AI models can generate and apply their own safety rules to resist manipulation attempts

A research team has demonstrated that large language models can create and internalize their own task-specific safety guidelines to better defend against jailbreak attempts, using a technique called Self-Guided Adaptive Safety Alignment (SGASA).

The Problem: Safety Rules That Fall Behind#

Static safety policies often struggle to keep pace with evolving jailbreak strategies designed to trick models into generating harmful content. Researchers explored whether models could instead develop adaptive guidelines by learning from concrete examples of both harmful and harmless prompts.

How the Approach Works#

The SGASA method operates through three main steps:

• Guideline generation: The model synthesizes a task-specific safety rule from a small set of examples
• Self-refinement: It improves the guideline by identifying where it previously made mistakes
• Self-evaluation: The model selects the best version of the guideline through its own assessment

The resulting guidelines can be deployed in two ways: applied directly during inference alongside user queries, or distilled (absorbed) into the model's weights so future responses follow the safety rules without needing to state them explicitly.

Results Across Model Sizes#

Testing on Qwen3 models at three different scales (8B, 14B, and larger), the researchers measured performance against two adversarial prompt datasets. In-context guidelines (applied at inference time) improved the combined score for safety and non-over-refusal by 20.0–45.5 points on the smaller models.

The self-evaluation mechanism successfully identified the best refinement round in five out of six test configurations. Notably, guideline generation and guideline utilization showed distinct scaling patterns, suggesting the underlying capabilities follow different improvement curves across model sizes.

Durability After Training#

When guidelines were distilled into models using only one jailbreak dataset (WildJailbreak), the internalized versions retained 13.3–14.1 point gains on that same dataset even without an external guideline at inference time. This indicates the learned safety behavior persists after the guidelines are baked in.