SAFE: Stable Alignment Finetuning with Entropy-Aware Predictive Control for RLHF

SAFE: Stable Alignment Finetuning with Entropy-Aware Predictive Control for RLHF Combining Double Soft-Min Critics with Adaptive KL Thresholding

SAFE: Stable Alignment Finetuning with Entropy-Aware Predictive Control for RLHF

Combining Double Soft-Min Critics with Adaptive KL Thresholding

Dipan Maity dipanai.xyz@gmail.com

Abstract

Proximal Policy Optimization (PPO) has been positioned by recent literature as the canonical method for the RL part of Reinforcement Learning from Human Feedback (RLHF). PPO performs well empirically but has a heuristic motivation and handles the KL-divergence constraint used in LM-RLHF in an ad-hoc manner and suffers from reward oscillations, entropy collapse, value function drift, and sudden policy divergence that require frequent restarts and extensive hyperparameter tuning. In this paper, we develop a new pure on policy actor-critic RL method for the LM-RLHF setting. We present SAFE (Stable Alignment Finetuning with Entropy-aware control),a novel RLHF algorithm that combines a Double Soft-Min Critic for pessimistic value estimation with a new multi-layer stabilization framework combining entropy-gated KL regulation, and Proportional-Integral-Derivative (PID)-controlled adaptive thresholds. Unlike standard PPO’s symmetric KL penalties, SAFE distinguishes high-entropy exploration from low-entropy mode collapse and adjusts penalties dynamically based on reward velocity. Experiments on a 3B parameter model show SAFE achieves +5.15% training-average reward than PPO (0.725 vs 0.689), negligible reward crashes , and superior KL control than ppo . Our method adds minimal computational overhead and provides an interpretable, crash-resistant RLHF framework that maintains aggressive learning speed while ensuring stable long-horizon optimization suitable for production deployment. Code is available at https://github.com/ryyzn9/SAFE

Keywords: RLHF, PPO, KL Divergence, Double Critic, Entropy Control, Proportional-Integral-Derivative (PID)-controlled

1

Introduction Reinforcement Learning from Human Feedback (RLHF) Ouyang et al. ( 2022 ); Bai et al. ( 2022 ); Christiano et al. ( 2023 ) has become a central paradigm for aligning large language models with human preferences. Despite its empirical success, RLHF training remains highly unstable, particularly in long-horizon on-policy optimization. Practitioners routinely observe failure modes including reward oscillations, entropy collapse, value function drift, and sudden policy divergence that require frequent restarts and extensive hyperparameter tuning.

Most existing stabilization approaches focus on single-axis control, typically through fixed or adaptive Kullback–Leibler (KL) Schulman et al. ( 2017 ) regularization that constrains policy deviation from a reference model. While effective at limiting distributional drift, KL-based control alone does not fully capture internal policy dynamics. In practice, policies may remain within acceptable KL bounds while undergoing progressive determinization, increased gradient sensitivity, or unstable value estimation, leading to degraded learning dynamics and brittle convergence behavior.

A critical but often overlooked source of instability is value overestimation in the critic network. Standard actor-critic methods rely on a single value estimator that, due to bootstrapping and function approximation error, systematically overestimates returns in high-variance regions. When the policy encounters outlier rewards—whether from genuine improvement or spurious reward model artifacts—an overestimating critic amplifies these signals through inflated advantage estimates, driving overly aggressive policy updates that can trigger cascading instability. This positive feedback loop is particularly destructive in RLHF, where reward models themselves contain systematic biases and the policy operates over enormous discrete action spaces with delayed sparse feedback.

These challenges become particularly pronounced in long training runs, where delayed instabilities often emerge after hundreds or thousands of optimization steps. Such late-stage failures are difficult to detect using instantaneous metrics and are not adequately addressed by static regularization schedules or symmetric divergence penalties. Addressing these coupled failure modes requires coordinated intervention across multiple levels of the optimization process.

In this work, we introduce SAFE ( S table A lignment F inetuning with E ntropy-aware control), a stabilized RLHF optimization framework that integrates complementary control mechanisms across three interacting layers: value estimation, divergence regulation, and training dynamics adaptation. Rather than relying on a single stabilizer, SAFE combines pessimistic value aggregation, entropy-conditioned divergence control, and predictive threshold adaptation into a unified training architecture.

Contributions.

Our contributions are:

•

We identify and characterize interacting instability modes in long-horizon RLHF training—including value overestimation, distributional drift, and entropy collapse—that are not adequately addressed by standard KL regularization alone.

• We propose SAFE, a multi-layer stabilization framework that integrates pessimistic double soft-min value estimation to suppress overconfident updates, entropy-aware predictive control that couples asymmetric divergence regulation with adaptive entropy-based thresholding, and reward-driven PID adaptation to regulate exploration dynamics across training phases.

• We demonstrate empirically that coordinated control across value, policy, and temporal dynamics improves training stability and robustness without sacrificing reward performance, and provide theoretical analysis suggesting SAFE may offer partial resistance to reward hacking through its pessimistic critic mechanism.

Together, these results suggest that robust RLHF optimization requires explicit multi-level control of value estimation, divergence dynamics, and exploration behavior rather than static regularization alone.

2

Background

2.1

RLHF Pipeline Reinforcement Learning from Human Feedback (RLHF) typically consists of three sequential stages Ouyang et al. ( 2022 ) :

1.

Supervised Fine-Tuning (SFT): A pretrained language model is adapted to follow instructions using curated human demonstrations.

2. Reward Model Training: A separate model is trained to approximate human preference judgments over generated responses.

3. Reinforcement Learning Optimization: The policy is optimized to maximize reward model outputs while remaining close to the supervised reference policy.

The resulting optimization objective is commonly formulated as:

ℒ ​ ( θ ) = − 𝔼 x ∼ D , y ∼ π θ ​ [ r ​ ( x , y ) ] + β ⋅ D KL ​ ( π θ ∥ π ref ) , \mathcal{L}(\theta)=-\mathbb{E}{x\sim D,,y\sim\pi{\theta}}\big[r(x,y)\big]+\beta\cdot D_{\text{KL}}\big(\pi_{\theta};|;\pi_{\text{ref}}\big),

(1)

where r ​ ( x , y ) r(x,y) denotes the learned reward model score, π ref \pi_{\text{ref}} is the frozen supervised policy, and β \beta controls the strength of divergence regularization.

This KL constraint plays a dual role: it stabilizes optimization by limiting large policy updates and preserves linguistic quality by anchoring the learned policy to the pretrained distribution.

Despite its success, PPO-based RLHF remains sensitive to entropy collapse, reward hacking, and late-stage instability, motivating more structured control mechanisms.

2.2

Log-Probability Ratio Estimation in RLHF In practical RLHF implementations, KL divergence is not computed exactly over the full vocabulary distribution. Instead, divergence is estimated using Monte Carlo sampling over tokens generated by the current policy. Ouyang et al. ( 2022 ); Bai et al. ( 2022 ) .

Specifically, the commonly used estimator is the batch mean of per-token log-probability ratios: Ouyang et al. ( 2022 ) .

D ^ KL = 1 N ​ ∑ i = 1 N [ log ⁡ π θ ​ ( a i ∣ s i ) − log ⁡ π ref ​ ( a i ∣ s i ) ] , a i ∼ π θ . \widehat{D}{\text{KL}}=\frac{1}{N}\sum{i=1}^{N}\Big[\log\pi_{\theta}(a_{i}\mid s_{i})-\log\pi_{\text{ref}}(a_{i}\mid s_{i})\Big],\quad a_{i}\sim\pi_{\theta}.

(2)

While the true KL divergence D KL ​ ( π θ ∥ π ref ) D_{\text{KL}}(\pi_{\theta}|\pi_{\text{ref}})
is always non-negative by definition, this finite-sample estimator can assume negative values due to sampling variance and estimator bias.

Negative estimates occur when sampled tokens have lower probability under the current policy than under the reference model on average. This phenomenon is especially common during high-entropy exploration phases, where the policy samples broadly from low-probability tail regions of the distribution.

Importantly, such negative values do not indicate negative KL divergence, but instead reflect stochastic sampling effects. Nevertheless, we observe empirically that the sign and magnitude of this estimator correlate strongly with policy behavior:

•

Negative log-ratio estimates typically coincide with high-entropy exploratory regimes.

• Positive log-ratio estimates reflect increasing policy confidence and concentration on high-reward modes.

Sustained positive log-ratio estimates combined with decreasing entropy are frequently observed prior to exploitative behavior and reward hacking. This motivates using the log-ratio signal jointly with entropy to regulate policy stabilization.

2.3

Double Critic Learning and Pessimistic Aggregation Value overestimation is a fundamental source of instability in actor–critic algorithms and arises from bootstrapped temporal-difference updates combined with function approximation error. When a single critic systematically overestimates action values, policy updates become overly aggressive, amplifying optimization noise and often leading to training divergence.

Double Q-learning mitigates this issue by maintaining two independently parameterized critics and applying pessimistic aggregation when computing Q-value targets Van Hasselt ( 2010 ); Fujimoto et al. ( 2018 ) . Instead of relying on a single value estimate, the minimum of the two critics is used to form training targets:

    V  target   ​   (  s  )    =   min  ⁡   (    Q  1   ​   (  s  )    ,    Q  2   ​   (  s  )    )     .   V_{\text{target}}(s)=\min(Q_{1}(s),Q_{2}(s)).    

(3)

This pessimistic selection reduces positive bias by lowering the probability that both critics simultaneously overestimate the same state or action. Although this introduces a small underestimation bias, empirical studies have shown that this trade-off substantially improves stability and robustness across a wide range of continuous control benchmarks Fujimoto et al. ( 2018 ) .

Twin-critic architectures have since become a standard component of modern off-policy and on-policy actor–critic algorithms, particularly in settings with high variance rewards and non-stationary policy updates. The core principle of pessimistic aggregation provides a simple yet effective mechanism for stabilizing value estimation in large-scale reinforcement learning systems.

2.4

Entropy Regularization and Exploration Stability Entropy regularization is commonly used in reinforcement learning to encourage exploration by penalizing overly deterministic policies. In maximum-entropy frameworks such as Soft Actor-Critic Haarnoja et al. ( 2018b ) , entropy is treated as a first-class optimization objective rather than a secondary regularizer. Haarnoja et al. ( 2018a ); Geist et al. ( 2019 ); Neu et al. ( 2017 ); Nachum et al. ( 2017 ) .

In RLHF, however, entropy regularization is typically implemented using static coefficients. Such static entropy bonuses are insufficient to prevent premature entropy collapse during early training and can destabilize late-stage convergence when over-amplified.

Language model alignment exacerbates this problem due to extremely large action spaces, delayed sequence-level rewards, and strong pretrained inductive biases. Once entropy collapses prematurely, policies rapidly overfit reward model artifacts and lose the ability to recover through exploration.

These observations motivate adaptive entropy-aware stabilization mechanisms that dynamically regulate exploration based on training state rather than relying on fixed entropy coefficients.

3

Method:

Value-Level Stabilization via Pessimistic Aggregation.

At the foundation of SAFE is a double soft-min critic architecture that directly addresses value overestimation bias. Following the principle of pessimistic value estimation Van Hasselt ( 2010 ) , we maintain two independently parameterized critics and aggregate their estimates using a differentiable soft-minimum operator:

    V  soft   ​   (  s  )    =   −   α  ​   log  ⁡   [    1  2   ​   (    e   −     V  1   ​   (  s  )    /  α     +   e   −     V  2   ​   (  s  )    /  α      )    ]       .   V_{\text{soft}}(s)=-\alpha\log\left[\frac{1}{2}\left(e^{-V_{1}(s)/\alpha}+e^{-V_{2}(s)/\alpha}\right)\right].    

This soft aggregation provides a smooth, pessimistic lower bound that reduces the probability of both critics simultaneously overestimating the same state. Unlike hard minimum operators that can introduce gradient discontinuities, the soft-min formulation preserves differentiability while systematically suppressing optimistic outliers. Crucially, this pessimistic bias makes the policy less responsive to reward spikes —including those arising from reward model exploitation—thereby providing a first line of defense against both training instability and reward hacking. We further stabilize critic learning through layer normalization applied to shared representations and Polyak-averaged target networks for bootstrap stability.

Policy-Level Stabilization via Entropy-Aware Predictive Control.

At the policy level, standard symmetric KL penalties fail because they penalize healthy exploratory deviations equally with dangerous overconfident drift. To address this fundamental limitation, SAFE introduces an entropy-aware predictive controller that integrates three complementary mechanisms into a unified control architecture: (1) asymmetric penalization that selectively suppresses positive KL divergence (indicating deterministic drift toward reward model artifacts) while preserving negative deviations associated with high-entropy exploration, (2) entropy-gated scaling that amplifies corrective pressure precisely when policy entropy drops into low-stochasticity regimes characteristic of mode collapse and exploitation, and (3) Proportional-Integral-Derivative (PID)-driven adaptive thresholding that dynamically adjusts divergence tolerance based on reward velocity rather than fixed schedules. By coupling directional divergence control with entropy dynamics and temporal reward trends, this controller detects exploitative behavior earlier and maintains stable regulation across varying training phases.

Importantly, our approach does not impose hard entropy targets or rigid divergence constraints. Instead, SAFE adapts its control signals continuously in response to observed training behavior, allowing smooth transitions from exploratory optimization to stable convergence without introducing additional off-policy corrections or auxiliary objectives.

3.1

Motivation: Late-Training Entropy Collapse in RLHF In RLHF, KL divergence measures how much the policy model (the model being trained) has deviated from the reference model (the original, pre-trained model). The formula used per-token is:

D KL ​ ( π ∥ π ref ) = log ⁡ π ​ ( x t ) − log ⁡ π ref ​ ( x t ) D_{\mathrm{KL}}(\pi,|,\pi_{\mathrm{ref}})=\log\pi(x_{t})-\log\pi_{\mathrm{ref}}(x_{t})

(4)

Averaged across tokens and batches, this gives a single scalar KL value per training step.

A critical instability in long-horizon RLHF is late-stage policy entropy collapse : policies initially optimize successfully but undergo abrupt divergence characterized by rapid KL growth, entropy collapse, and catastrophic reward degradation. We observed the following failure pstandard KLdouble soft critic with standered kl experiments:

Step
KL Estimate
Reward

1400
− 0.09 -0.09
0.71 0.71

1450
+ 0.12 +0.12
0.70 0.70

1500
+ 1.36 +1.36
0.59 0.59

1550
+ 2.89 +2.89
0.41 0.41

Table 1: Example collapse trajectory showing transition from exploration ( KL < 0 \text{KL}<0 ) to exploitative divergence ( KL > 0 \text{KL}>0 ) with 42% reward loss.

This transition corresponds to a shift from exploratory behavior toward narrow exploitation of reward model artifacts, followed by irreversible policy degeneration. The problem is not negative KL itself. The problem is that the adaptive controller INTERPRETS negative KL as ”everything is fine, remove constraints . To prevent this we suggest making KL always positive, but always positive KL regularization fails to prevent this because symmetric penalties of the form

  L  KL   =   β  ⋅   |     D  ^    K  ​  L    −   D  target    |     L_{\text{KL}}=\beta\cdot|\hat{D}_{KL}-D_{\text{target}}|    

(5)

suffer from two limitations: (1) negative KL estimates associated with healthy exploration are penalized equally to dangerous positive divergence, and (2) penalties react only to instantaneous magnitude, failing to detect accelerating trends that precede collapse.

3.2

Asymmetric Controller Design To address these limitations, we introduce an asymmetric controller that selectively penalizes over-confident divergence while preserving exploration and detecting rising trends early via momentum signals.

Asymmetric Divergence Penalty.

The controller activates only when divergence exceeds a safety threshold τ \tau :

  L  asym   =   {        λ  asym   ​    (     D  ^    K  ​  L    −  τ   )   2    ,        D  ^    K  ​  L    >  τ        0  ,     otherwise       L_{\text{asym}}=\begin{cases}\lambda_{\text{asym}}(\hat{D}_{KL}-\tau)^{2},&\hat{D}_{KL}>\tau\\

0,&\text{otherwise}\end{cases}

(6)

where D ^ K ​ L \hat{D}{KL} is the Monte Carlo log-ratio estimator and λ asym \lambda{\text{asym}} controls penalty strength. This formulation imposes zero penalty on negative KL estimates, tolerates small positive deviations, and quadratically suppresses large over-confidence.

Momentum-Based Early Warning.

Value-based thresholding alone is insufficient because divergence often accelerates rapidly once exploitative behavior emerges. We augment the controller with a momentum penalty based on KL velocity over a sliding window w w :

   m  t   =      D  ^    K  ​  L    (  t  )    −    D  ^    K  ​  L    (   t  −  w   )     w    ,    L  mom   =   {        λ  mom   ​   m  t  2    ,       m  t   >  0        0  ,     otherwise        m_{t}=\frac{\hat{D}_{KL}^{(t)}-\hat{D}_{KL}^{(t-w)}}{w},\quad L_{\text{mom}}=\begin{cases}\lambda_{\text{mom}}m_{t}^{2},&m_{t}>0\\

0,&\text{otherwise}\end{cases}

(7)

This term activates when divergence is increasing, enabling early intervention even when absolute KL magnitude remains moderate.

Combined Control Signal.

The final penalty combines both components:

   L  AKL   =    L  asym   +   L  mom     .   L_{\text{AKL}}=L_{\text{asym}}+L_{\text{mom}}.    

(8)

Algorithm  1 summarizes the controller logic. The asymmetry is motivated by the role of the reference policy in RLHF: over-confidence typically indicates exploitation of reward model artifacts, while reduced confidence reflects exploration. Momentum control follows classical control theory, where reacting to derivative signals enables early intervention before large errors accumulate  Åström and Murray ( 2008 ) .

Algorithm 1 Asymmetric KL Controller

0:  Current KL estimate D ^ K ​ L \hat{D}_{KL} , history buffer, threshold τ \tau , window w w

1:  Append D ^ K ​ L \hat{D}_{KL} to history buffer

2:   L asym ← λ asym max ( 0 , D ^ K ​ L − τ ) 2 L_{\text{asym}}\leftarrow\lambda_{\text{asym}}\max(0,\hat{D}_{KL}-\tau)^{2}

3:   if history length ≥ w \geq w then

4:    m t ← ( D ^ K ​ L ( t ) − D ^ K ​ L ( t − w ) ) / w m_{t}\leftarrow(\hat{D}{KL}^{(t)}-\hat{D}{KL}^{(t-w)})/w

5:    L mom ← λ mom max ( 0 , m t ) 2 L_{\text{mom}}\leftarrow\lambda_{\text{mom}}\max(0,m_{t})^{2}

6:   else

7:    L mom ← 0 L_{\text{mom}}\leftarrow 0

8:   end if

9:   return L AKL = L asym + L mom L_{\text{AKL}}=L_{\text{asym}}+L_{\text{mom}}

3.3

Empirical Behavior Figure  1 compares training dynamics under Double Soft-Min Critics with Asymmetric KL control versus standard PPO over 2000 steps. The asymmetric controller demonstrates improved KL regulation but reveals significant trade-offs in other stability metrics.

