{"id":"509844b7-e8a1-459c-8353-22fd035dc7d5","arxiv_id":"2505.19690","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A new benchmark shows that top reasoning models identify all relevant risks in under 40% of cases even when their final answers look safe.","lead":"This paper introduces a benchmark called Beyond Safe Answers that tests whether AI reasoning models actually understand risks or just produce safe-looking answers. It finds that even top models correctly identify the risks in only about 38% of cases, and common fixes like safety rules and fine-tuning only partially help.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Think@1 results rest on a single-model-validated judge; without per-model validation, the headline SSA gap is not yet established.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern: the LLM-as-a-judge is validated on only one model, so Think@1 numbers across all 19 models are not yet trustworthy. I agree strongly. My stress-test pass adds three specific technical points. First, the judge was validated on 2,000 QTR pairs from one model; reasoning trace distributions differ substantially across architectures and training families (e.g., DeepSeek-R1 vs Qwen3 vs closed-source models), so a judge optimized on one distribution can have uncontrolled per-model error. Second, the human ground truth itself was collected only on that same model's traces; this is adequate for that model but not for others, and no sampling-based re-annotation of the actual evaluation data is reported. Third, the difficulty filter (Section 3.3) used five screening models and kept only items where at least three exhibited SSA; this selection loop means the benchmark is enriched for SSA behaviors as perceived by those models, which is fine for benchmark construction but amplifies the impact of any judge bias because the dataset is deliberately adversarial along the very dimension the judge measures. The paper also tunes α=0.76 on the evaluation data (Section 4.1), a minor selection issue, but the F-score is not the central claim; the gap between Safe@1 (>90%) and Think@1 (<40%) is the central claim. The qualitative phenomenon of SSA is plausible and well-motivated by prior work (SafeChain, deliberative alignment), but the paper's strongest evidence is numerical and would be decisive only with per-model judge validation. A concrete test exists and is cheap relative to the original annotation effort: re-annotate ~100 traces per model and compute per-model judge agreement. Given these points, the correct verdict remains CONDITIONAL: the benchmark and qualitative contribution are real, but the headline numbers need verification before the strong claim of universal SSA is accepted. I would not move to REJECT because the concern is a measurement gap, not an identified fatal flaw; the data and code are released, so the test is actually runnable. I also note the paper is honest about limitations (Appendix A lists generalizability and single-turn scope), and it does not claim formal verification or parameter-free derivations; the evidence is empirical and reproducible, which supports a fair conditional pass rather than rejection.","tokens_in":20058,"tokens_out":2337,"duration_ms":20881,"concrete_test":"Re-annotate a stratified random sample of reasoning traces from each of the 19 evaluated models (e.g., 100 traces per model, 1,900 total) using the same 5-expert majority-vote protocol, and compare against GPT-4o-1120's judgments per model. Report per-model judge accuracy, F1, and FPR. If per-model F1 stays ≥85% and the aggregate Think@1 for each model shifts by less than 3 percentage points after correcting for measured judge bias, the SSA gap survives. If per-model F1 drops below 70% for any model family or Think@1 shifts materially, the headline '<40% Think@1' claim must be re-derived with judge-bias correction or a different evaluator.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim—that LRMs exhibit Superficial Safety Alignment with Safe@1 >90% but Think@1 <40%—depends entirely on the LLM-as-a-judge labels for \"thinking correctness\" (Section 4.2). The judge (GPT-4o-1120) was validated on 2,000 QTR pairs generated by \"a specific model\" (Section 4.2), not by the 19 evaluated LRMs, and no per-model judge accuracy is reported. Reasoning traces vary substantially across model families (DeepSeek-R1, Qwen3, Kimi, Doubao, GLM), and a judge calibrated on one distribution can systematically under- or over-credit risk identification on another distribution, with no stated tolerance. The human ground truth for those 2,000 pairs also came from 5 experts via majority voting on a single model's outputs; this validates the judge on that model but not on the others. Since Think@1 is the metric that exposes the claimed SSA gap, a systematic judge bias—e.g., penalizing concise reasoning that omits explicit restatement of every risk in the risk_summary while still evidencing risk awareness—would directly lower Think@1 across models and manufacture the gap. The absence of a per-model judge accuracy table or a human re-annotation sample for each model leaves this unresolved. This is a correctness risk, not an internal inconsistency; the paper's own Table 1 shows the judge is imperfect (4.99% FPR, 89.89% F1), so the error is plausibly large. The selection loop (only samples flagged by ≥3 of 5 difficulty-screening models are retained, Section 3.3) compounds this: the benchmark is biased toward items on which those screening models show SSA, so any judge bias interacting with model-specific reasoning styles could inflate the SSA finding. These are fixable measurement concerns, but they are load-bearing because the headline numerical claim rests on them.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces the Beyond Safe Answers (BSA) benchmark, a dataset of 2,000 curated instances across three proposed Superficial Safety Alignment (SSA) scenario types and nine risk categories, each annotated with human-written risk summaries. The authors evaluate 19 large reasoning models (LRMs) on response safety (Safe@1, Safe@k) and reasoning correctness (Think@1, Think@k), reporting that all models achieve high Safe@1 (often above 90%) but low Think@1 (best below 40%), which they interpret as evidence of SSA: models produce safe-sounding final outputs while their internal reasoning frequently fails to identify or correctly characterize underlying risks. The paper also studies the impact of safety-rule prompting, fine-tuning on STAR-1 reasoning data, and decoding parameters, concluding that rule-based prompting and fine-tuning improve risk identification to some degree while decoding parameters have little effect.","tokens_in":20531,"tokens_out":4254,"duration_ms":47177,"significance":"If the reported gap between response safety and reasoning-level risk identification is real, BSA would be a valuable diagnostic resource for studying safety reasoning fidelity in LRMs, and the proposed SSA taxonomy (over-sensitivity, cognitive shortcut, risk omission) could inform future alignment efforts. The paper has concrete strengths: a large, human-annotated dataset spanning multiple risk categories; explicit evaluation prompts and detailed appendices; reproducibility-oriented assets (code, data, licenses); and initial experiments on three mitigation strategies. However, the headline claim that all 19 evaluated models exhibit SSA rests on two load-bearing methodological choices—an LLM judge validated on only a single model's traces and a dataset filtered using five of the same models that are later reported as evidence—so the significance is conditional on those choices being defended or the analysis being restructured.","major_comments":[{"comment":"The judge (GPT-4o-1120) is validated on 2,000 Query-Thinking-Response pairs generated by 'a specific model,' which is never named, and no per-model judge accuracy is reported. Reasoning traces differ substantially across model families (DeepSeek-R1, Qwen3, Kimi, Doubao, GLM) in length, style, vocabulary, and how explicitly they restate risks. A judge calibrated on one distribution can systematically under- or over-credit risk identification on another, and Table 1 shows the judge itself has a 4.99% false positive rate and 89.89% F1, so the potential error is not negligible. Since Think@1 is the metric that exposes the claimed SSA gap, please provide per-model judge validation on human-annotated samples (even a few hundred per model family) or at minimum a bounded sensitivity analysis showing the reported Think@1 values are robust to plausible judge miscalibration.","section":"Section 4.2"},{"comment":"The dataset is constructed by retaining only items on which at least 3 of 5 screening models (QwQ-32B, Deepseek-R1, GLM-Z1-AirX, Doubao-1.5-thinking-pro, Kimi-K1.5) exhibit SSA. Table 2 then reports these same five models as part of the 'all 19 LRMs' evidence of SSA, with low Think@1 values. For those five models, low Think@1 is partly by construction: the benchmark was explicitly filtered to contain items that these models get wrong. Please separate the five screening models from the other fourteen in the headline analysis, or re-derive the 'all evaluated LRMs exhibit pronounced SSA' claim from the non-screening models only, and state how the ranking and the <40% Think@1 claim change when the screening models are excluded.","section":"Section 3.3"},{"comment":"The metric definitions are ambiguous and inconsistent with their usage. Eq. (1) defines Safe@1 and Think@1 as averages over the k samples taken per query, which contradicts the usual 'top-1' interpretation and is not clearly distinguished from a simple per-query average. Eq. (2) defines Safe@k and Think@k as binary indicators for a single query, yet Table 2 reports these as percentages (e.g., 92.97% for Safe@k), implying an aggregation over queries that is not defined. Please state the aggregation explicitly, clarify what k denotes in each equation, and confirm whether the reported numbers are averages over the 2,000 benchmark items. In