Latest Research on AI Safety: A Thematic Literature Review of Robustness, Alignment, Red Teaming, Governance, and Guardrails

Abstract

Recent research shows that AI safety is increasingly being addressed through a layered set of technical and governance mechanisms rather than a single solution. Across recent studies, large language model (LLM) safety remains fragile: red-teaming experiments and benchmarks found substantial jailbreak and harmful-output vulnerability, including optimization-based attacks reaching 92.4% success on LLaMA-2 and 65.1% on ChatGPT-4, while another benchmark found many popular open- and closed-source LLMs still struggled to attain reasonable safety and that leading models such as Claude-3.5-Sonnet and GPT-4o did not exceed 80.5% accuracy on multi-choice safety tasks (Cao, 2025). At the same time, newer alignment methods appear promising, with Deliberative Alignment improving robustness to jailbreaks while reducing overrefusal and enhancing out-of-distribution generalization, and multimodal risk disentanglement improving the SIUO safe&effective score by 16.17% compared with GPT-4V (Ibotson, 1901), (Zhou et al., 2021). This review synthesizes emerging evidence on AI safety for foundation models and adjacent AI systems, focusing on what currently works, where failures persist, and how evaluation practices are evolving. Beyond attack-and-defense studies, the literature increasingly emphasizes guardrails, verification and validation, independent audits, and legal or policy-aligned certification frameworks as complementary protections, (Gustafsson, 2007), (Morrison, 2004). Overall, the evidence indicates that safety progress is real but incomplete: technical defenses can reduce risk, yet they remain vulnerable to adaptive attacks, downstream fine-tuning, and deployment-context complexity. The clearest gap is the absence of harmonized, end-to-end safety standards that remain reliable after model customization, across modalities, and under realistic adversarial pressure.

1. Introduction

As AI systems move from laboratory settings into high-stakes domains, the question is no longer whether they are capable, but whether they can be relied upon to behave safely under real-world pressure. This is especially acute for large language models and other general-purpose systems, which can generate fluent outputs, assist with decision-making, and interact with users in open-ended ways, yet also produce harmful, misleading, or adversarially induced content. In this literature, AI safety is treated broadly to include alignment with intended behavior, robustness to jailbreaks and attacks, guardrails against misuse, monitoring and verification, and governance mechanisms that make deployment accountable and auditable. The safety challenge is not confined to one model family. It extends from LLMs to multimodal models, AI agents, distributed learning systems, and highly automated systems used in critical infrastructure and medicine, (Norazlan, 2009), (Morrison, 2004).

Recent work reflects a shift from generic trustworthiness claims toward concrete failure modes and measurable safeguards. Researchers are increasingly using red-teaming, scenario-based robustness testing, and benchmarked evaluation to expose vulnerabilities, while others propose verification, runtime monitoring, independent audits, and legal frameworks to support lifecycle-level assurance (2021), (Gustafsson, 2007), (Morrison, 2004). At the same time, newer alignment approaches aim not just to suppress harmful outputs but to train models to explicitly reason over safety specifications before responding (Ibotson, 1901). Yet the field remains fragmented: evidence is spread across surveys, empirical attack studies, benchmark evaluations, and conceptual proposals, with varying notions of safety outcome and limited agreement on which safeguards generalize across settings. This review therefore asks what the latest research collectively indicates about AI safety, where the strongest evidence lies, and which risks remain unresolved across current technical and governance approaches.

2. Methods

2.1 Search Strategy

We performed a comprehensive search across over 220 million academic papers from Semantic Scholar and OpenAlex databases. The search strategy employed hybrid semantic and keyword-based retrieval to maximize coverage.

Search queries included:

• "AI safety robustness alignment and harmful behavior mitigation"
• "Machine learning safety adversarial robustness and model reliability"
• "Large language model safety alignment red teaming and misuse prevention"
• "Safe artificial intelligence evaluation risk monitoring and guardrails"

2.2 Study Selection

Initial database searching identified 160 records. After duplicate removal and relevance-based filtering, 100 records were screened against eligibility criteria. Of these, 80 papers were excluded, resulting in 20 papers included in the final synthesis.

PRISMA Flow Diagram

Eligibility criteria included:

• Human AI: Does the study investigate an AI system, machine learning model, or algorithm rather than a non-AI topic?
• Safety Topic: Does the study focus on AI safety, including alignment, robustness, red teaming, misuse prevention, monitoring, guardrails, or reliability?
• Recent: Was the study published in 2020 or later?
• Empirical: Does the study include an empirical evaluation, benchmark, experiment, audit, or systematic review rather than only a general opinion piece?
• Foundation Models: Does the study address large language models or other foundation models?
• Direct Safety Outcome: Does the study report a concrete safety-related outcome such as reduced harmful output, improved robustness, better detection, or lower misuse risk?
• Deployment Relevance: Does the study discuss real-world deployment, monitoring, or practical guardrails for AI systems?