KL Divergence Control. The Asymmetric KL controller achieves substantially better KL regulation, with mean absolute KL divergence of 0.241 0.241 compared to PPO’s 0.131 0.131 . More importantly, only 28.6 % 28.6% of training steps exceed KL > 0.2 \text{KL}>0.2 under Asymmetric KL versus 55.9 % 55.9% for PPO, and KL volatility is reduced by 44 % 44% (rolling std 0.294 0.294 vs 0.526 0.526 ). This indicates that directional divergence penalties successfully constrain large positive KL excursions associated with exploitative drift.

Entropy Preservation. The asymmetric mechanism maintains moderate entropy levels throughout training, with mean policy entropy remaining stable. However, completion length variability is reduced (std 9.7 9.7 vs 12.6 12.6 tokens), suggesting somewhat more deterministic generation patterns.

Reward Performance. Despite improved KL control, Double Soft-Min Q with Asymmetric KL achieves lower mean reward than PPO ( 0.672 0.672 vs 0.689 0.689 , p
Value Function Instability. The most severe limitation is critic destabilization: the Double Soft-Min Q with Asymmetric KL produces 1256 value loss spikes exceeding 0.1 0.1 , compared to only 28 under PPO—a 45 × 45\times increase in instability. Mean value loss rises to 0.226 0.226 versus PPO’s 0.006 0.006 , suggesting that the interaction between asymmetric penalties and advantage estimation introduces severe optimization noise. This critic instability likely explains the reduced reward performance and higher training volatility.

These results demonstrate that while Asymmetric KL control successfully constrains divergence magnitude, it destabilizes value learning and sacrifices reward performance. The directional penalty approach combined with pessimistic double critics alone is insufficient for robust RLHF optimization. These findings motivate the entropy-aware predictive controller introduced in Section  3.4 , which addresses value instability through dual-timescale tracking, adaptive thresholding, and phase-aware modulation to coordinate policy and critic stabilization.

Figure 1: Training dynamics comparing asymmetric KL control ( blue) versus PPO (red) over 2000 steps. Asymmetric control achieves stronger KL regulation but exhibits higher value loss volatility, indicating the need for additional stabilization (Section  3.4 ).

3.4

Entropy-Aware Predictive Controller: Motivation and Design While the Asymmetric KL Controller stabilizes divergence magnitude and growth dynamics, KL alone does not capture internal changes in policy confidence. During RLHF training, policies naturally become more deterministic as optimization progresses. However, excessive determinization can amplify the effect of KL deviations by concentrating probability mass on narrow token subsets. From training curves (Fig.  1 ), we observe that reward stability and batch variance differ across controllers even when KL magnitudes remain comparable. This motivates incorporating policy entropy as a modulating signal for divergence control rather than treating KL in isolation. Importantly, the controller does not assume direct causality between entropy and reward outcomes. Instead, entropy is used as a stabilizing proxy for policy sharpness that influences how aggressively KL deviations should be penalized.

The Entropy-Aware Predictive Controller constitutes the second stabilization layer in SAFE. Unlike the Asymmetric KL Controller, which focuses on directional divergence control, this component introduces adaptive thresholding, entropy-conditioned penalty modulation, and reward-driven predictive regulation.

3.4.1

Motivation:
Empirical training traces indicate that while reward optimization may remain stable, KL trajectories and value losses can fluctuate significantly across phases of training. This motivates a controller that:

•

Adapts divergence constraints dynamically using reward feedback,

• Accounts for the interaction between KL magnitude and policy entropy,

• Adjusts control sensitivity across different training regimes.

The Entropy-Aware Predictive Controller addresses these requirements by combining adaptive threshold control, entropy-based penalty scaling, and phase-aware modulation.

3.4.2

Dual-Timescale KL Tracking To stabilize control signals under noisy minibatch estimates, the controller maintains two exponential moving averages of KL divergence:

KL short ( t ) = 0.9 ⋅ KL short ( t − 1 ) + 0.1 ⋅ D ^ K ​ L ( t ) , \text{KL}{\text{short}}^{(t)}=0.9\cdot\text{KL}{\text{short}}^{(t-1)}+0.1\cdot\hat{D}_{KL}^{(t)},

(9)

KL long ( t ) = 0.99 ⋅ KL long ( t − 1 ) + 0.01 ⋅ D ^ K ​ L ( t ) . \text{KL}{\text{long}}^{(t)}=0.99\cdot\text{KL}{\text{long}}^{(t-1)}+0.01\cdot\hat{D}_{KL}^{(t)}.

(10)

The short-timescale tracker responds rapidly to transient spikes, while the long-timescale tracker captures slower distributional drift. This separation improves numerical stability and avoids reacting excessively to single-batch noise.

3.4.3

Reward-Driven Predictive Threshold Adaptation Rather than using a fixed KL target, the controller adapts its divergence tolerance using a PID controller driven by reward velocity feedback. This enables the system to automatically adjust exploration constraints based on whether training is improving at the desired rate.

The PID controller tracks the reward improvement rate rather than absolute reward magnitude. The control error is defined as:

   e  t   =    Δ  ​  EMA  ​   (   r  t   )    −   v  target     ,   e_{t}=\Delta\text{EMA}(r_{t})-v_{\text{target}},    

(11)

where Δ ​ EMA ​ ( r t ) = EMA t − EMA t − 1 \Delta\text{EMA}(r_{t})=\text{EMA}{t}-\text{EMA}{t-1} is the velocity (rate of change) of the exponentially smoothed reward with decay factor 0.95 0.95 , and v target = 0.001 v_{\text{target}}=0.001 is the target improvement rate (0.1% per step).

The adaptive KL threshold is computed using standard PID control:

   τ  t   =    (    τ  base   +    K  p   ​   e  t    +    K  i   ​    ∑   k  =  0   t    e  k     +    K  d   ​   (    e  t   −   e   t  −  1     )     )   ⋅   ϕ  t     ,   \tau_{t}=\left(\tau_{\text{base}}+K_{p}e_{t}+K_{i}\sum_{k=0}^{t}e_{k}+K_{d}(e_{t}-e_{t-1})\right)\cdot\phi_{t},    

(12)

where τ base \tau_{\text{base}} is the baseline divergence tolerance, K p , K i , K d K_{p},K_{i},K_{d} are proportional, integral, and derivative gains, and ϕ t \phi_{t} is the phase-dependent multiplier. The integral term is clamped to [ − 1 , 1 ] [-1,1] to prevent windup. The resulting threshold is bounded to [ 0.1 , 0.6 ] [0.1,0.6] to maintain reasonable operating ranges.

The mechanism works as follows: When reward improvement exceeds the target rate ( e t > 0 e_{t}>0 ), the PID output becomes positive, increasing τ t \tau_{t} and allowing greater KL divergence to encourage continued exploration of the productive region. When improvement falls below target ( e t
This design creates a feedback loop where divergence tolerance tracks optimization productivity rather than absolute performance, relaxing constraints during sustained improvement and tightening them during plateaus or instability.

3.4.4

Entropy-Gated KL Penalty While KL divergence measures deviation from the reference policy, it does not capture the internal confidence of the current policy. To account for this interaction, the controller applies entropy-aware modulation to the KL penalty.

First, a base penalty is computed when the short-term KL estimate exceeds the adaptive threshold:

l ​ L base = { λ ​ ( KL short − τ t ) 2 , KL short > τ t 0 , otherwise . lL_{\text{base}}=\begin{cases}\lambda(\text{KL}{\text{short}}-\tau{t})^{2},&\text{KL}{\text{short}}>\tau{t}\ 0,&\text{otherwise}.\end{cases}

(13)

This penalty is then scaled using an entropy-dependent factor:

g t = max ⁡ ( 0.5 , H floor H ​ ( π θ ) + ϵ ) , g_{t}=\max\left(0.5,\frac{H_{\text{floor}}}{H(\pi_{\theta})+\epsilon}\right),

(14)

where:

•

 H  ​   (   π  θ   )    H(\pi_{\theta})    is the current policy entropy,

• H floor H_{\text{floor}} defines a minimum entropy reference,

• ϵ \epsilon ensures numerical stability.

The final penalty becomes:

L EPC = g t ⋅ L base . L_{\text{EPC}}=g_{t}\cdot L_{\text{base}}.

(15)

This mechanism does not directly predict entropy collapse. Instead, it modulates penalty strength such that low-entropy regimes receive stronger corrective pressure, while higher-entropy policies experience gentler regulation.

3.4.5

Phase-Aware Threshold Modulation Training dynamics differ substantially between early exploration, reward climbing, plateau phases, and late convergence. A lightweight phase detector monitors reward statistics and applies a multiplicative adjustment factor ϕ t \phi_{t} to the KL threshold.

This enables:

•

relaxed constraints during early exploration,

• tighter regulation during stagnation,

• stabilized behavior near convergence.

Phase awareness improves controller robustness without introducing task-specific heuristics.

3.4.6

Gradient Preview Safety Gate To further prevent instability, the controller implements a gradient preview mechanism. After computing a tentative policy update, the resulting preview KL divergence is compared against a maximum allowable limit:

scale = { 1 , D ^ K ​ L preview ≤ D max D max D ^ K ​ L preview , otherwise . \text{scale}=\begin{cases}1,&\hat{D}{KL}^{\text{preview}}\leq D{\text{max}}\ \frac{D_{\text{max}}}{\hat{D}_{KL}^{\text{preview}}},&\text{otherwise}.\end{cases}

(16)

When necessary, the update magnitude is scaled down before application. This provides an additional safety layer against sudden divergence spikes.

