Beyond Safe Answers:
A Benchmark for Evaluating True Risk Awareness in Large Reasoning Models

Key Features of Beyond Safe Answers Benchmark

• Detailed Risk Rationales: Each instance is accompanied by explicit annotations that detail the underlying risks, enabling precise assessment of a model's reasoning depth
• Comprehensive Coverage: Contains over 2,000 carefully curated samples spanning three distinct SSA scenarios—Over Sensitivity, Cognitive Shortcut, and Risk Omission—across 9 primary risk categories, ensuring diverse and extensive evaluation.
• Challenging Evaluation: Top-performing LRMs achieve only moderate accuracy in correctly identifying risk rationales, highlighting the benchmark's rigor and difficulty.
• Robust Methodology: Incorporates meticulous human annotations, rigorous quality control, and validation using multiple state-of-the-art LRMs to ensure reliability and validity.
• Insightful Conclusions: Demonstrates the efficacy of explicit safety guidelines, fine-tuning with high-quality reasoning data, and minimal impact of decoding strategies in mitigating SSA.

Main Results

• BeyondSafeAnswer Bench is Challenging. All tested LRMs exhibit significant Superficial Safety Alignment (SSA). Although models achieve high surface-level safety scores (over 90%), their internal risk reasoning accuracy is low, with even top-performing models scoring below 40% on accurately identifying risks.
• Reasoning Accuracy Correlates with Safety. Higher reasoning accuracy strongly predicts safer outputs. Models proficient at internally identifying risks consistently generate safer responses, whereas models with poor internal reasoning demonstrate inconsistent safety behaviors.
• Larger Models Exhibit Superior Safety Performance. Performance analysis indicates that larger models generally achieve better results across safety metrics, particularly in scenarios involving subtle or hidden risks (Risk Omission). The enhanced memory and knowledge retrieval capabilities of larger LRMs significantly improve their internal risk assessment.
• Explicit Safety Guidelines Enhance Model Safety. Integrating explicit safety rules into prompts significantly improves both surface-level response safety and internal reasoning accuracy, particularly addressing the issue of Risk Omission. However, this approach may increase model hypersensitivity in certain scenarios.
• Fine-tuning with High-quality Reasoning Data Improves Performance. Fine-tuning LRMs with curated reasoning trajectories enhances overall safety and internal risk reasoning accuracy. Smaller models see greater relative improvements, whereas larger models, already performing well, achieve more modest gains.

Through evaluating the effects of different decoding-phase sampling strategies on the performance of Qwen3-32B and QwQ-32B models, we identify that altering decoding parameters such as temperature, top-p, and top-k minimally influences the models' performance in safety reasoning tasks. The experiments systematically tested various combinations of these parameters, assessing their impact on metrics including Safe@1, Safe@k, Think@1, Think@k, and scenario-specific metrics (RO, OS, CS).

The experimental outcomes reveal that the core reasoning and safety evaluation capabilities of the tested large reasoning models are predominantly determined by intrinsic knowledge structures acquired during pre-training and alignment phases, rather than by decoding parameter adjustments. Notably, despite variations in sampling strategies, performance remained relatively stable across all metrics, suggesting that model training quality and inherent knowledge representation are far more critical to reliable safety alignment than the selection of decoding-phase parameters.

We evaluated the efficacy of explicitly integrating safety rules into the input prompts of several Large Reasoning Models (LRMs), assessing changes in response safety and reasoning accuracy across multiple dimensions. The radar chart illustrates comparative performance before ("Base") and after ("With Rule") applying these explicit safety guidelines.

The integration of safety rules significantly enhanced overall safety metrics, notably Safe@1, which reached as high as 99.8% for QwQ-32B. Additionally, the rules markedly improved performance in risk omission scenarios (RO@1), suggesting models were more adept at detecting subtle or previously overlooked risks. However, this rule-based approach also resulted in a notable increase in over-sensitivity (OS@1), reflecting a tendency towards overly cautious behavior in ambiguous contexts. These findings underscore a trade-off where explicit rule integration improves risk detection at the expense of increased false positives in low-risk scenarios, indicating a need for carefully balanced safety guidelines.

We investigated the impact of fine-tuning Large Reasoning Models (LRMs) using high-quality safety reasoning trajectories from the STAR-1 dataset, measuring improvements across multiple safety evaluation metrics. The provided visualizations compare model performances before ("Base") and after ("Fine-tuned") fine-tuning across various scales of the Qwen3 model family.

The results clearly demonstrate that fine-tuning substantially improves safety and reasoning accuracy metrics, especially for smaller models (e.g., Qwen3-0.6B and Qwen3-1.7B), which exhibited the largest relative gains in both Safe@1 and Think@1 metrics. Fine-tuning also notably enhanced model performance in scenarios involving Cognitive Shortcut (CS) and Risk Omission (RO), highlighting increased capacity for nuanced risk detection. Conversely, fine-tuned models exhibited heightened over-sensitivity (OS), indicating that fine-tuning, while significantly boosting comprehensive safety reasoning abilities, also tends to increase cautiousness, thus highlighting an essential balance to be considered in model alignment strategies.

We observed a significant positive correlation between reasoning accuracy (Think@1) and response safety (Safe@1) in the evaluated Large Reasoning Models (LRMs). Models demonstrating high accuracy in risk identification during reasoning processes consistently yielded safer final outputs. Conversely, models exhibiting weak reasoning capabilities, particularly smaller-scale models like Qwen3-0.6B and R1-Distill-Qwen-1.5B, displayed substantial inconsistencies between their initial safety (Safe@1) and sustained safety performance (Safe@k), highlighting reduced robustness in safety alignment. These findings underscore that reliable internal reasoning is critical to maintaining robust and consistent safety across diverse contexts, and emphasizes the necessity of prioritizing accurate internal reasoning processes within LRMs.