language:

• en
  license: odc-by
  size_categories:
• 100M<n<1B
  task_categories:
• text-generation
  pretty_name: ReSA
  tags:
• ai safety
• jailbreak
• safety training
• red-teaming
• chain-of-thought
• reasoning
  configs:
• config_name: train
  data_files: sft_train.json
• config_name: eval
  data_files: eval_safe_completion.json

ReSA (Reasoned Safety Alignment)

Project Page | Paper

ReSA (Reasoned Safety Alignment) is an open-source synthetic safety-training dataset with 80K examples designed to enhance LLM robustness against jailbreak attacks through an "Answer-Then-Check" strategy. The dataset teaches models to first generate a summary of their intended answer, then critically evaluate its safety before providing a final response. This approach achieves superior safety performance while maintaining strong general capabilities and reducing over-refusal rates.

Dataset Composition

ReSA Training Set

The ReSA dataset contains 80,426 training samples across four query categories, each paired with reasoning-enhanced responses:

1. Vanilla Harmful (12,412 samples): Direct harmful requests that could potentially elicit unsafe responses. These prompts span various risk categories and are paired with responses that demonstrate the Answer-Then-Check reasoning process, ultimately refusing to provide harmful content.

2. Vanilla Benign (16,179 samples): Harmless prompts that may superficially resemble unsafe queries through keywords or sensitive topic discussions. These are paired with responses that correctly identify the benign nature and provide helpful answers after safety analysis. We also selected 1,000 rejection-prone samples from the MMLU auxiliary training set and incorporated them into the training set.

3. Adversarial Harmful (22,763 samples): Complex jailbreak attempts that disguise harmful requests through various obfuscation techniques including roleplaying, hypothetical scenarios, and nested contexts. Generated using methods like PAIR, PAP, and GPTFuzzer against base models.

4. Adversarial Benign (29,072 samples): Queries that mimic jailbreak patterns but contain no harmful intent. These help prevent over-refusal by teaching models to distinguish between genuinely harmful content and benign queries with complex structures.

Note: We open sourced the dataset with 79,552 (80,426-874) of the highest quality samples eligible to facilitate further research. You can directly use the instruction column as the input and the output column as the output of the model for SFT.

Safe Completion Evaluation Set

To evaluate the safe completion capability, we extract all self-harm related queries from StrongREJECT, HarmBench, and AdvBench datasets, and apply PAIR, PAP, and DeepInception jailbreak methods to generate 153 test instances. This evaluation set specifically tests whether models can recognize sensitive topics even under adversarial prompts and respond with appropriate care.

Answer-Then-Check Strategy

Each response in ReSA follows a structured reasoning template:

<think>
I'll create an answer planning idea and verify its safety. The planning idea is as follows:
<intended_answer_summary>
[Concise 1-5 sentence summary of intended answer]
</intended_answer_summary>
But wait, let me check if the planning idea is safe.
[Detailed safety analysis]
</think>
[Final response: either the answer if safe, or refusal if unsafe]

This approach enables models to:

• First formulate what they would naturally respond with
• Critically evaluate the safety of that response
• Make informed decisions about whether to provide the answer

Key Features

Jailbreak Defense

• Comprehensive Coverage: Includes examples from WildJailbreak, PAIR, PAP, and GPTFuzzer attack methods
• Adaptive Resistance: Trained models show strong defense against both seen and unseen jailbreak techniques

Safe Completion

• Beyond Simple Refusal: For sensitive topics like self-harm, provides supportive and helpful responses rather than outright refusal

Efficiency

• Minimal Data Requirements: Experiments show that even 500 samples can achieve strong safety performance
• Balanced Distribution: Carefully balanced between harmful and benign queries to prevent over-refusal

Citation

If you find this resource useful in your work, please cite it with:

@inproceedings{cao2025reasoned,
  title={Reasoned Safety Alignment: Ensuring Jailbreak Defense via Answer-Then-Check},
  author={Cao, Chentao and Xu, Xiaojun and Han, Bo and Li, Hang},
  booktitle={ICLR},
  year={2026}
}

Acknowledgments

This dataset builds upon the WildJailbreak dataset and incorporates jailbreak techniques from PAIR, PAP, and GPTFuzzer. We thank the authors for their wonderful works.

License

This dataset is released under the ODC-BY license, allowing for both academic and commercial use with attribution.