3.4.7

Controller Algorithm

Algorithm 2 Entropy-Aware Predictive Controller

1:  Input: current KL estimate D ^ K ​ L \hat{D}{KL} , entropy H ​ ( π θ ) H(\pi{\theta}) , reward r t r_{t}

2:  Update short-term KL EMA

3:  Update long-term KL EMA

4:  Update reward-driven PID controller

5:  Update training phase detector

6:  Compute adaptive threshold τ t = ( τ base + PID ) ⋅ ϕ t \tau_{t}=(\tau_{\text{base}}+\text{PID})\cdot\phi_{t}

7:   if KL s ​ h ​ o ​ r ​ t > τ t \text{KL}{short}>\tau{t} then

8:   Compute base KL penalty

9:   Compute entropy scaling factor g t g_{t}

10:    L EPC ← g t ⋅ L base L_{\text{EPC}}\leftarrow g_{t}\cdot L_{\text{base}}

11:   else

12:    L EPC ← 0 L_{\text{EPC}}\leftarrow 0

13:   end if

14:  Return penalty and diagnostic statistics

3.4.8

Practical Role of the Entropy-Aware Controller in SAFE Within the overall SAFE framework, the Entropy-Aware Predictive Controller provides:

•

Adaptive divergence regulation across training phases,

• Improved robustness to noisy KL estimates,

• Stabilized interaction between policy confidence and divergence control,

• Additional protection against large post-update KL spikes.

Combined with the Asymmetric KL Controller, this forms a multi-layer stabilization architecture that operates at both directional divergence control and dynamic threshold regulation levels.

4

Components
SAFE combines pessimistic value estimation, entropy-gated KL regulation, and adaptive threshold control into a unified on-policy RLHF optimization framework. The method extends PPO-style policy optimization by introducing stabilization components that operate at the value estimation level, policy divergence regulation level, and training-dynamics adaptation level.

At each training iteration, on-policy rollouts are collected, normalized advantages are computed using a pessimistic critic ensemble, and multiple clipped PPO updates are performed with entropy-modulated KL penalties and dynamically adjusted divergence thresholds.

4.1

Double Soft-Min Critic To mitigate value overestimation and stabilize advantage estimation, we employ a twin-critic architecture with differentiable pessimistic aggregation.

Given two independent value estimators V 1 ​ ( s ) V_{1}(s) and V 2 ​ ( s ) V_{2}(s) , the soft-min aggregation is defined as:

V soft ​ ( s ) = − α ​ log ⁡ ( 1 2 ​ [ e − V 1 ​ ( s ) / α + e − V 2 ​ ( s ) / α ] ) , V_{\text{soft}}(s)=-\alpha\log\left(\frac{1}{2}\left[e^{-V_{1}(s)/\alpha}+e^{-V_{2}(s)/\alpha}\right]\right),

(17)

where α > 0 \alpha>0 controls the smoothness of the approximation.

This operator satisfies the following properties:

Hard-min limit

lim α → 0 V soft ​ ( s ) = min ⁡ ( V 1 ​ ( s ) , V 2 ​ ( s ) ) . \lim_{\alpha\to 0}V_{\text{soft}}(s)=\min(V_{1}(s),V_{2}(s)).

(18)

Differentiability

The log-sum-exp formulation preserves smooth gradients compared to non-differentiable minimum operators.

Pessimistic bias

The aggregation suppresses optimistic value estimation errors that can destabilize policy updates.

To stabilize critic training, Layer Normalization is applied to the shared hidden representation prior to the value heads. A Polyak-averaged target critic is maintained for bootstrap stability:

θ target ← ( 1 − τ polyak ) ​ θ target + τ polyak ​ θ , \theta_{\text{target}}\leftarrow(1-\tau_{\text{polyak}})\theta_{\text{target}}+\tau_{\text{polyak}}\theta,

(19)

where τ polyak \tau_{\text{polyak}} denotes the soft update coefficient.

4.2

Reward Normalization and Advantage Estimation Reward signals produced by the reward model are normalized using running mean and variance statistics:

r ~ = r − μ r σ r + ϵ . \tilde{r}=\frac{r-\mu_{r}}{\sigma_{r}+\epsilon}.

(20)

Advantages are computed using the pessimistic critic estimate:

A = r ~ − V soft ​ ( s ) , A=\tilde{r}-V_{\text{soft}}(s),

(21)

and standardized within each batch:

A ^ = A − μ A σ A + ϵ , \hat{A}=\frac{A-\mu_{A}}{\sigma_{A}+\epsilon},

(22)

which reduces gradient variance and improves PPO optimization stability.

4.3

Entropy-Gated KL Control Signal Instead of using a fixed KL penalty coefficient, SAFE applies entropy-modulated divergence regulation that adapts penalty strength based on the current policy entropy.

4.3.1

Monte Carlo KL Estimate A per-batch log-ratio estimator is computed over policy-generated tokens:

D ^ t = 1 N ​ ∑ i = 1 N [ log ⁡ π θ ​ ( a i | s i ) − log ⁡ π ref ​ ( a i | s i ) ] , a i ∼ π θ . \hat{D}{t}=\frac{1}{N}\sum{i=1}^{N}\Big[\log\pi_{\theta}(a_{i}|s_{i})-\log\pi_{\text{ref}}(a_{i}|s_{i})\Big],\quad a_{i}\sim\pi_{\theta}.

(23)

This estimator is treated as a control signal rather than a strict divergence metric.

To reduce high-frequency noise, a short-horizon exponential moving average is applied:

D ¯ t = 0.9 ​ D ¯ t − 1 + 0.1 ​ D ^ t . \bar{D}{t}=0.9\bar{D}{t-1}+0.1\hat{D}_{t}.

(24)

Only the smoothed estimate D ¯ t \bar{D}_{t} is used for penalty computation.

4.3.2

Entropy-Gated Penalty The entropy-gated KL penalty is defined as:

L KL = { 0 , D ¯ t ≤ τ t λ ​ ( D ¯ t − τ t ) 2 ⋅ max ⁡ ( 0.5 , H floor H ​ ( π θ ) + ϵ e ) , otherwise L_{\text{KL}}=\begin{cases}0,&\bar{D}{t}\leq\tau{t}\[6.0pt] \lambda(\bar{D}{t}-\tau{t})^{2}\cdot\max!\left(0.5,\frac{H_{\text{floor}}}{H(\pi_{\theta})+\epsilon_{e}}\right),&\text{otherwise}\end{cases}

(25)

where:

•

 τ  t   \tau_{t}    is the adaptive divergence threshold,

• H ​ ( π θ ) H(\pi_{\theta}) is the current policy entropy,

• H floor H_{\text{floor}} is a minimum entropy reference,

• λ \lambda is a scaling coefficient,

• ϵ e = 0.1 \epsilon_{e}=0.1 is a numerical stabilizer.

The entropy gate amplifies penalties when entropy becomes low and attenuates penalties when entropy remains high, allowing divergence regulation strength to adapt to the current exploration regime.

4.4

Proportional-Integral-Derivative (PID)-controlled Adaptive Threshold To adapt divergence tolerance dynamically during training, we employ a PID controller that adjusts the KL threshold based on training progress. Unlike fixed schedules that cannot respond to varying learning dynamics, the PID controller tracks reward velocity and modulates exploration constraints accordingly.

The adaptive threshold is computed as:

   τ  t   =    (    τ  base   +    K  p   ​   e  t    +    K  i   ​    ∑   k  =  0   t    e  k     +    K  d   ​   (    e  t   −   e   t  −  1     )     )   ⋅   ϕ  t     ,   \tau_{t}=\left(\tau_{\text{base}}+K_{p}e_{t}+K_{i}\sum_{k=0}^{t}e_{k}+K_{d}(e_{t}-e_{t-1})\right)\cdot\phi_{t},    

(26)

where the control error is defined using reward velocity:

   e  t   =    Δ  ​  EMA  ​   (   r  t   )    −   v  target     .   e_{t}=\Delta\text{EMA}(r_{t})-v_{\text{target}}.    

(27)

Here, EMA ​ ( r t ) \text{EMA}(r_{t}) denotes exponentially smoothed reward with decay factor 0.95 0.95 , Δ ​ EMA ​ ( r t ) = EMA t − EMA t − 1 \Delta\text{EMA}(r_{t})=\text{EMA}{t}-\text{EMA}{t-1} is the velocity (improvement rate), v target = 0.001 v_{\text{target}}=0.001 is the target improvement rate, K p , K i , K d K_{p},K_{i},K_{d} are proportional, integral, and derivative gains, and ϕ t \phi_{t} is the phase-dependent multiplier (Section  4.5 ).

The three PID components serve complementary roles:

• Proportional term ( K p ​ e t K_{p}e_{t} ): Responds immediately to the current velocity gap, increasing τ t \tau_{t} when improvement exceeds target and decreasing it during stagnation.

• Integral term ( K i ​ ∑ e k K_{i}\sum e_{k} ): Accumulates persistent under-performance, forcing corrective tightening during prolonged plateaus. The sum is clamped to [ − 1 , 1 ] [-1,1] to prevent integral windup.

• Derivative term ( K d ​ ( e t − e t − 1 ) K_{d}(e_{t}-e_{t-1}) ): Responds to acceleration changes, preemptively adjusting before large deviations occur.

The resulting threshold is clipped to a bounded operating range:

   τ  t   ←   clip  ​   (   τ  t   ,  0.1  ,  0.6  )     ,   \tau_{t}\leftarrow\text{clip}(\tau_{t},0.1,0.6),    

(28)

which prevents overly aggressive constraints (that would halt exploration) or overly permissive bounds (that would allow uncontrolled drift). This creates a feedback loop where divergence tolerance tracks optimization productivity: relaxing constraints during sustained improvement and tightening them during plateaus or instability.

4.5

Phase Detection Algorithm Training dynamics differ substantially between early exploration, reward climbing, plateau phases, and late convergence. To adapt divergence tolerance across these regimes, we implement a lightweight phase detector that monitors reward statistics over sliding windows and applies multiplicative adjustments ϕ t \phi_{t} to the KL threshold.

Phase Detection Algorithm. The detector maintains a 100-step reward history and classifies the current training phase based on mean reward trends and variance:

Algorithm 3 Training Phase Detection

0:  Reward history ℋ \mathcal{H} , current reward r t r_{t}

1:  Append r t r_{t} to ℋ \mathcal{H}

2:   if | ℋ | < 50 |\mathcal{H}|<50 then

3:    return Warmup , ϕ t = 1.5 \phi_{t}=1.5

4:   end if

5:   ℛ recent ← ℋ [ − 50 : ] \mathcal{R}_{\text{recent}}\leftarrow\mathcal{H}[-50:] {Last 50 steps}

6:   ℛ old ← ℋ [ − 100 : − 50 ] \mathcal{R}_{\text{old}}\leftarrow\mathcal{H}[-100:-50] {Previous 50}

7:   r ¯ recent ← mean ​ ( ℛ recent ) \bar{r}{\text{recent}}\leftarrow\text{mean}(\mathcal{R}{\text{recent}})

8:   r ¯ old ← mean ​ ( ℛ old ) \bar{r}{\text{old}}\leftarrow\text{mean}(\mathcal{R}{\text{old}})

9:   σ recent ← std ​ ( ℛ recent ) \sigma_{\text{recent}}\leftarrow\text{std}(\mathcal{R}_{\text{recent}})

10:   if r ¯ recent > r ¯ old + 0.01 \bar{r}{\text{recent}}>\bar{r}{\text{old}}+0.01 then

11:    return Climbing , ϕ t = 1.2 \phi_{t}=1.2

12:   else if σ recent < 0.02 \sigma_{\text{recent}}<0.02 and r ¯ recent > 0.7 \bar{r}_{\text{recent}}>0.7 then

13:    return Converged , ϕ t = 1.0 \phi_{t}=1.0

14:   else

15:    return Plateau , ϕ t = 0.8 \phi_{t}=0.8

16:   end if

The phase multipliers directly modulate the adaptive threshold τ t = ( τ base + PID ​ ( r t ) ) ⋅ ϕ t \tau_{t}=(\tau_{\text{base}}+\text{PID}(r_{t}))\cdot\phi_{t} as described in Equation ( 4.4 ). This design enables:

• Warmup ( ϕ t = 1.5 \phi_{t}=1.5 ): Relaxed constraints permit broad exploration during initialization

• Climbing ( ϕ t = 1.2 \phi_{t}=1.2 ): Moderate constraints allow continued reward improvement

• Plateau ( ϕ t = 0.8 \phi_{t}=0.8 ): Tight constraints suppress drift when reward stagnates

• Converged ( ϕ t = 1.0 \phi_{t}=1.0 ): Normal constraints maintain stability near convergence

Phase awareness improves controller robustness without introducing task-specific heuristics or manual scheduling.

4.6

Preview KL Scaling (Optional) The controller exposes optional preview-based KL scaling hooks that can be used to bound update magnitude. In the current implementation, these functions are defined but not activated during training.

4.7

Policy and Value Optimization The final optimization objective is:

L total = L PPO + 0.5 ​ L value + L KL − β ​ H ​ ( π θ ) . L_{\text{total}}=L_{\text{PPO}}+0.5L_{\text{value}}+L_{\text{KL}}-\beta H(\pi_{\theta}).

(29)

PPO Objective

L PPO = − 𝔼 ​ [ min ⁡ ( ρ t ​ A ^ t , clip ​ ( ρ t , 1 − ϵ , 1 + ϵ ) ​ A ^ t ) ] , L_{\text{PPO}}=-\mathbb{E}\Big[\min(\rho_{t}\hat{A}{t},\text{clip}(\rho{t},1-\epsilon,1+\epsilon)\hat{A}_{t})\Big],

(30)

with importance ratio:

ρ t = π θ ​ ( a t | s t ) π old ​ ( a t | s t ) . \rho_{t}=\frac{\pi_{\theta}(a_{t}|s_{t})}{\pi_{\text{old}}(a_{t}|s_{t})}.

(31)

Value Loss.

To stabilize critic learning under heavy-tailed reward distributions, we use a clipped Huber regression objective,

   L  value   =     1  2    ​   [     Huber  δ   ​   (   V  soft   ,   r  ~   )    +    Huber  δ   ​   (   V  clip   ,   r  ~   )     ]     ,   L_{\text{value}}=\tfrac{1}{2}\big[\text{Huber}_{\delta}(V_{\text{soft}},\tilde{r})+\text{Huber}_{\delta}(V_{\text{clip}},\tilde{r})\big],    

(32)

where r ~ \tilde{r} denotes normalized rewards and Huber δ ​ ( ⋅ , ⋅ ) \text{Huber}{\delta}(\cdot,\cdot) is the Huber loss with threshold δ \delta Huber ( 1964 ) . The Huber loss behaves quadratically for small errors and linearly for large errors, combining the fast convergence of mean-squared error near the target with the robustness of absolute error for outliers. This caps the influence of rare but very large TD errors that arise from reward-model spikes or bootstrapping noise, preventing gradient explosions in the critic. Averaging the loss over both the pessimistic soft-min value V soft V{\text{soft}} and its clipped counterpart V clip V_{\text{clip}} further reduces overestimation while keeping the value function responsive to genuine improvements, yielding smoother value traces and fewer destabilizing loss spikes during RLHF training.

Additional Stabilization Mechanisms

Beyond the main control architecture, we employ several standard stabilization techniques that further reduce pathological updates and improve numerical robustness:

•

Gradient norm clipping: We cap the magnitude of policy and value gradients to prevent single noisy minibatches or reward spikes from producing excessively large parameter updates that could destabilize training, following common practice for controlling exploding gradients in deep RL and sequence models  Pascanu et al. ( 2013 ); Schulman et al. ( 2017 ) .

• Synchronized learning rates: Using matched step sizes for policy and critic helps avoid regimes where the critic badly lags behind the policy (underfitting) or overreacts to transient changes (overfitting), which can otherwise amplify value–policy feedback loops and degrade stability.

• Entropy regularization: A small entropy bonus discourages premature collapse to highly deterministic policies, maintaining sufficient exploration so that the KL and entropy controllers operate on informative, non-degenerate trajectories, consistent with maximum-entropy RL objectives  Haarnoja et al. ( 2018a ) .

• Polyak target critic updates: We maintain slowly updated target critics via Polyak–Ruppert averaging  Polyak and Juditsky ( 1992 ) , which smooths bootstrap targets, reduces the variance and oscillation of TD errors, and makes the pessimistic critic ensemble more stable.

• Dual-timescale KL tracking: Short- and long-horizon moving averages of KL divergence provide reliable diagnostic signals for the controllers, separating transient batch noise from genuine distributional drift and enabling more calibrated adjustments of KL penalties.

5

Training Algorithm

Algorithm 4 SAFE Training Step

0:  Policy π θ \pi_{\theta} , reference policy π ref \pi_{\text{ref}} , critics V 1 , V 2 V_{1},V_{2} , target critics V 1 ′ , V 2 ′ V_{1}^{\prime},V_{2}^{\prime} , reward model R R

1:  Sample batch of prompts { x i } {x_{i}}

2:  Generate responses y i ∼ π θ ( ⋅ | x i ) y_{i}\sim\pi_{\theta}(\cdot|x_{i})

3:  Compute rewards r i = R ​ ( x i , y i ) r_{i}=R(x_{i},y_{i})

4:  Normalize rewards r ~ i \tilde{r}_{i}

5:  Compute policy entropy H ​ ( π θ ) H(\pi_{\theta})

6:  Evaluate critics V 1 ​ ( s i ) , V 2 ​ ( s i ) V_{1}(s_{i}),V_{2}(s_{i})

7:  Compute pessimistic value:

   V  soft   ​   (   s  i   )    =   SoftMin  ​   (    V  1   ​   (   s  i   )    ,    V  2   ​   (   s  i   )    )     V_{\text{soft}}(s_{i})=\text{SoftMin}(V_{1}(s_{i}),V_{2}(s_{i}))    

8:  Compute advantages:

  A  i   =     r  ~   i   −    V  soft   ​   (   s  i   )      A_{i}=\tilde{r}_{i}-V_{\text{soft}}(s_{i})    

9:  Standardize advantages A ^ i \hat{A}_{i}

10:   for each PPO epoch do

11:   Compute importance ratio ρ i \rho_{i}

12:   Compute clipped PPO loss L PPO L_{\text{PPO}}

13:   Compute log-ratio estimate:

  D  ^   =   𝔼  ​   [     log  ⁡   π  θ    ​   (   a  |  s   )    −    log  ⁡   π  ref    ​   (   a  |  s   )     ]     \hat{D}=\mathbb{E}[\log\pi_{\theta}(a|s)-\log\pi_{\text{ref}}(a|s)]    

14:   Update PID controller using reward velocity

15:   Compute adaptive KL threshold τ t \tau_{t}

16:   Compute entropy-gated KL penalty L KL L_{\text{KL}}

17:   Compute clipped Huber value loss L value L_{\text{value}}

18:   Update policy and critic parameters using:

  L  total   =     L  PPO   +   0.5  ​   L  value    +   L  KL    −   β  ​  H  ​   (   π  θ   )      L_{\text{total}}=L_{\text{PPO}}+0.5L_{\text{value}}+L_{\text{KL}}-\beta H(\pi_{\theta})    

19:   Apply gradient norm clipping

20:   end for

21:  Update target critics via Polyak averaging:

  θ  ′   ←     (   1  −  τ   )   ​   θ  ′    +   τ  ​  θ     \theta^{\prime}\leftarrow(1-\tau)\theta^{\prime}+\tau\theta    

6

Overall Objective Function SAFE optimizes a composite loss balancing policy improvement, value learning, divergence control, and exploration:

L total = L PPO + 0.5 ​ L Huber + L KL − β ​ H ​ ( π θ ) . L_{\text{total}}=L_{\text{PPO}}+0.5L_{\text{Huber}}+L_{\text{KL}}-\beta H(\pi_{\theta}).

(33)

PPO Policy Loss.

The clipped surrogate objective  Schulman et al. ( 2017 ) :

   L  PPO   =   −   𝔼  ​   [    min   ⁡   (    ρ  t   ​    A  ^   t    ,   clip  ​   (   ρ  t   ,   1  −  ϵ   ,   1  +  ϵ   )   ​    A  ^   t    )    ]      ,   L_{\text{PPO}}=-\mathbb{E}\left[\min\!\left(\rho_{t}\hat{A}_{t},\,\text{clip}(\rho_{t},1-\epsilon,1+\epsilon)\hat{A}_{t}\right)\right],    

(34)

with importance ratio ρ t = π θ ​ ( a t ∣ s t ) / π old ​ ( a t ∣ s t ) \rho_{t}=\pi_{\theta}(a_{t}\mid s_{t})/\pi_{\text{old}}(a_{t}\mid s_{t}) and advantage A ^ t \hat{A}_{t} from the pessimistic soft-min critic.

Value Loss.

Clipped Huber regression  Huber ( 1964 ) for robust critic learning:

   L  Huber   =     1  2    ​   [     Huber  δ   ​   (   V  soft   ,   r  ~   )    +    Huber  δ   ​   (   V  clip   ,   r  ~   )     ]     ,   L_{\text{Huber}}=\tfrac{1}{2}\left[\text{Huber}_{\delta}(V_{\text{soft}},\tilde{r})+\text{Huber}_{\delta}(V_{\text{clip}},\tilde{r})\right],    

(35)

which caps gradient magnitude from reward-model outliers.

KL Penalty.

Entropy-gated, adaptively thresholded divergence control (Section  4.3 ):

  L  KL   =   {      0  ,         D  ¯   t   ≤   τ  t    ,          λ  ​    (     D  ¯   t   −   τ  t    )   2    ⋅    max   ⁡   (  0.5  ,     H  floor     H  ​   (   π  θ   )    +  ϵ     )     ,      otherwise  ,        L_{\text{KL}}=\begin{cases}0,&\bar{D}_{t}\leq\tau_{t},\\

\lambda(\bar{D}{t}-\tau{t})^{2}\cdot\max!\left(0.5,\frac{H_{\text{floor}}}{H(\pi_{\theta})+\epsilon}\right),&\text{otherwise},\end{cases}

(36)

with PID-adjusted threshold τ t \tau_{t} and entropy-dependent scaling.

Entropy Bonus.

Standard term − β ​ H ​ ( π θ ) -\beta H(\pi_{\theta}) maintains baseline exploration.

This objective extends PPO with pessimistic value aggregation, Huber-based robustness, and adaptive entropy-aware KL control for stable long-horizon RLHF.

7

Experiments

7.1

Experimental Setup We evaluate SAFE using a custom RLHF training pipeline implementing the proposed entropy-aware predictive control and pessimistic value estimation components. All methods are trained under identical computational budgets, datasets, and optimization settings to ensure fair comparison.

Policy Model.

We fine-tune the Qwen/Qwen2.5-3B Qwen Team ( 2024 ) causal language model using parameter-efficient LoRA adaptation. LoRA is applied to attention and feed-forward projection layers with rank r = 128 r=128 and scaling factor α = 128 \alpha=128 . Only adapter parameters are updated during training.

Reference Policy.

A frozen copy of the base model is maintained as the reference policy for KL regularization throughout training.

Reward Model.

Preference supervision is provided by the pretrained RLHFlow/ArmoRM-Llama3-8B-v0.1 reward model, which outputs scalar quality scores for generated responses. Reward model inference is performed in evaluation mode without gradient updates.

Dataset.

Experiments are conducted on the Anthropic/hh-rlhf RLHFlow Contributors ( 2024 ) dataset. We use 5,000 prompt samples for training and 500 held-out samples for evaluation. Prompts are extracted by truncating assistant responses and retaining the conversational context prefix.

Optimization Configuration.

Training is performed for 2,000 on-policy update steps using batch size 16 and gradient accumulation factor 2. Policy and critic learning rates are synchronized at 1 × 10 − 5 1\times 10^{-5} . PPO clipping thresholds are set to ϵ = 0.2 \epsilon=0.2 for policy updates and value function clipping.

Gradient norms are clipped to 1.0 for the policy network and 0.5 for the critic to improve numerical stability.

Figure 2:
Training dynamics of SAFE. Top row: reward trajectory, KL divergence with adaptive threshold, and value loss. Bottom row: policy entropy with entropy floor, completion length, and smoothed reward. The controller maintains entropy above the configured floor while dynamically regulating KL magnitude.

Stabilization Components.

SAFE incorporates the following stabilization mechanisms:

•

Double soft-min critic with Layer Normalization,

• Entropy-aware KL penalty with entropy floor H floor = 2.0 H_{\text{floor}}=2.0 ,

• PID-controlled adaptive KL threshold,

• Phase-aware threshold modulation,

• Preview-based KL step scaling with ceiling κ max = 0.5 \kappa_{\max}=0.5 .

All experiments use identical hardware environments and random seed initialization protocols where applicable.

7.2

Overall Performance Table  2 reports aggregate performance statistics over 2,000 training steps.

Table 2: Overall training statistics averaged across the full training run.

Metric SAFE PPO

Mean Reward 0.7249 0.6894

Reward Std 0.0291 0.0788

Final Reward (last 50) 0.7287 0.7259

Mean KL 0.1729 0.1313

Mean Value Loss 0.0582 0.0059

Mean Completion Length 127.3 123.8

SAFE achieves a higher average reward compared to PPO while maintaining comparable KL divergence magnitude. In addition, reward variance is substantially reduced, indicating more stable optimization behavior across training iterations.

7.3

Training Stability Analysis We evaluate training stability using rolling statistics and event-based indicators.

Figure 3:
Training dynamics and stability comparison between SAFE and PPO. Top row: Reward trajectory with confidence intervals, KL divergence with adaptive thresholds, and value function loss. Middle row: Reward distribution, KL distribution, and completion length evolution. Bottom row: Reward–KL trade-off scatter, cumulative reward accumulation, rolling reward stability, reward box plots, KL box plots, and batch-level reward variance. SAFE exhibits tighter reward confidence bands, improved reward stability, controlled KL excursions, and smoother cumulative reward growth compared to PPO, indicating improved robustness under long-horizon RLHF optimization.

Reward Stability.

The coefficient of variation of reward decreases from 0.114 0.114 under PPO to 0.040 0.040 under SAFE. Rolling reward standard deviation is reduced from 0.0208 0.0208 to 0.0123 0.0123 .

Furthermore, PPO exhibits two reward collapse events, defined as drops exceeding 20% relative to recent averages, while no such events are observed for SAFE.

KL Stability.

Although average KL divergence remains similar across methods, SAFE exhibits lower KL volatility (rolling standard deviation 0.306 0.306 versus 0.526 0.526 for PPO). This indicates that the adaptive threshold mechanism constrains large divergence excursions while allowing moderate exploratory deviations.

Value Learning Dynamics.

The critic loss in SAFE remains bounded with a final value loss of 0.0075 0.0075 . While PPO achieves lower absolute value loss, SAFE exhibits smoother temporal behavior with fewer abrupt spikes, consistent with the use of pessimistic aggregation and Polyak target updates.

7.4

Convergence Behavior To analyze convergence dynamics, training is partitioned into early (0–33%), mid (33–66%), and late (66–100%) phases.

•

SAFE increases average reward from 0.711 in the early phase to 0.731 in the late phase.

• PPO exhibits larger early-stage reward gains but maintains higher variability throughout training.

• KL divergence under SAFE trends downward across phases, whereas PPO exhibits increasing divergence during later stages.

Both methods satisfy a convergence criterion defined as rolling reward standard deviation below 0.05 during the final 100 training steps.

7.5

Statistical Significance We evaluate statistical significance using step-level reward distributions.

Reward Comparison.

Welch’s t-test yields t = 18.90 t=18.90 with p

KL Comparison.

Differences in KL divergence are not statistically significant ( p = 0.10 p=0.10 ), suggesting that reward improvements are not primarily driven by increased policy drift.

Table 3: Comparison of SAFE variants and PPO over 2,000 training steps. Higher reward is better. Lower variance, value loss spikes, and reward crashes indicate improved stability.