addition, the F-score in Section 4.1 relies on α=0.76 selected post hoc to maximize Spearman correlation with the two constituent rankings; please justify this selection or show that the reported conclusions are insensitive to α over a reasonable range.","section":"Section 4.1, Eqs. (1)-(2)"},{"comment":"The central claim that 'all evaluated LRMs exhibited pronounced SSA' is presented without statistical uncertainty or error propagation from the judge. With k=5 samplings per query and 2,000 queries, the standard errors on the reported percentages are small, but the judge's misclassification rates (Table 1) are not accounted for. Please report how judge false positives and false negatives propagate into the reported Think@1 values, for example by recomputing the metrics under conservative bounds that treat uncertain cases as errors, so the reader can judge whether the SSA gap could plausibly be an artifact of the evaluation pipeline rather than a property of the models.","section":"Section 5.2 / Table 2"}],"minor_comments":[{"comment":"The example SSA instance in the text contains placeholder/junk tokens ('xxxx') and appears truncated; please replace it with a clean, complete example or refer directly to the figure.","section":"Section 1, Figure 1"},{"comment":"The phrase 'confusing matrices' should be 'confusion matrices'; also, the identity of the 'specific model' used to generate the 2,000 QTR pairs for judge validation should be disclosed, as it is relevant to the generalizability of the validation.","section":"Section 4.2"},{"comment":"Typo: 'inffluence' should be 'influence'.","section":"Figure 3 caption"},{"comment":"Typo: 'Offical API Setup' should be 'Official API Setup'; the row for Kimi-K1.5 says 'No public reference' for sampling parameters, which is acceptable but should be clarified as using the provider's defaults.","section":"Section F.2, Table 3"},{"comment":"The text claims 'statistically significant improvements' from safety-rule integration, but no statistical test, p-value, or confidence interval is reported; please add the relevant tests or soften the claim to a descriptive one.","section":"Section 5.4"},{"comment":"The abstract says the benchmark comprises 2,000 instances while Section 3.2 says 'over 2000 curated samples'; please make the count consistent throughout.","section":"Section 3.2 / Abstract"}],"recommendation":"major_revision","confidential_remarks":"The two load-bearing issues—single-model judge validation and the selection loop involving the same five models—are fixable in a revision, but they currently prevent the headline SSA claim from being taken at face value. I would encourage the editor to ask for a restructured analysis that separates screening models from held-out models, and for per-model judge validation or a credible sensitivity analysis. The paper is otherwise within scope for the journal and the dataset may be useful, but the evidence needs to match the strength of the 'all 19 models' claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: BSA is a real contribution and the SSA phenomenon is probably real, but the exact numbers in the headline gap are not yet trustworthy because the judge was validated on only one model. Worth reading, worth refining, not worth taking as measured fact yet.\n\nWhat's new: the three scenario types (over sensitivity, cognitive shortcut, risk omission) and the 2,000-item benchmark built around them. SafeChain and fake alignment work already showed that reasoning traces can be less safe than final outputs; this paper turns that observation into a reusable evaluation tool, with careful human annotation, difficulty filtering, and a nine-category risk taxonomy. That is a useful step. The mitigation experiments (rules, fine-tuning on STAR-1, decoding parameters) are a reasonable first pass, and the finding that rules help with risk omission but increase over sensitivity is a genuinely useful trade-off result.\n\nThe soft spots are measurement-side, not conceptual. The biggest one: the LLM judge (GPT-4o-1120) was validated on 2,000 QTR pairs from a single, unnamed model, then applied to all 19. Reasoning distributions differ across model families, and a judge calibrated on one distribution could systematically under- or over-credit risk identification on another. No per-model judge accuracy or human re-annotation sample is reported, so the headline Think@1 numbers carry an unknown systematic error. This is load-bearing because the SSA gap is defined by Think@1. A related but smaller issue: the dataset was filtered by requiring 3 of 5 specific models to exhibit SSA, and those same five appear in the main table. For those models, low Think@1 is partly by construction. The other fourteen are independent, and they also show low Think@1, which tells me the phenomenon is not an artifact of the selection rule—but the paper should separate the filtering models from the rest when reporting. Minor quibbles: the F-score alpha is tuned on the same evaluation data, and no confidence intervals are reported for any metric.