SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignment

arXiv:2606.02530 · cs.AI, cs.CL · Submitted 2026-08-21 · Read on arXiv

Hao Li, Jingkun An, Zijun Song, Pengyu Zhu, Rui Li, Hao Wang, Wendi Feng, Yesheng Liu, Lijun Li, Jin-Ge Yao, Lei Sha

cs.AI, cs.CL

Submitted: 2026-08-21

Updated: 2026-08-24

Comments: 19 pages, 8 figures, 14 tables. EMNLP 2026 Main Conference

Code: https://github.com/tatsu-lab/alpaca_eval

Project page: https://anjingkun.github.io/SafeSteer

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Alignment — 41× in this paper
• Benchmark — 29× in this paper · explained in 2 episodes
• Steering — 22× in this paper · explained in 2 episodes
• Distillation — 20× in this paper · explained in 2 episodes
• On-Policy Distillation — 10× in this paper · explained in 3 episodes
• Alignment Tax — 9× in this paper · explained in 4 episodes
• Ablation — 8× in this paper · explained in 1 episode
• Activation Steering — 7× in this paper · explained in 5 episodes
• Accuracy — 4× in this paper · explained in 1 episode
• LLM-as-a-Judge — 4× in this paper · explained in 3 episodes
• Adam — 3× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 3× in this paper · explained in 8 episodes
• Self-Distillation — 3× in this paper · explained in 7 episodes
• Transformer — 3× in this paper · explained in 2 episodes
• Aggregation — 2× in this paper
• Alignment Methods — 2× in this paper
• Attack Success Rate — 2× in this paper
• Core — 2× in this paper · explained in 2 episodes
• In-Context Learning — 2× in this paper · explained in 7 episodes
• Representation Engineering — 2× in this paper · explained in 2 episodes
• Robustness — 2× in this paper · explained in 6 episodes
• Ablation Studies — 1× in this paper · explained in 1 episode
• Adaptation — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper
• Attack Success Rate (ASR) — 1× in this paper · explained in 3 episodes
• Catastrophic Forgetting — 1× in this paper · explained in 9 episodes
• Continual Learning — 1× in this paper · explained in 3 episodes
• Diffusion Model — 1× in this paper · explained in 10 episodes
• Diffusion Models — 1× in this paper · explained in 9 episodes
• Distribution Shift — 1× in this paper · explained in 10 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• GRPO — 1× in this paper · explained in 6 episodes
• Knowledge Distillation — 1× in this paper · explained in 15 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Principal Component Analysis — 1× in this paper
• Principal Component Analysis (PCA) — 1× in this paper · explained in 6 episodes
• Prompt Engineering — 1× in this paper · explained in 5 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Verifier — 1× in this paper · explained in 2 episodes
• Vision-Language Models (VLMs) — 1× in this paper · explained in 6 episodes

Sources

• Evaluating Large Language Models Trained on Code
• Training Verifiers to Solve Math Word Problems
• Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment
• Measuring Massive Multitask Language Understanding
• Safety Tax: Safety Alignment Makes Your Large Reasoning Models Less Reasonable
• Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimization
• Rethinking On-Policy Distillation of Large Language Models: Phenomenology, Mechanism, and Recipe
• Let's Verify Step by Step
• DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models
• The Llama 3 Herd of Models
• X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• Qwen2.5 Technical Report
• LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shifts
• Self-Distillation Enables Continual Learning
• A Survey of On-Policy Distillation for Large Language Models
• ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teaming
• SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal
• Qwen3 Technical Report
• GLM-5: from Vibe Coding to Agentic Engineering

Related papers

• MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
• Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
• Agents' Last Exam
• The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
• MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
• Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems