SafeCompass: Dynamic Chain-of-Thought Steering via Inference-Time Safety Signals

Large reasoning models (LRMs) achieve strong performance by explicitly generating chain-of-thought (CoT) reasoning, but this reasoning process can be manipulated by adversarial prompts. Inference-time CoT interventions offer a simple and lightweight approach to improving safety, yet existing methods typically apply static heuristics that ignore the dynamic nature of reasoning, leading to an inherent trade-off between robustness and over-refusal. This paper introduces *SafeCompass*, a plug-and-play framework for dynamically steering chain-of-thought reasoning using inference-time safety signals extracted from internal states. At different reasoning positions, *SafeCompass* derives a latent safety direction through contrastive analysis of internal representations and uses this direction to quantify the model’s current safety state. These signals enable selective intervention, allowing the model’s reasoning trajectory to be modified only when and where it becomes unsafe. Extensive experiments demonstrate that *SafeCompass* significantly improves robustness, reducing the average attack success rate up to $10\times$ compared to the best baseline, while preserving general reasoning performance and minimizing over-refusal rates.

Powerful AI models solve complex problems by "thinking step-by-step", but attackers can hijack this reasoning process to bypass safety rules. Current defense methods are often too rigid, making the AI overly cautious and prone to refusing perfectly safe requests. We wanted to secure this reasoning process without losing the model's helpfulness. To tackle this, we developed SafeCompass, a framework that monitors the AI's internal states in real-time while it generates an answer. By analyzing these internal signals, SafeCompass detects exactly when the AI's thoughts start turning dangerous. Instead of completely shutting down the response, it steps in to steer the reasoning back on track only at that specific moment. We found that this targeted approach reduces successful attacks by up to 10 times. Ultimately, SafeCompass provides a practical way to build highly robust AI systems that remain capable and helpful for everyday users.