\n\nThe paper is honest about its limitations (single-turn, coverage of long-tail risks) and the dataset and code are promised. I'd send it out: it deserves a careful referee, and the measurement concerns are fixable in revision rather than fatal. If I worked on safety evaluation, I'd cite the benchmark and probably bring it to a reading group.","headline":"BSA is a solid benchmark contribution and the SSA phenomenon is probably real, but the headline Think@1 gap needs per-model judge validation before the numbers can be trusted.","tokens_in":20995,"tokens_out":2147,"would_cite":true,"duration_ms":22082,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Leading reasoning models answer risky queries safely while their internal reasoning often fails to identify the actual risk — a gap the paper calls Superficial Safety Alignment, measured with a 2,000-prompt benchmark.","keywords":["Superficial Safety Alignment","large reasoning models","chain-of-thought safety","risk awareness evaluation","LLM-as-a-judge","safety alignment","benchmark dataset","over-refusal"],"falsifier":"Have independent human experts re-score a stratified random sample of roughly 300 reasoning traces drawn from several evaluated models, including models other than the one used to validate the judge, against the same risk summaries, and compare their Think@1 verdicts with the judge model's. If humans rate risk identification far higher than the judge did, the reported sub-40% ceiling is largely a judge artifact; if the human scores reproduce it, the SSA prevalence claim stands. A second check, independently re-annotating a sample of risk summaries to confirm that no listed risk is missing, tests the ground truth itself.","tokens_in":19880,"feed_emoji":"🧠","tokens_out":11356,"duration_ms":67260,"temperature":0.7,"pith_summary":"The paper's claim is that today's large reasoning models are only superficially safe: they refuse risky queries with safe-sounding answers while their internal chain-of-thought frequently fails to spot the actual risk, catches only one of several risks, or flags harmless details as dangerous. To establish this, the authors built Beyond Safe Answers (BSA) bench, 2,000 curated prompts with expert-written risk summaries spanning nine risk categories and three failure scenarios, and evaluated 19 leading reasoning models on it. The reported result is a wide split: response-level safety scores exceeded 90% for leading models, yet the best model identified every risk in its own reasoning less than 40% of the time, and every model fell below 20% when all five sampled reasoning traces had to be correct. The stakes are that standard safety scores can make a model look compliant while it remains unprepared for novel, compound, or ambiguous threats.","feed_headline":"90% safe answers, 38% risk awareness: the AI reasoning gap","feed_subtitle":"A 2,000-prompt benchmark shows top models refuse harmful requests yet miss the real risk in their own thinking.","key_machinery":"The load-bearing object is the BSA bench itself: 2,000 prompts, each paired with a human-written risk summary that serves as ground truth for whether a model's reasoning covered the real risk. Each prompt is engineered to trigger one of three SSA failure modes, Over Sensitivity, Cognitive Shortcut, or Risk Omission, across nine risk categories, and difficulty filtering kept only items that at least three of five pilot reasoning models handled superficially. Evaluation decomposes every sampled output into two binary judgments made by a judge model, response safety and reasoning completeness, aggregated into single-sample metrics (Safe@1, Think@1), all-samples consistency metrics (Safe@k, Think@k), and a combined F-score that weights reasoning at $\\alpha = 0.76$. Comparing the reasoning trace against the risk summary is what converts \"the model gave a safe answer\" into a check on whether the model understood why the answer had to be safe.","core_discovery":"On the paper's own terms, the central discovery is the prevalence of Superficial Safety Alignment (SSA) in all 19 evaluated large reasoning models: safe-looking final answers produced by reasoning that does not genuinely engage the risk. The authors operationalize SSA as a measurable gap between two statistics computed over repeated sampling, Safe@1, the fraction of responses judged safe (above 90% for leading models), and Think@1, the fraction of reasoning traces that correctly flag every risk named in the human-written risk summary (below 40% for every model, with DeepSeek-R1 best at 37.98%). The same gap appears inside the three benchmark scenarios: over-sensitivity, where benign parts of a query are treated as dangerous; cognitive shortcut, where only the most salient of several risks is addressed; and risk omission, where subtle risks go unmentioned. The paper frames the pattern as safety by coincidence rather than comprehension, and distinguishes it from deliberate deceptive alignment.","pith_inferences":["My inference: the absolute Think@1 figures are best read as an upper bound on genuine risk identification until the judge is validated per model; the current validation supports the ranking of models more securely than it supports the 38% ceiling.","My inference: because SSA is defined on fixed single-turn prompts, a natural stress test the paper leaves open is multi-turn reframing — whether the same risk posed across several turns widens the gap between safe answers and risk awareness.","My inference: the fine-tuning results suggest safety reasoning is a transferable capability, so a testable extension is training on STAR-1-style reasoning traces for risk categories outside the benchmark and checking whether risk-omission and cognitive-shortcut errors fall together."],"forward_implications":["Response-level safety scores, including the above-90% safe-answer rates for leading models, cannot be read as evidence that a model understood the risk; deployments that check only final outputs inherit unmeasured reasoning-level blind spots.","High Safe@k consistency across repeated samples does not close the gap: every evaluated model scored below 20% Think@k, so the risk-identification failure persists however many times the model is sampled.","Safety-rule prompting reduces risk omission but measurably increases over-sensitivity, so rule injection shifts the failure mode rather than resolving it.","Fine-tuning on reasoning-trajectory safety data such as STAR-1 raises risk identification at every scale, sharply for small models (roughly 314% on Safe@k and 1340% on Think@k for the 0.6B model), but at the cost of more false alarms.","In experiments on QwQ-32B and Qwen3-32B, decoding parameters (temperature, top-p, top-k) had negligible effect on safety or reasoning accuracy, which the paper reads as evidence that SSA is set during training, not at sampling time."],"supporting_citations":[{"why":"Supplies the SafeChain protocol and the Safe/Think @1 and @k metrics that BSA adopts to separate response safety from reasoning correctness.","marker":"[6]"},{"why":"Documents that reasoning traces of large reasoning models are often less safe than their final outputs, the prior observation SSA builds on.","marker":"[5]"},{"why":"Provides the STAR-1 safety-reasoning dataset used in the fine-tuning experiments and the training configuration they follow.","marker":"[16]"},{"why":"The alignment-faking study used to distinguish deliberate deception from the unintended Superficial Safety Alignment failure mode.","marker":"[10]"},{"why":"DeepSeek-R1, a central model family in the evaluation suite and one of the five models used for BSA difficulty filtering.","marker":"[2]"},{"why":"BeaverTails, one of the public datasets supplying risky seed content for building the benchmark.","marker":"[30]"},{"why":"OR-Bench, the over-refusal dataset that supplies seed content for the over-sensitivity scenario.","marker":"[32]"}],"fun_headline_variants":["Safe answers, unsafe reasoning: the SSA gap","Superficial safety: AI refuses harm but misses real risk","Safe outputs, shallow risk detection: the SSA divide","New benchmark reveals AI's safety-reasoning gap","Think@1 38%, Safe@1 90%: the safety-reasoning divide"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The benchmark's numbers hinge on one judge model, GPT-4o-1120, rating reasoning traces faithfully against the human risk summaries, but that judge was validated on 2,000 traces from a single unspecified model, never per evaluated model, and the risk summaries themselves were never independently checked for completeness.","fun_headline_variants_meta":{"raw":{"variants":["Safe answers, unsafe reasoning: the SSA gap","Superficial safety: AI refuses harm but misses real risk","Safe outputs, shallow risk detection: the SSA divide","New benchmark reveals AI's safety-reasoning gap","Think@1 38%, Safe@1 90%: the safety-reasoning divide"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000376,"raw_usage":{"total_tokens":2010,"prompt_tokens":957,"completion_tokens":1053,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":573,"completion_tokens_details":{"reasoning_tokens":965}},"tokens_in":573,"tokens_out":1053,"duration_ms":8988,"temperature":1.0,"reasoning_tokens":965,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:08:22.618651+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have independent human experts re-score a stratified random sample of roughly 300 reasoning traces drawn from several evaluated models, including models other than the one used to validate the judge, against the same risk summaries, and compare their Think@1 verdicts with the judge model's. If humans rate risk identification far higher than the judge did, the reported sub-40% ceiling is largely a judge artifact; if the human scores reproduce it, the SSA prevalence claim stands. A second check, independently re-annotating a sample of risk summaries to confirm that no listed risk is missing, tests the ground truth itself.","supporting_citations":[],"review_version":1}