# arXiv: SAVeR²: Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards [Canonical reading](https://escapemeridian.com/readings/arxiv-saver2-reasoning-based-safety-alignment-for-large-784ba4a4) The authors of SAVeR² argue that safety alignment for Large Reasoning Models (LRMs) can use the models’ own reasoning, rather than treating reasoning only as a source of risk or a cost to safety. Their method breaks safety objectives into four fine-grained verifiable reward signals, selects training data according to difficulty, and uses reasoning-preserving gradient projection to resolve conflicts between safety and reasoning gradients. The authors say this approach addresses weaknesses in existing alignment methods, including poor adversarial generalization and coarse-grained rewards that may not faithfully reflect safety. They say the reasoning-preserving gradient projection mechanism effectively eliminates the “safety tax” on reasoning. They report experiments on models ranging from 1.5B to 671B, with superior safety performance and lower over-refusal rates across multiple benchmarks, without compromising general reasoning capabilities. Escape Meridian interpretation: if borne out beyond those evaluations, the approach could help make reasoning models safer without making them more likely to refuse acceptable requests. The abstract does not establish how well these results transfer to other settings. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 5, 2026 (2026-11-05). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-08T18:07:50.523Z. First observed: 2026-11-06T05:10:20.674Z. Retrieved: 2026-11-08T17:54:57.146Z. - [SAVeR$^2$: Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards](https://arxiv.org/abs/2611.07482) ## Limits The evidence is the paper abstract, which reports experimental outcomes but does not give the benchmark names, evaluation details, or results by model. The abstract’s claims about improved safety, reduced over-refusal, and no compromise to general reasoning are the authors’ reported findings, not independently established here. ## Open question Which adversarial settings and benchmarks were used to evaluate SAVeR², and how well do its reported results hold beyond them? ## Source-stated The authors define LRM safety as requiring non-malicious reasoning and answers, safety consistency, and explicit intent identification. > We formalize LRM safety objectives as requiring non-malicious reasoning and answers, safety consistency, and explicit intent identification. - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated The authors say existing alignment methods have poor adversarial generalization, impose a “safety tax” on reasoning, and use unfaithful coarse-grained rewards. > existing alignment methods suffer from poor adversarial generalization, a significant \`\`safety tax'' on reasoning, and unfaithful coarse-grained rewards - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated SAVeR² uses four fine-grained verifiable reward signals, difficulty-aware data selection, and reasoning-preserving gradient projection to address conflicts between safety and reasoning gradients. > decomposes the safety objective into four fine-grained verifiable reward signals and utilizes a difficulty-aware data selection strategy to stabilize training. Crucially, we introduce a reasoning-preserving gradient projection mechanism - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated The authors report that experiments across models from 1.5B to 671B showed higher safety performance and lower over-refusal rates across multiple benchmarks, without compromising general reasoning capabilities. > Extensive experiments on models ranging from 1.5B to 671B demonstrate that SAVeR$^2$ achieves superior safety performance and significantly lower over-refusal rates across multiple benchmarks without compromising general reasoning capabilities. - [Supporting source](https://arxiv.org/abs/2611.07482) ## Escape Meridian interpretation If the reported results extend beyond the evaluated benchmarks, SAVeR² could help improve safety without increasing refusals of acceptable requests. > significantly lower over-refusal rates across multiple benchmarks without compromising general reasoning capabilities - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source and contributor context Sun, Yichen, Liu, Qirui, Wang, Yan, Lin, Jianan, Jiang, Linbo, Wang, Shiyu, Wang, Zhibo, Chu, Zhixuan · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Reasoning model A language model trained to work through a problem in written steps before it answers. - [Definition reference](https://en.wikipedia.org/wiki/Reasoning_model) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 8be04382-24da-4b53-81d0-f6fa61c4d411. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-08T18:07:50.523Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: a0c7dc1c5d793af03e5705bfbd20be813b53b04cd859ee74c46d887a78387ea7. Source text hash: 31658139ffc3e64fc590f4e3edd71ea9a65f02e2395d942d13720b439fce2f42. ## Revision and source-check history ### Version 1 — 2026-11-08T18:07:50.523Z The authors of SAVeR² argue that safety alignment for Large Reasoning Models (LRMs) can use the models’ own reasoning, rather than treating reasoning only as a source of risk or a cost to safety. Their method breaks safety objectives into four fine-grained verifiable reward signals, selects training data according to difficulty, and uses reasoning-preserving gradient projection to resolve conflicts between safety and reasoning gradients. The authors say this approach addresses weaknesses in existing alignment methods, including poor adversarial generalization and coarse-grained rewards that may not faithfully reflect safety. They say the reasoning-preserving gradient projection mechanism effectively eliminates the “safety tax” on reasoning. They report experiments on models ranging from 1.5B to 671B, with superior safety performance and lower over-refusal rates across multiple benchmarks, without compromising general reasoning capabilities. Escape Meridian interpretation: if borne out beyond those evaluations, the approach could help make reasoning models safer without making them more likely to refuse acceptable requests. The abstract does not establish how well these results transfer to other settings. ## Original source arXiv cs.AI · Article Original source date: Nov 5, 2026 (2026-11-05). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-08T18:07:50.523Z. First observed: 2026-11-06T05:10:20.674Z. Retrieved: 2026-11-08T17:54:57.146Z. - [SAVeR$^2$: Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards](https://arxiv.org/abs/2611.07482) ## Limits The evidence is the paper abstract, which reports experimental outcomes but does not give the benchmark names, evaluation details, or results by model. The abstract’s claims about improved safety, reduced over-refusal, and no compromise to general reasoning are the authors’ reported findings, not independently established here. ## Open question Which adversarial settings and benchmarks were used to evaluate SAVeR², and how well do its reported results hold beyond them? ## Source-stated The authors define LRM safety as requiring non-malicious reasoning and answers, safety consistency, and explicit intent identification. > We formalize LRM safety objectives as requiring non-malicious reasoning and answers, safety consistency, and explicit intent identification. - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated The authors say existing alignment methods have poor adversarial generalization, impose a “safety tax” on reasoning, and use unfaithful coarse-grained rewards. > existing alignment methods suffer from poor adversarial generalization, a significant \`\`safety tax'' on reasoning, and unfaithful coarse-grained rewards - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated SAVeR² uses four fine-grained verifiable reward signals, difficulty-aware data selection, and reasoning-preserving gradient projection to address conflicts between safety and reasoning gradients. > decomposes the safety objective into four fine-grained verifiable reward signals and utilizes a difficulty-aware data selection strategy to stabilize training. Crucially, we introduce a reasoning-preserving gradient projection mechanism - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source-stated The authors report that experiments across models from 1.5B to 671B showed higher safety performance and lower over-refusal rates across multiple benchmarks, without compromising general reasoning capabilities. > Extensive experiments on models ranging from 1.5B to 671B demonstrate that SAVeR$^2$ achieves superior safety performance and significantly lower over-refusal rates across multiple benchmarks without compromising general reasoning capabilities. - [Supporting source](https://arxiv.org/abs/2611.07482) ## Escape Meridian interpretation If the reported results extend beyond the evaluated benchmarks, SAVeR² could help improve safety without increasing refusals of acceptable requests. > significantly lower over-refusal rates across multiple benchmarks without compromising general reasoning capabilities - [Supporting source](https://arxiv.org/abs/2611.07482) ## Source and contributor context Sun, Yichen, Liu, Qirui, Wang, Yan, Lin, Jianan, Jiang, Linbo, Wang, Shiyu, Wang, Zhibo, Chu, Zhixuan · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Reasoning model A language model trained to work through a problem in written steps before it answers. - [Definition reference](https://en.wikipedia.org/wiki/Reasoning_model) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 8be04382-24da-4b53-81d0-f6fa61c4d411. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-08T18:07:50.523Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: a0c7dc1c5d793af03e5705bfbd20be813b53b04cd859ee74c46d887a78387ea7. Source text hash: 31658139ffc3e64fc590f4e3edd71ea9a65f02e2395d942d13720b439fce2f42. ### passed — 2026-11-08T18:07:50.523Z — anthropic/claude-opus-5.5 Publication: 8be04382-24da-4b53-81d0-f6fa61c4d411 attribution — pass: The reading attributes the method, the critique of existing alignment methods and the experimental results to the paper's authors on arXiv. Claims stay framed as what the authors argue, say or report. The Escape Meridian interpretation is labeled and kept separate from the authors' claims. > Authors:Yichen Sun, Qirui Liu, Yan Wang, Jianan Lin, Linbo Jiang, Shiyu Wang, Zhibo Wang, Zhixuan Chu summary — pass: The reading accurately covers the abstract's argument: existing methods neglect the model's own reasoning for safety, and SAVeR2 has three components. It also preserves the strong claim of 'effectively eliminating the safety tax'. A non-specialist can follow the core development: a training method meant to make reasoning models safer without hurting reasoning or increasing over-refusal. Technical terms are kept exactly. Optional tooltips for safety tax, verifiable reward, gradient projection and the parameter units in 1.5B to 671B would further aid readers, but their absence does not block understanding. > primarily due to their neglect of the LRM's intrinsic reasoning capabilities for safety date — pass: The originalPublished date, 2026-11-05, matches the arXiv v1 submission date shown in the source. This is the first submission, not a later revision. > \[Submitted on 5 Nov 2026\] support — pass: Each claim matches the abstract and is presented as source-stated. The interpretation is explicitly conditional and supported by the reported lower over-refusal rates. The limitations correctly note that benchmark names and per-model results are absent. The question follows from that gap without asserting a conclusion. > achieves superior safety performance and significantly lower over-refusal rates across multiple benchmarks without compromising general reasoning capabilities media — pass: The selected media is the verified arXiv abstract page for this paper. It is the direct original source and the most relevant link available. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/784ba4a468562824e3e961998478c0c2a692f1bd4cfec7723b759707d669b8e6/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-saver2-reasoning-based-safety-alignment-for-large-784ba4a4.json)