A new AI training method makes chatbots write out their safety reasoning before they answer, and only rewards them when that reasoning actually holds up.
Researchers describe AUDITPLAN, a plan-then-answer technique where a single model first writes a compact, structured safety plan, a threat label, an intended action, and explicit constraints, before generating its real answer. The plan stays hidden from end users, but it gives auditors a machine-checkable record of what the model thought it was doing. The team trained this behavior with supervised fine-tuning followed by reinforcement learning using a reward-gating method called FAITHGATE, which withholds the answer reward unless the safety plan itself is correct. Tested on Qwen2.5-3B-Instruct, the approach cut attack success rate (how often a jailbreak attempt worked) from 24.0% to 11.6%, cut a separate leak-success rate from 1.0% to 0.36%, and cut over-refusal on harmless prompts from 11.0% to 2.0%, with similar gains on Qwen2.5-1.5B-Instruct, Qwen-3-4B-Instruct, and Qwen2.5-7B-Instruct.
Most safety tuning only grades the final answer, so a model can look safe while its stated reasoning has nothing to do with what it actually does, or it can just refuse everything and call that a win. Forcing the plan and the answer to match before either earns a reward closes a loophole that has made safety benchmarks easier to game than to actually solve.
It is a solid fix for small, open Qwen models in a lab setting, not yet proof it survives the messier jailbreaks aimed at production chatbots.