Metric
PPO
Asymmetric-KL
SAFE

Mean Reward 0.689 0.672 0.725

Final Reward (last 50) 0.726 0.714 0.729

Peak Reward 0.748 0.747 0.748

Reward Std (global) 0.079 0.054 0.029

Reward Coefficient of Variation 0.114 0.081 0.040

Reward Volatility (rolling std) 0.0208 0.0343 0.0123

Reward Crashes ( > > 20%) 2 2 0

Mean KL Divergence 0.131 -0.241
-0.053

Final KL Divergence 0.692 -0.349
-0.054

KL Std 0.869 0.661 0.744

KL Volatility (rolling std) 0.526 0.294 0.306

KL Trend (early → \rightarrow late) +0.70 -1.07 -1.30

Mean Value Loss 0.0059
0.226 0.058

Final Value Loss (last 50) 0.0009
0.114 0.0075

Value Loss Spikes ( > > 0.1) 28
1256 435

Mean Completion Length 123.8 119.4 127.3

Completion Length Std 12.6 9.7 3.1

Converged (last 100 steps) Yes Yes Yes

Late-stage Regression No Yes
No

7.6

Qualitative Training Dynamics Figure  3 illustrates representative training trajectories. The entropy-aware controller maintains entropy above the configured floor throughout training. Completion lengths stabilize earlier, and reward curves exhibit reduced oscillatory behavior relative to PPO.

The adaptive KL threshold dynamically tracks training phases, tightening during plateau periods and relaxing during early exploration, consistent with the controller design.

7.7

Discussion These results indicate that combining pessimistic value estimation with entropy-aware predictive KL regulation improves training robustness and reduces instability under long-horizon RLHF optimization. Importantly, these improvements are achieved without substantially increasing average KL divergence.

We emphasize that the reported gains reflect behavior on a single benchmark and training configuration. Further evaluation is required to assess generalization across tasks and model scales.

7.8

GPU Memory and Performance Overhead To assess the computational cost of the additional control logic in SAFE, we tracked GPU memory usage and wall-clock time for both SAFE and PPO over the full 2,000-step run (Figure  4 ). Table  4 summarizes the key metrics.

Figure 4: GPU memory and runtime comparison between SAFE and PPO. Left: GPU peak memory usage per training step over 2,000 iterations. Both methods exhibit similar memory profiles with comparable peak allocations ( ∼ \sim 54 GB). Center: Wall-clock time per training step. SAFE maintains slightly faster step times with reduced variance, indicating that the additional control logic does not introduce computational bottlenecks. Right: Summary comparison of initialization memory, peak memory, and average step time. SAFE achieves near-identical resource usage with − 0.9 % -0.9% memory overhead and − 1.4 % -1.4% time overhead, demonstrating that the multi-layer stabilization framework is computationally efficient.

Memory Usage.

Initial memory footprints after model load and trainer initialization are effectively identical (SAFE: 12.69 GB vs. PPO: 12.80 GB). Peak memory during training reaches 54.05 GB for SAFE and 54.04 GB for PPO, a negligible difference of +6 MB. Average per-step allocated memory is similarly matched (15,554 MB vs. 15,569 MB). Overall, SAFE incurs a net memory overhead of approximately − 0.9 % -0.9% , indicating that the additional critics and control statistics do not materially increase GPU usage.

Runtime.

SAFE completes training in 1,951.7 s compared to 1,980.1 s for PPO, a reduction of 28.4 s over 2,000 steps. The average step time is 3.90 s for SAFE versus 3.96 s for PPO, corresponding to throughputs of 15.4 and 15.2 steps per minute, respectively. This translates to an effective time overhead of − 1.4 % -1.4% , i.e., the additional controller logic does not slow training and may even slightly improve runtime due to smoother dynamics and fewer large, destabilizing updates.

Table 4: GPU memory and timing overhead comparison between SAFE and PPO.

Metric
SAFE
PPO
Δ \Delta

Memory Usage (MB)

   After Model Load 12,687 12,803 − 116 -116

   After Trainer Init 12,696 12,805 − 109 -109

   Peak During Training 54,050 54,044 + 6 +6

   Avg Per-Step Allocated 15,554 15,569 − 15 -15

Timing (seconds)

   Total Training Time 1,951.7 1,980.1 − 28.4 -28.4

   Avg Step Time 3.90 3.96 − 0.06 -0.06

   Throughput (steps/min) 15.4 15.2 + 0.2 +0.2

Overhead Summary

   Memory Overhead − 0.9 % -0.9%

   Time Overhead − 1.4 % -1.4%

Conclusion.

Across both memory and runtime metrics, SAFE behaves as a drop-in replacement for PPO from a hardware perspective: the multi-layer stabilization framework adds negligible GPU cost while providing the stability benefits described in the preceding sections.

8

Experimental Analysis This section analyzes the empirical behavior of SAFE under the Entropy-Aware Predictive Controller using the metrics and training traces described in the previous section. We focus on reward progression, stability characteristics, divergence control, and interaction between entropy and KL regulation.

8.1

Reward Learning Dynamics Figure  3 shows the evolution of batch reward and smoothed reward over training. SAFE exhibits rapid early improvement during the warmup phase followed by gradual stabilization.

Across the full training run, the average reward reaches 0.7249, compared to 0.6894 for PPO. More importantly, reward variance is substantially lower under SAFE (standard deviation 0.0291 versus 0.0788). This indicates that the controller primarily contributes to reducing training noise rather than simply increasing peak reward.

Smoothed reward trajectories further show reduced oscillatory behavior, suggesting improved stability during late-stage optimization.

8.2

KL Divergence Behavior The adaptive KL controller maintains divergence within a bounded operating region while allowing moderate exploratory fluctuations. Although the mean KL magnitude remains comparable to PPO, KL volatility is reduced by approximately 42% (rolling standard deviation 0.306 versus 0.526).

The dynamic threshold adapts over time in response to reward trends and phase transitions. During early training, relaxed thresholds permit exploration, while tighter thresholds are applied during plateau regions to constrain excessive drift. This behavior is consistent with the controller design objective of regulating divergence without enforcing a fixed KL target.

8.3

Entropy Regulation and Exploration Stability Policy entropy remains consistently above the configured entropy floor throughout training. Rather than enforcing a fixed entropy bonus, the entropy-aware gating mechanism selectively amplifies KL penalties when entropy decreases.

This interaction allows entropy to decay gradually instead of collapsing abruptly. As a result, completion length stabilizes earlier and remains more consistent across training steps, indicating controlled policy determinization.

Importantly, entropy stabilization is achieved without introducing additional explicit entropy maximization terms beyond the standard PPO entropy coefficient.

8.4

Value Function Stability The double critic with soft-min aggregation produces bounded value loss throughout training. Although absolute value loss remains higher than PPO, SAFE exhibits smoother temporal behavior with fewer abrupt divergence events.

The use of Layer Normalization and Polyak target updates contributes to stabilizing bootstrap targets, while pessimistic aggregation reduces optimistic bias in advantage estimation. These effects are reflected in reduced reward volatility and improved convergence consistency.

8.5

Phase-Aware Control Behavior The phase detector identifies transitions between warmup, climbing, plateau, and convergence regimes. During climbing phases, thresholds are relaxed to accommodate reward improvement. During plateau phases, stricter constraints are applied to limit unnecessary policy drift.

This adaptive modulation allows the controller to adjust its behavior according to training dynamics rather than relying on static scheduling rules.

8.6

Statistical Reliability Statistical testing confirms that reward improvements are unlikely to arise from random fluctuations. Welch’s t-test and Mann–Whitney U test both reject the null hypothesis of equal reward distributions with p
In contrast, KL divergence differences are not statistically significant ( p = 0.10 p=0.10 ), suggesting that performance gains are primarily associated with improved stability rather than increased divergence.

8.7

Failure Modes and Limitations Despite improved stability, several limitations are observed. Value loss remains higher relative to PPO, reflecting the conservative bias introduced by pessimistic aggregation. Additionally, while reward volatility is reduced, KL spike frequency remains non-negligible, indicating that further smoothing of short-term divergence dynamics may be beneficial.

These observations motivate future work on controller smoothing strategies and alternative critic regularization methods.

8.8

Summary of Findings Overall, the experimental results indicate that SAFE improves training stability by jointly regulating divergence, entropy dynamics, and value estimation behavior. The primary benefit arises from reduced reward volatility and more consistent convergence patterns rather than aggressive reward maximization.

These findings support the use of adaptive control mechanisms as complementary stabilization tools within RLHF training pipelines.

9

Conclusion We presented SAFE, a multi-layer RLHF stabilization framework combining pessimistic value estimation, entropy-gated KL control, and PID-based adaptive thresholds. Experiments on a 3B model show SAFE eliminates catastrophic collapses and reduces reward variance by 2.8× compared to PPO, with a statistically significant 5.2% reward improvement. These results suggest that coordinated control across value, divergence, and temporal dynamics can improve training stability.

However, important limitations remain. Value loss spikes persist (435 events vs PPO’s 28), the method requires manual tuning of 8+ hyperparameters without systematic ablation, and evaluation is restricted to one model size, dataset, and reward model over 2,000 steps. Generalization beyond this setting is unproven. We can only hypothesize that the SAFE is more robust to reward hacking from the theoretical viewpoint, but we need proper empirical evidence to prove that.

SAFE demonstrates that layered control mechanisms can reduce instability in a specific experimental configuration, which is a useful contribution to RLHF research. But broader claims about production readiness or general applicability require validation across multiple scales, tasks, and longer training horizons. Future work should prioritize systematic ablations, automated hyperparameter tuning, and multi-scale evaluation before deployment.

10

Limitations While SAFE demonstrates improved stability over PPO, several limitations constrain generalizability:

Experimental Scope.

•

Single scale: Evaluated only at 3B parameters; scaling behavior at 7B+ untested.

• Short horizon: Limited to 2,000 steps; late-stage dynamics beyond 5,000+ steps unknown.

• Single dataset/reward model: Anthropic HH-RLHF and ArmoRM-Llama3-8B only; generalization to other domains unvalidated.

