Read the Scene, Not the Script: Outcome-Aware Safety for LLMs

2025-10-05

AI Summary

This work addresses the pervasive “consequence blindness” in safety-aligned large language models—where models over-rely on superficial cues (e.g., sensitive keywords), leading to vulnerability to jailbreaking or excessive rejection of harmless inputs. We introduce the novel concept of “consequence blind spots” and establish CB-Bench, the first benchmark explicitly designed to evaluate misalignment between semantic risk and actual outcome risk. We further release CS-Chain-4k, a dataset comprising fine-grained behavior–consequence reasoning examples. Supervised fine-tuning on CS-Chain-4k significantly improves model robustness against semantically obfuscated jailbreaking (+23.6% defense success rate) and reduces over-rejection of benign inputs (↓38.1% refusal rate), while preserving general capabilities and demonstrating strong cross-benchmark generalization.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Adversarial Learning & Robustness
• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness

Application Category

• Security and Privacy: Large-scale security measurements
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Safety-aligned Large Language Models (LLMs) still show two dominant failure modes: they are easily jailbroken, or they over-refuse harmless inputs that contain sensitive surface signals. We trace both to a common cause: current models reason weakly about links between actions and outcomes and over-rely on surface-form signals, lexical or stylistic cues that do not encode consequences. We define this failure mode as Consequence-blindness. To study consequence-blindness, we build a benchmark named CB-Bench covering four risk scenarios that vary whether semantic risk aligns with outcome risk, enabling evaluation under both matched and mismatched conditions which are often ignored by existing safety benchmarks. Mainstream models consistently fail to separate these risks and exhibit consequence-blindness, indicating that consequence-blindness is widespread and systematic. To mitigate consequence-blindness, we introduce CS-Chain-4k, a consequence-reasoning dataset for safety alignment. Models fine-tuned on CS-Chain-4k show clear gains against semantic-camouflage jailbreaks and reduce over-refusal on harmless inputs, while maintaining utility and generalization on other benchmarks. These results clarify the limits of current alignment, establish consequence-aware reasoning as a core alignment goal and provide a more practical and reproducible evaluation path.

Problem

• LLMs fail to link actions with outcomes
• Models over-rely on surface signals ignoring consequences
• Current safety alignment lacks consequence-aware reasoning

Innovation

• Consequence-reasoning dataset addresses safety alignment
• Fine-tuning improves jailbreak resistance and reduces over-refusal
• Benchmark evaluates semantic versus outcome risk separation