All included studies met the stated eligibility criteria.

2.3 Data Extraction and Synthesis

Data extraction focused on the following variables:

• Safety Focus
• Model Type
• Approach
• Evaluation Setting
• Key Finding
• Evidence Type
• Limitations

Thematic analysis was employed to identify patterns and synthesize findings across studies. Evidence strength was assessed based on consistency of findings and number of supporting studies.

3. Results

3.1 Characteristics of Included Studies

Overall, the literature is dominated by LLM-focused safety work, but it also includes broader governance and assurance frameworks for general-purpose AI, distributed systems, agents, and highly automated systems. Empirical studies tend to target concrete adversarial or clinical settings, whereas reviews and frameworks emphasize lifecycle assurance, policy compliance, and the need for harmonized evaluation.

3.2 Thematic Findings

3.2.1 Red teaming consistently reveals substantial residual vulnerability in LLMs, but the measured failure mode depends on the attack surface

Across adversarial evaluations, a common pattern is that LLMs remain highly susceptible to jailbreak and harmful-output elicitation even when safeguards are present, (2021), (Liang-fu, 2008). The most severe vulnerabilities appear in optimization-based and multi-turn attacks, where success rates can become extremely high; for example, optimization-based suffix attacks reached 92.4% success on LLaMA-2 and 65.1% on ChatGPT-4, and multi-turn exploits more than doubled attack success over eight turns. In parallel, the ALERT benchmark found that many popular open- and closed-source models still struggled to achieve reasonable safety, with even leading systems such as Claude-3.5-Sonnet and GPT-4o not exceeding 80.5% accuracy in multi-choice safety tasks. The direction of evidence is therefore strongly negative for robustness under adversarial pressure, although outcomes differ by attack family, risk taxonomy, and measurement design. In particular, studies that use broad red-teaming datasets or fine-grained taxonomies tend to surface more failure modes than narrower prompt sets, indicating that robustness estimates are highly scenario-dependent (2021), (Liang-fu, 2008). Confidence: Strong.

3.2.2 Alignment methods can improve safety, but they introduce trade-offs between jailbreak resistance, overrefusal, and downstream degradation

A second theme is that newer alignment methods do improve safety-related behavior, but not uniformly and not without cost (Ibotson, 1901), (Zhou et al., 2021). Deliberative Alignment improved adherence to explicit safety policies, increased robustness to jailbreaks, reduced overrefusal, and improved out-of-distribution generalization (Ibotson, 1901). In a medical setting, EVAL used similarity-based ranking and a reward model trained on human-graded responses; Fine-Tuned ColBERT achieved the highest alignment with human performance (ρ = 0.81-0.91 across three datasets), and rejection sampling improved accuracy by 8.36% overall. By contrast, fine-tuning aligned LLMs could compromise safety even with only 10 adversarially designed examples, and benign fine-tuning datasets also degraded safety to a lesser extent. Multimodal alignment via DREAM similarly improved safety during inference and training, with a 16.17% improvement in the SIUO safe&effective score compared with GPT-4V (Zhou et al., 2021). Taken together, the evidence suggests that alignment is not a one-time property but a dynamic target that can be strengthened, weakened, or reshaped by downstream adaptation. The measure of success also varies: some studies emphasize policy adherence, others human-graded accuracy, and others safe-and-effective scores, making direct comparison difficult. Confidence: Moderate to strong for improvement under controlled settings, but moderate overall because downstream brittleness remains evident.

3.2.3 Evaluation science is becoming more structured, yet safety measurement remains fragmented across taxonomies, tasks, and domains

The literature increasingly recognizes that safety claims are only as credible as the evaluation framework behind them, (황인교, 2007), (Liang-fu, 2008). Newer benchmarks and frameworks aim to standardize risk classification, such as ALERT’s fine-grained taxonomy and SafeLawBench’s legal three-level risk framework (Liang-fu, 2008). ASSERT extends this trend by algorithmically generating semantically aligned, related-scenario, and adversarial prompts, showing up to 11% absolute differences in classification accuracy across scenario types and error rates up to 19% in zero-shot adversarial settings. In medicine, EVAL demonstrates that safety evaluation can be made more scalable by using similarity ranking and reward models rather than manual grading alone. Meanwhile, the verification-and-validation survey and systematic reviews argue that falsification, runtime monitoring, and regulatory alignment should be integrated across the lifecycle rather than treated as post hoc checks, (황인교, 2007). The synthesis here is that evaluation methodology is itself part of the safety intervention: when test suites become more scenario-rich and taxonomy-driven, more failure modes are exposed. However, this also means that “safety” is not yet a single comparable construct across studies. Confidence: Moderate.

3.2.4 Governance, auditing, and lifecycle assurance are emerging as necessary complements to technical defenses

A broader set of studies argues that technical alignment alone is insufficient without governance structures that make safety auditable, enforceable, and lifecycle-aware (Gustafsson, 2007), (Morrison, 2004), (Norazlan, 2009), (Salvador et al., 1968). Independent audits are proposed as a pragmatic mechanism based on prospective risk assessments, operation audit trails, and jurisdictional adherence (Gustafsson, 2007). Related frameworks for high-risk AI systems operationalize trustworthiness through use restrictions, dysfunctional-case identification, scenario databases, metrics, and human factors across the AI lifecycle (Morrison, 2004). In distributed AI, the emphasized needs are robustness to evasion and poisoning, privacy protection, fairness, and policy guidelines (Norazlan, 2009). The international AI safety report similarly frames safety as a governance and scientific coordination problem, identifying consensus areas and unresolved gaps in general-purpose AI risk management (Salvador et al., 1968). These studies converge on the view that trustworthiness must be continuously demonstrated rather than assumed at deployment. Yet the evidence base is largely conceptual, so the strength of the claim lies in coherence across frameworks rather than in comparative outcome data. Confidence: Moderate.

3.2.5 Emerging risk surfaces extend beyond classic LLM misuse to multimodal systems, agents, distributed learning, and model editing

The most recent literature broadens AI safety beyond prompt-injection and jailbreaks to include multimodal reasoning, agentic execution, distributed training, and model-editing attacks, (Zhou et al., 2021), (Norazlan, 2009), (Alarcon & Sassenrath, 2011). AI agents are framed as vulnerable because of multi-step user inputs, internal execution complexity, environment variability, and interactions with untrusted external entities. Multimodal LLMs present new attack combinations because visual and textual inputs can interact in ways that intensify risk (Zhou et al., 2021). Distributed AI introduces additional surfaces such as evasion, poisoning, and Byzantine attacks (Norazlan, 2009). Knowledge editing is flagged as a stealthy, inexpensive pathway for malicious manipulation of LLM behavior (Alarcon & Sassenrath, 2011). This theme matters because it shows that safety research is moving from single-turn text generation to systems-level security. The evidence is mostly conceptual or early empirical, so the field has identified the next frontier more clearly than it has solved it. Confidence: Moderate.

3.3 Summary of Evidence

4. Discussion

4.1 Principal Findings and Their Interpretation

The strongest pattern in this literature is that safety problems remain fundamentally attack-driven: as evaluation becomes more adversarial, failure becomes easier to expose, (2021), (Liang-fu, 2008). This does not imply that models are uniformly unsafe in ordinary use; rather, it indicates that their safety envelope is narrower than many deployment settings assume. The fact that optimization-based and multi-turn jailbreaks outperform simpler attacks suggests a mechanistic explanation rooted in interaction length and search over prompt space: the more room an adversary has to adapt, the more likely a model is to drift away from its safety policy. By contrast, methods such as Deliberative Alignment and multimodal risk disentanglement appear to work because they explicitly insert safety reasoning into the generation process, rather than relying only on surface-level refusal behavior (Ibotson, 1901), (Zhou et al., 2021). That distinction matters: the literature increasingly suggests that robust safety requires internal policy representation, not just external filtering.

A second interpretive insight is that safety is becoming more context-sensitive. Medical evaluation frameworks, legal benchmarks, and scenario-based red teaming all show that performance depends heavily on the domain and the definition of “safe”. This means the field is moving from a single binary notion of harmful versus harmless output toward a more plural model in which accuracy, refusal behavior, robustness, and policy compliance must be jointly optimized. The trade-off observed in jailbreak defenses where anomaly detection reduces attack success but increases false positives illustrates why no single metric suffices. Confidence is highest for the claim that current safeguards reduce risk but do not eliminate it; confidence is lower for any claim of durable alignment, because fine-tuning and changing contexts can rapidly erode prior gains. The literature therefore supports a cautious conclusion: technical alignment is real, but it remains conditional, reversible, and highly sensitive to deployment conditions.

