Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models

2026-10-07

AI Summary

This study addresses the safety alignment inconsistencies and jailbreak vulnerabilities of Loop Language Models (LoopLMs) across varying reasoning depths. We provide the first systematic investigation into this cross-depth safety vulnerability, revealing that deeper reasoning is substantially more susceptible to attacks and exhibits significant behavioral discrepancies. To mitigate this, we propose SafeBridge, a method that unifies safety performance across depths through lightweight depth control, selective state bridging, and a cross-depth joint safety supervision mechanism, enabling depth-specific modulation of shared parameters. Experimental results demonstrate that SafeBridge significantly reduces both matched- and cross-depth attack success rates while effectively enhancing general model utility and maintaining an appropriate refusal rate.

Abstract

Looped Language Models (LoopLMs) provide a parameter efficient approach to scaling model capabilities through repeated use of shared parameters across recurrent steps. Since each recurrent depth can be read out independently, a single LoopLM exposes a broader output space across inference depths, raising an important question: whether safety is preserved throughout recurrent computation. Prior evaluations suggest that deeper recurrence can improve safety on harmful queries, but robustness under jailbreak attacks remains unclear. We therefore conduct a comprehensive safety evaluation of LoopLMs under jailbreak attacks targeting different recurrent depths. We find that attack success can increase at deeper inference depths, the same query can elicit different safety behaviors across depths, and attacks constructed against one depth can transfer to others. Moreover, SFT and preference alignment do not eliminate these safety gaps, motivating an alignment method designed for LoopLMs. We introduce SafeBridge, which combines lightweight depth specific control of shared recurrent layers, selective state bridging, and joint safety supervision across recurrent depths. Across model scales, multiple attack methods, and safety benchmarks, SafeBridge substantially reduces attack success for both matched-depth and cross-depth attacks. It also improves general utility over the vanilla models while maintaining comparable over-refusal behavior. Our results show that the safety of a LoopLM cannot be inferred from a single recurrent depth, motivating safety alignment across recurrent computation. Our code and model checkpoints will be released upon acceptance.

Problem

• Looped Language Models
• Safety Alignment
• Jailbreak Attacks
• Recurrent Depths
• Cross-depth Transfer

Innovation

• Looped Language Models
• SafeBridge
• Jailbreak Attacks
• Safety Alignment
• Recurrent Depths