PolicyAlign: Direct Policy-Based Safety Alignment for Large Language Models
About
Safety alignment of large language models (LLMs) typically depends on high-quality supervision data, such as safe demonstrations or preference pairs. However, in real-world deployment, emerging safety requirements are often specified as natural-language policies, while corresponding supervision data may be costly, delayed, or unavailable. This creates a mismatch between rapidly evolving safety policies and conventional data-driven alignment methods. To address this, we propose PolicyAlign, a simple yet effective framework for directly aligning LLMs with safety policies. Given a safety policy, PolicyAlign first synthesizes policy-violating instructions and then performs on-policy self-distillation to internalize policy-guided behavior. To improve training stability and data efficiency, we further introduce Policy-Sensitive Filtering, which selects instructions where the policy induces the largest behavioral shift. Experiments across multiple models show that PolicyAlign consistently improves safety while maintaining low over-refusal and preserving general capabilities. PolicyAlign also generalizes to medical, legal, and financial safety scenarios, highlighting its potential as a scalable and maintainable approach to policy-based LLM safety alignment. The code is released at https://github.com/Qwen-Applications/PolicyAlign.
Related benchmarks
| Task | Dataset | Result | Rank | |
|---|---|---|---|---|
| Jailbreak Robustness | WildJailbreak | Unsafe Rate4.75 | 165 | |
| Math Reasoning | MATH500 | Accuracy58.2 | 127 | |
| Over-refusal | XSTest | -- | 102 | |
| Scientific Reasoning | GPQA Diamond | Accuracy38.38 | 94 | |
| Harmful Request Defense | AdvBench | ASR0.00e+0 | 65 | |
| Multi-task Knowledge Understanding | MMLU-Pro | Mean Accuracy59.64 | 47 | |
| Jailbreak evaluation | WildJailbreak | -- | 22 | |
| Jailbreak Robustness | FORTRESS | ASR7.2 | 21 | |
| Harmful Request Rejection | StrongREJECT | Acceptance Rate (ASR)0.00e+0 | 21 | |
| Harmful query evaluation | AdvBench | Harmful Rate0.00e+0 | 4 |