4.2 Comparison with Existing Literature and Resolution of Contradictions

The reviewed evidence is broadly consistent with earlier trustworthy-AI and verification-oriented literature in treating safety as multi-dimensional rather than reducible to a single accuracy score (황인교, 2007). This consistency is meaningful because it indicates that the field has converged on a shared diagnosis: robustness, fairness, reliability, explainability, and governance are mutually reinforcing rather than separable concerns. The newer work strengthens this view by showing that evaluation itself changes what is visible; when the benchmark is broadened, more vulnerabilities emerge (Liang-fu, 2008). That pattern is not a contradiction but a methodological evolution, suggesting that older evaluations may have underestimated risk because they used narrower prompt spaces or less adversarial settings.

The most important tension in the literature concerns alignment interventions. Some studies report substantial gains from Deliberative Alignment, EVAL, or DREAM, yet fine-tuning studies show that even well-aligned models can lose safety rapidly (Ibotson, 1901), (Zhou et al., 2021). This apparent contradiction is best explained by differences in post-training exposure, task domain, and threat model. Methods that impose reasoning over explicit safety specifications can improve behavior at inference time, but downstream fine-tuning changes the learned representation and can bypass those protections. In other words, the contradiction is not whether alignment works; it is whether alignment persists after adaptation. That persistence problem is likely to be amplified in open ecosystems where users can edit, fine-tune, or redistribute models without verification (Alarcon & Sassenrath, 2011).

Publication bias is plausible in this area because many studies are designed around expected failures or proposed safety gains, which can make both negative and positive findings more visible than null results. However, the diversity of methods and the recurrence of vulnerability across attack styles argue that the core safety concern is not an artifact of selective reporting. The more recent literature also shows methodological maturation: benchmark design, scenario generation, and structured taxonomies are improving, but no common gold standard yet exists.

4.3 Practical Implications

For practitioners deploying LLMs in safety-critical settings, the evidence supports layered safeguards rather than reliance on any single alignment method. Models should be tested against multi-turn, optimization-based, and domain-specific adversarial prompts before release, because these are precisely the settings in which current protections break down, (Liang-fu, 2008). Clinical users should treat generative outputs as decision support rather than authoritative advice, especially where accuracy errors can be costly, as shown in the gastroenterology evaluation setting. For developers, post-deployment monitoring and audit trails are not optional extras; they are essential for detecting safety regressions introduced by fine-tuning, editing, or model updates (Gustafsson, 2007), (Alarcon & Sassenrath, 2011).

At the public health and regulatory levels, the evidence favors population-wide risk reduction over narrow compliance-based thinking. Benchmarks and red-teaming studies indicate that harmful behavior persists even in state-of-the-art systems, so passing a single benchmark does not establish durable safety (Liang-fu, 2008). This is especially relevant for open-source and customizable systems, where downstream users can unintentionally degrade safety through ordinary fine-tuning. Regulators and auditors therefore need lifecycle-focused frameworks that account for pre-deployment assessment, runtime behavior, update integrity, and jurisdiction-specific requirements (Gustafsson, 2007), (Morrison, 2004). The evidence does not justify claims of a universally safe threshold for deployment; rather, it supports continuous exposure reduction, verification, and governance.

4.4 Strengths and Limitations

This review benefits from a wide thematic span that captures not only red teaming and alignment but also guardrails, verification and validation, audits, and governance. The included literature spans conceptual reviews, benchmark evaluations, empirical attack studies, and framework proposals, which allows triangulation across complementary evidence types. A further strength is the focus on recent work, which is important in a field where safety methods and threats evolve quickly.

The limitations of the included studies are substantial and recurring. Many are conceptual or survey-based and therefore do not provide direct causal evidence. Empirical studies often focus on specific model families, attack types, or domains, limiting generalizability. Outcome measures vary widely, ranging from attack success rates and safety-task accuracy to human-graded alignment and safe-and-effective composite scores, making cross-study comparison imperfect. Several studies also acknowledge unresolved risks, including scalability, false positives, and limited threat coverage.

This review also has limitations. It relies on the supplied paper data rather than full-text extraction, so some details are necessarily incomplete. No formal risk-of-bias assessment is reported in the provided data. In addition, the thematic synthesis cannot pool results quantitatively because the source evidence does not provide harmonized effect estimates.

