ACTR: Aligning Thoughts and Responses for Multilingual Safety in Reasoning LLMs
A reasoning model may recognize a safety risk in its thoughts yet still produce an unsafe answer in another language.
The short version
ACTR studies a gap in multilingual safety: a model can identify danger in its reasoning yet produce an unsafe final response, especially in non-high-resource languages. Think Gap Score measures differences in reasoning utilization, while safety-think neurons identify internal components associated with carrying safety reasoning into behavior.
The framework selectively optimizes these neurons and introduces a consistency signal between reasoning and response. It targets the connection between recognizing a risk and acting on it, with evaluation across languages and attack settings.
Recognizing a risk in reasoning is only useful when that recognition constrains the final action.
Connecting reasoning to response
The framework measures reasoning utilization, identifies safety-think neurons, and optimizes think-response consistency.
View in the paperWhy this matters
Recognizing risk does not guarantee that the response uses that recognition. This gap is especially important under jailbreak attacks in non-high-resource languages.
How it works
- Measure reasoning-trace contributions with TGS and examine safety changes under trace substitution.
- Compare neuron importance with reasoning enabled and disabled to identify safety think neurons.
- Use a frozen judge to reward safety-category consistency while updating only selected neuron-associated parameters.
A multilingual reasoning-utilization gap
Think Gap Score and attack success rates are compared across languages and two model families.
View in the paperWhat the study finds
Across two reasoning models, ACTR is evaluated on AdvBench-X and MultiJail. It reports lower average attack success rates than the compared methods, with gains extending to unseen languages while limiting benign false refusals.
Multilingual safety outcomes
The table reports attack success rates on AdvBench-X and MultiJail under the paper’s evaluation protocol.
View in the paperWhat this means
This makes safety a question about the continuity of computation. A model needs to detect a harmful request, retain that judgment through generation, and let it shape the answer. A failure at any transition can leave apparently sound reasoning disconnected from the response users receive.
The multilingual setting makes this gap especially visible. Improving the use of safety reasoning offers a more specific intervention target than treating every unsafe response as an absence of safety knowledge; its value must be assessed jointly with useful responses and transfer to languages outside training.
Paper and resources
This is an introduction to the linked paper. Refer to the original for method definitions, evaluation settings, and complete results.
Cite this work
@misc{actr,
title = {ACTR: Aligning Thoughts and Responses for Multilingual Safety in Reasoning LLMs},
author = {Zhang, Xianhui and Yu, Jian and Xie, Chengyu and Cui, Chenhang and Miao, Shuyi and Shao, Pengyang and Zheng, Yu and Shen, Fei and Chua, Tat-Seng},
year = {2026},
eprint = {2609.37054},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.37054}
}