tuned LLMs through linear arithmetic. Additionally, to account for the varying encoding densities of safety information across different layers of LLMs, we propose a novel metric called safety singular value entropy. This metric quantifies the encoding density and allows for the dynamic computation of the safety-critical rank for each safety vector. Extensive experiments demonstrate that our proposed post-hoc alignment method can effectively restore the safety alignment of fine-tuned models with minimal impact on their performance on downstream tasks.