AUDITPLAN: Commit, Then Answer for Auditable Safety Alignment

What is AUDITPLAN and how does it work?

AUDITPLAN is a safety-alignment method where a language model first emits a short structured safety plan (a threat label such as benign/jailbreak/leakage, an intended action, and constraints) before writing its visible answer. The plan is hidden from users but logged for auditing, and during reinforcement learning the answer only earns high reward when the plan is valid and correct (the FAITHGATE gate), which discourages blind refusals and rationales that ignore the actual decision.

How much does FAITHGATE improve safety compared to standard reward training?

In the paper's controlled 3B comparison (same model, data, and reward components, only the credit-assignment rule changed), FAITHGATE reduced attack success rate from 24.0% to 11.6%, leakage success from 1.0% to 0.36%, and over-refusal of benign prompts from 11.0% to 2.0%, improving all six reported metrics with statistical significance across three seeds.

Does the plan actually control the model's answers?

The paper shows measurable coupling: plan-answer consistency reaches 0.80 and threat-label accuracy 0.72 on the 3B model with FAITHGATE, versus 0.65 and 0.58 for a weighted-sum reward. The authors are careful to say this is not a mechanistic proof of faithfulness, and both metrics remain well below 1.0, so the plan constrains answers substantially but imperfectly.

What are the main limitations of the study?

Evaluation covers only 900 held-out prompts (plus a 180-item stress slice) with template-style attacks rather than optimised ones like GCG; all safety/leakage verdicts come from the authors' LLM-judge cascade with only an internal agreement check; the larger-model confirmations are single-seed runs; and no code or data release is stated.