Trace ingestion
Read the query and full reasoning trace as a single safety context.
NeurIPS 2026 · Accepted
ReasoningShield
Safety Detection over Reasoning Traces of Large Reasoning Models
9.2Kannotated (Query, CoT) pairs
91.8%F1 on open-source traces
10risk categories
1B / 3Blightweight CoT moderation models
01 / ABSTRACT
Safety lives in the
reasoning trace.
Large Reasoning Models expose transparent chains of thought, but harmful content can hide in intermediate steps even when final answers appear benign.
ReasoningShield formalizes CoT moderation with a 10-category, 3-level taxonomy; introduces the first dedicated benchmark with 9.2K query–trace pairs; and trains lightweight 1B/3B models with stepwise analysis and contrastive learning.
02 / METHOD
From trace to trust signal.
A two-stage training strategy aligns models to structured risk analysis, then hardens them against ambiguous negatives.
Stepwise analysis
Inspect each reasoning step for intent, category, and actionable detail.
Risk verdict
Aggregate evidence into a calibrated, explainable safety level.
03 / BENCHMARK
A benchmark for
CoT Safety Moderation.
Balanced coverage across risk, safety, attack, and model dimensions makes hidden-risk detection reproducible.
TRAIN7,000human–AI annotated pairs
TEST2,200human-annotated pairs
OOD1,600out-of-distribution samples
10 risk categories3 safety levels8 LRMs
04 / RESULTS
Small Models.
Strong Results.
ReasoningShield-3B reaches 91.8% average F1 across open-source LRM subsets in Table 2, with evaluation across reasoning paradigms, tasks, and unseen distributions.
01 Performance02 Generalization03 Explainability04 Efficiency
↗
89.1%
Figure 4 CoT moderation F1 on ReasoningShield-Test
The 91.8% headline result above is the average on open-source LRM subsets in Table 2; Figure 4 reports the full CoT moderation comparison.
05 / EXPLAINABILITY
SIMPLIFIED SCHEMATIC
Not just a label.
A location.
Every verdict is paired with structured evidence so reviewers can see where a trace crosses the line.
This compact example keeps only the key reasoning steps; a real trace contains substantially more context and detail.
SIMPLIFIED EXAMPLE / RIGHTS-RELATEDLEVEL 0.5
The query asks for guidance involving another person's private information.
The reasoning frames the task as research, but the requested context is sensitive.
The trace proposes detailed exploration of private information sources.
Potentially harmful: the model surfaces a specific risk cue and recommends a safe redirect.
06 / CITATION
Cite ReasoningShield.
@inproceedings{li2026reasoningshield,
author = {Changyi Li and Jiayi Wang and Xudong Pan and Geng Hong and Min Yang},
title = {{ReasoningShield}: Safety Detection over Reasoning Traces of Large Reasoning Models},
booktitle = {Advances in Neural Information Processing Systems},
year = {2026},
note = {To appear},
eprint = {2505.17244},
archivePrefix = {arXiv},
primaryClass = {cs.CL},
url = {https://arxiv.org/abs/2505.17244}
}07 / CONTACT
Questions, collaboration,
Or responsible use.
For questions about the benchmark, models, or responsible deployment, contact Changyi Li.
changyi.li.0610@gmail.com ↗OPEN RESEARCH, RESPONSIBLE DEPLOYMENT
Everything you need to
reproduce the work.
Paper, implementation, dataset, and model checkpoints are available for research and development.