Methodological Gaps.

•

Value instability persists: 435 value loss spikes vs PPO’s 28, indicating soft-min introduces bias without eliminating instability.

• Manual tuning: 8+ hyperparameters (entropy floor, PID gains, phase thresholds) lack systematic ablation or sensitivity analysis.

• No component isolation: Relative contribution of pessimistic critics, entropy gating, and PID control unclear.

Future work requires multi-scale evaluation (1B–70B), long-horizon experiments (10,000+ steps), systematic ablations, automated hyperparameter tuning, diverse task validation, and direct reward hacking tests.

References

D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and D. Mané (2016) Concrete problems in ai safety .

arXiv preprint arXiv:1606.06565 .

Cited by: Appendix A .

K. J. Åström and R. M. Murray (2008) Feedback systems: an introduction for scientists and engineers .

Princeton University Press .

Cited by: §3.2 .

Y. Bai, A. Jones, K. Ndousse, A. Askell, A. Chen, N. DasSarma, D. Drain, S. Fort, D. Ganguli, T. Henighan, N. Joseph, S. Kadavath, J. Kernion, T. Conerly, S. El-Showk, N. Elhage, Z. Hatfield-Dodds, D. Hernandez, T. Hume, S. Johnston, S. Kravec, L. Lovitt, N. Nanda, C. Olsson, D. Amodei, T. Brown, J. Clark, S. McCandlish, C. Olah, B. Mann, and J. Kaplan (2022) Training a helpful and harmless assistant with reinforcement learning from human feedback .

External Links: 2204.05862 , Link

Cited by: §1 , §2.2 .

P. Christiano, J. Leike, T. B. Brown, M. Martic, S. Legg, and D. Amodei (2023) Deep reinforcement learning from human preferences .

External Links: 1706.03741 , Link

Cited by: §1 .

S. Fujimoto, H. Hoof, and D. Meger (2018) Addressing function approximation error in actor-critic methods .

In International Conference on Machine Learning ,

pp. 1587–1596 .

Cited by: §2.3 , §2.3 .

M. Geist, B. Scherrer, and O. Pietquin (2019) A theory of regularized markov decision processes .

Proceedings of the 36th International Conference on Machine Learning (ICML) 97 , pp. 2160–2169 .

Cited by: §2.4 .

T. Haarnoja, A. Zhou, P. Abbeel, and S. Levine (2018a) Soft actor-critic: off-policy maximum entropy deep reinforcement learning with a stochastic actor .

In Proceedings of the 35th International Conference on Machine Learning (ICML) ,

Vol. 80 , pp. 1861–1870 .

Cited by: §2.4 , 3rd item .

T. Haarnoja, A. Zhou, P. Abbeel, and S. Levine (2018b) Soft actor-critic: off-policy maximum entropy deep reinforcement learning with a stochastic actor .

External Links: 1801.01290 , Link

Cited by: §2.4 .

P. J. Huber (1964) Robust estimation of a location parameter .

The Annals of Mathematical Statistics 35 ( 1 ), pp. 73–101 .

Cited by: §4.7 , §6 .

O. Nachum, M. Norouzi, K. Xu, and D. Schuurmans (2017) Bridging the gap between value and policy based reinforcement learning .

In Advances in Neural Information Processing Systems ,

Vol. 30 .

Cited by: §2.4 .

G. Neu, A. Jonsson, and A. Gómez (2017) A unified view of entropy-regularized markov decision processes .

In Proceedings of the European Workshop on Reinforcement Learning (EWRL) ,

Cited by: §2.4 .

L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. Miller, M. Simens, A. Askell, P. Welinder, P. Christiano, J. Leike, and R. Lowe (2022) Training language models to follow instructions with human feedback .

External Links: 2203.02155 , Link

Cited by: §1 , §2.1 , §2.2 , §2.2 .

R. Pascanu, T. Mikolov, and Y. Bengio (2013) On the difficulty of training recurrent neural networks .

In Proceedings of the 30th International Conference on Machine Learning (ICML) ,

pp. 1310–1318 .

Cited by: 1st item .

B. T. Polyak and A. B. Juditsky (1992) Acceleration of stochastic approximation by averaging .

SIAM Journal on Control and Optimization 30 ( 4 ), pp. 838–855 .

Cited by: 4th item .

Qwen Team (2024) Qwen2.5 technical report .

Note: arXiv preprint arXiv:2412.15115Available at https://arxiv.org/abs/2412.15115

Cited by: §7.1 .

RLHFlow Contributors (2024) ArmoRM-llama3-8b-v0.1 .

Note: https://huggingface.co/RLHFlow/ArmoRM-Llama3-8B-v0.1 Reward model used for SAFE experiments

Cited by: §7.1 .

J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov (2017) Proximal policy optimization algorithms .

External Links: 1707.06347 , Link

Cited by: §1 , 1st item , §6 .

J. Skalse, N. H. R. Howe, D. Krasheninnikov, and D. Krueger (2022) Defining and characterizing reward hacking .

arXiv preprint arXiv:2209.13085 .

Cited by: Appendix A .

H. Van Hasselt (2010) Double q-learning .

Advances in Neural Information Processing Systems 23 .

Cited by: §2.3 , §3 .

Appendix A

Theoretical Analysis: Hypothesized Reward Hacking Resistance Reward hacking occurs when a policy exploits spurious features of the learned reward model (e.g., length bonuses, keyword artifacts) instead of improving alignment with true human preferences  Amodei et al. [ 2016 ], Skalse et al. [ 2022 ] . In this work, we do not directly evaluate SAFE on deliberately hackable reward models. The discussion in this section is therefore purely theoretical and should be interpreted as a hypothesis , not as empirical evidence of robustness.

Mechanism 1: Pessimistic Value Estimation Suppresses Exploitation Spikes.

The double soft-min critic (Section  3.1 ) computes value estimates as

    V  soft   ​   (  s  )    =   −   α  ​   log  ⁡   [     1  2    ​   (    e   −     V  1   ​   (  s  )    /  α     +   e   −     V  2   ​   (  s  )    /  α      )    ]       ,   V_{\text{soft}}(s)=-\alpha\log\left[\tfrac{1}{2}\left(e^{-V_{1}(s)/\alpha}+e^{-V_{2}(s)/\alpha}\right)\right],    

which introduces a systematic negative (pessimistic) bias. Reward hacking typically manifests as high-variance, high-reward outliers when the policy discovers an exploit. The pessimistic aggregation reduces the estimated value of such outliers, making them appear less attractive during advantage computation. Consequently, policy updates are less likely to chase these exploitation spikes than under a single, potentially overestimating critic.

Mechanism 2: Directional KL Control Detects Exploitative Drift.

Section  2.2 shows that sustained positive log-ratio estimates combined with decreasing entropy often precede exploitative behavior. SAFE’s asymmetric KL component (Section  3.1 ) penalizes positive deviations quadratically when D ^ KL > τ \hat{D}{\mathrm{KL}}>\tau while imposing zero penalty on negative estimates. Since reward hacking involves shifting probability mass toward exploit patterns that depart from the reference distribution, such directional control may intervene earlier than symmetric penalties. The momentum term m t = ( D ^ KL ( t ) − D ^ KL ( t − w ) ) / w m{t}=(\hat{D}^{(t)}{\mathrm{KL}}-\hat{D}^{(t-w)}{\mathrm{KL}})/w
further responds to accelerating divergence, potentially catching the onset of exploitation before catastrophic drift occurs.

Mechanism 3: Entropy-Gated Penalties Suppress Low-Entropy Exploitation.

The entropy-gated penalty (Equation ( 15 )) scales the KL loss by

   g  t   =    max   ⁡   (  0.5  ,    H  floor     H  ​   (   π  θ   )    +  ε    )     ,   g_{t}=\max\!\left(0.5,\frac{H_{\mathrm{floor}}}{H(\pi_{\theta})+\varepsilon}\right),    

amplifying penalties when the policy entropy H ​ ( π θ ) H(\pi_{\theta}) decreases. Many reward-hacking strategies (e.g., keyword stuffing, repetitive templates, extreme length manipulation) correspond to low-entropy, highly deterministic behavior. By increasing penalty strength precisely when entropy collapses, SAFE applies stronger corrective pressure in regimes most associated with exploitation, while allowing relatively unpenalized exploration when entropy remains high.

Mechanism 4: Tighter Distributional Anchoring.

Compared to PPO, SAFE maintains lower KL volatility and keeps the policy closer to the supervised reference throughout training (Table  2 ). Because the reference policy has never been optimized against the reward model, it is less likely to have learned exploitative patterns. By constraining distributional drift around this reference, SAFE may reduce the policy’s capacity to discover and exploit reward model artifacts that lie far from the supervised training distribution.

Theoretical Prediction and Caveats.

Taken together, these mechanisms suggest that SAFE may provide partial resistance to reward hacking by: (1) reducing the attractiveness of high-variance exploits via pessimistic values, (2) detecting exploitative drift earlier through directional KL and momentum signals, (3) suppressing deterministic exploitation via entropy-gated penalties, and (4) constraining search to regions closer to the reference policy. However, this analysis is entirely mechanistic and does not constitute empirical validation. SAFE does not address the fundamental mismatch between the learned reward model r ​ ( x , y ) r(x,y) and the true preference function. At best, it may slow or redirect exploitation, but it cannot eliminate reward hacking without improving reward model fidelity.

A rigorous assessment of SAFE’s reward-hacking behavior requires dedicated experiments with explicitly hackable reward functions, adversarial and out-of-distribution prompts, and long training horizons. Designing and running such evaluations are an important direction for future work and is beyond the scope of the present study.