Auditable plans improve safety and honesty in ai answers
AUDITPLAN: Commit, Then Answer for Auditable Safety Alignment
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
It can be hard to tell if an AI is refusing to answer because something is really unsafe or just avoiding certain questions altogether. The authors propose a new method where the AI first makes a clear safety plan and then answers based on that plan. This plan can be checked by machines to make sure the AI is being honest about why it refuses or answers. Their method made AI responses more reliable and easier to audit in tests.
What this means in practice
- •For ai product developers: Develop AI systems that produce checkable safety plans alongside answers to ensure honest and robust refusal behavior in deployed chatbots.$Commercial implications: Enables safer, auditable AI chat products that can prove compliance with safety standards, improving user trust and regulatory acceptance.
- •For ai safety engineers: Use internal safety plans to diagnose and reduce unsafe or unfaithful refusal behavior during development of large language models.
Authors
Sai Sri Pushpa Jampani, Kshitij Mishra, Asif Ekbal
Abstract
Safety tuning pipelines judge only the final answer, which makes it difficult to distinguish robust refusal from two undesirable shortcuts: blanket refusal on benign requests and polished but unfaithful safety rationales that do not actually constrain the answer. We propose AUDITPLAN, a single-model plan-then-answer approach where the model first emits a compact structured safety plan and then answers conditioned on it. The plan records a threat label, intended action, and explicit constraints, enabling machine-checkable auditing while remaining hidden from users at deployment. We train this behavior with supervised fine-tuning followed by reinforcement learning with FAITHGATE, a reward-gating objective that grants answer reward only when the safety plan is correct. This discourages safe-looking but unfaithful behavior and promotes tighter plan-answer coupling. Across Qwen backbones, AUDITPLAN improves both robustness and auditability: on Qwen2.5-3B-Instruct, FAITHGATE reduces ASR from 24.0% to 11.6%, LSR from 1.0% to 0.36%, and over-refusal from 11.0% to 2.0%, outperforming answer-only RL, free-form explanation, and weighted-sum structured rewards. Similar trends hold for Qwen2.5-1.5B-Instruct. Larger-model confirmation runs on Qwen-3-4B-Instruct and Qwen2.5-7B-Instruct preserve the same trend suggesting that explicit internal commitments can make safety alignment more faithful, robust, and auditable.