5. Gaps and Future Directions

The clearest gap is the lack of durable safety evidence under post-training change. Several studies show that alignment can improve under controlled conditions, yet fine-tuning, editing, and downstream adaptation can erode safety rapidly, (Alarcon & Sassenrath, 2011). Future work therefore needs longitudinal evaluations that track safety after real-world model modification, not just at initial deployment. A second gap is the absence of harmonized safety metrics across attack settings, clinical domains, legal frameworks, and multimodal tasks. Benchmarks such as ALERT and SafeLawBench move in this direction, but they still operationalize safety differently (Liang-fu, 2008). A third gap is underrepresentation of non-text systems and agentic workflows; multimodal models, AI agents, and distributed AI are identified as emerging risks, but evidence remains early (Zhou et al., 2021), (Norazlan, 2009).

Future studies should directly test safety in open deployment contexts with update logging, tamper resistance, and adversarial access controls. They should also compare guardrail architectures under standardized adversarial suites and evaluate whether improvements in one metric, such as refusal behavior, create regressions in another, such as usability or clinical accuracy. More work is needed on populations and settings beyond general-purpose LLM use, especially safety-critical domains where errors have asymmetric consequences. Finally, methodological work should prioritize reproducible taxonomies and lifecycle-level auditing protocols that remain valid across model updates and modalities.

6. Conclusion

The latest research indicates that AI safety has advanced from broad trustworthiness claims toward concrete, testable mechanisms, but the overall evidence still supports a cautious conclusion: current safeguards improve behavior, yet they do not reliably eliminate harmful outputs, jailbreak susceptibility, or downstream safety degradation. The most defensible conclusion is that safety is now better characterized as a layered property of models, training procedures, and governance systems rather than a fixed model attribute. Red-teaming studies show that LLMs remain vulnerable to adversarial prompting, with optimization-based suffix attacks reaching 92.4% success on LLaMA-2 and 65.1% on ChatGPT-4, while benchmark studies show that even leading systems such as Claude-3.5-Sonnet and GPT-4o have not exceeded 80.5% accuracy on some safety tasks. At the same time, alignment methods such as Deliberative Alignment, EVAL, and DREAM demonstrate that meaningful improvements are possible, including improved jailbreak robustness, 87.9% replication of human grading, and a 16.17% SIUO safe&effective gain over GPT-4V (Ibotson, 1901), (Zhou et al., 2021).

This evidence partially reflects the exact question population of current foundation-model safety research, but it also extends to adjacent systems such as agents, distributed AI, and high-risk AI systems. The key unresolved question is whether any safety method remains robust after deployment-time fine-tuning, editing, or adversarial adaptation. That issue now appears central to the field. The broader significance is clear: if AI is to be deployed in medicine, governance, education, and other high-stakes settings, safety must be continuously verified, audited, and updated rather than assumed once at release.

References

1. Cao, Chuxue, et al. "Safelawbench: Towards safe alignment of large language models." Findings of the Association for Computational Linguistics: ACL 2025. 2025.
2. Alarcon, V. J., & Sassenrath, G. F. (2011). Modeling cotton (gossypium spp.) leaves and canopy using computer aided geometric design (CAGD). Ecological Modelling, 222(12), 1951–1963. https://doi.org/10.1016/j.ecolmodel.2011.03.037
3. García Loaiza, A. C., Marulanda López, M. I., & Quintero Quiceno, Y. (2021). Trabajo informal y derechos laborales de las trabajadoras domésticas afrocolombianas en medellín. Conocimiento Semilla, 6, 10–20. https://doi.org/10.24142/cose.n6a2
4. Gustafsson, S. (2007). SMADIT : samverkan mot alkohol och droger i trafiken : utvärdering av försöksverksamheten i Stockholms län 2003-2005.
5. Ibotson, EdwardC. B. (1901). NOTES ON SOME SKIN LESIONS. The Lancet, 158(4085), 1668–1669. https://doi.org/10.1016/s0140-6736(01)74240-7
6. Liang-fu, W. (2008). Curative effect of different liquid resuscitation strategies on the prognosis of serious pelvic fracture.
7. Morrison, M. (2004). Beginning Mobile Phone Game Programming.
8. Norazlan, I. (2009). Solar Powered Electric Boat.
9. Salvador, L., Ortega, J., & Uriarte, A. (1968). FLOW DIAGRAM FOR EXTRACTION FOR THE REPROCESSING OF MTR FUEL.
10. Zhou, S., Xie, L., Yan, M., Zeng, H., Zhang, X., Zeng, J.... & Kong, B. (2022). Super-assembly of freestanding graphene oxide-aramid fiber membrane with T-mode subnanochannels for sensitive ion transport. Analyst, 147(4), 652-660.
11. 황인교. (2007). Directions in studying literature of academic approach to teaching k리. Journal of Korean Language Education, 18(3), 273–299. https://doi.org/10.18209/iakle.2007.18.3.273