SafeCRS: Personalized Safety Alignment for LLM-Based Conversational Recommender Systems

Haochang Hao; Yifan Xu; Xinzhuo Li; Yingqiang Ge; Lu Cheng

cs.CLMar 3, 2026

SafeCRS: Personalized Safety Alignment for LLM-Based Conversational Recommender Systems

Authors: Haochang Hao, Yifan Xu, Xinzhuo Li, Yingqiang Ge, Lu Cheng

Organizations: University of Illinois at Chicago Chicago, IL, USA · University of Notre Dame South Bend, IN, USA · Amazon Santa Clara, CA, USA

Abstract

Current LLM-based conversational recommender systems (CRS) primarily optimize recommendation accuracy and user satisfaction. We identify an underexplored vulnerability in which recommendation outputs may negatively impact users by violating personalized safety constraints, when individualized safety sensitivities -- such as trauma triggers, self-harm history, or phobias -- are implicitly inferred from the conversation but not respected during recommendation. We formalize this challenge as personalized CRS safety and introduce SafeRec, a new benchmark dataset designed to systematically evaluate safety risks in LLM-based CRS under user-specific constraints. To further address this problem, we propose SafeCRS, a safety-aware training framework that integrates Safe Supervised Fine-Tuning (Safe-SFT) with Safe Group reward-Decoupled Normalization Policy Optimization (Safe-GDPO) to jointly optimize recommendation quality and personalized safety alignment. Extensive experiments on SafeRec demonstrate that SafeCRS reduces safety violation rates by up to 96.5% relative to the strongest recommendation-quality baseline while maintaining competitive recommendation quality. Warning: This paper contains potentially harmful and offensive content.

Figures & tables

Figure 1. Examples of Personal-unsafe Recommendation. For a kid afraid of firearms and violence, Resident Evil satisfies the recommendation requirements, though it may violate the user’s safety concerns. In this case, Coraline is a safer and better recommendation.

Figure 2. Overview of the SafeRec benchmark generation pipeline. We construct a ground-truth dataset for safety evaluation by integrating SafeMovie and SafeGame safety parts with conversations. The pipeline fuses domain-specific safety descriptors with user sensitivity traits extracted from Reddit, utilizing a continuous risk scoring mechanism to rigorously quantify recommendation safety. A framework diagram showing the SafeCRS system: benchmark construction from DDD and IPG data sources through a Safety Knowledge Base, integration with REDDIT-V2 conversational data, and a two-stage training pipeline consisting of Safe-SFT with safety reasoning supervision and Safe-GDPO with per-rank reward decomposition.

Figure 3. Two-stage training pipeline. Stage 1 (Safe-SFT) trains the model to produce a safety reasoning block that identifies and filters unsafe items, followed by a safe recommendation list. Stage 2 (Safe-GDPO) samples multiple ranked completions and applies per-rank reward decomposition, combining relevance rewards with safety penalties from a plug-in Safety Oracle, to update the policy via group-normalized advantages. A framework diagram showing the SafeCRS training system: a two-stage training pipeline consisting of Safe-SFT with safety reasoning supervision and Safe-GDPO with per-rank reward decomposition.

Traditional CRS
Method	Recall $\uparrow$		NDCG $\uparrow$		SVR $\downarrow$		S-DCG $\downarrow$		Recall $\uparrow$		NDCG $\uparrow$		SVR $\downarrow$		S-DCG $\downarrow$
Method	@5	@10	@5	@10	@5	@10	@5	@10	@5	@10	@5	@10	@5	@10	@5	@10
KBRD	.0115	.0135	.0090	.0097	.3752	.3756	1.11	1.62	-	-	-	-	-	-	-	-
NBCRS	.0451	.0766	.0312	.0420	.5380	.5083	1.64	2.40	-	-	-	-	-	-	-	-
CRAG (Collaborative Retrieval + Closed-source LLM)
CRAG (GPT-4o)	.0826	.1217	.0581	.0715	.4007	.3894	1.20	1.80	.0422	.0422	.0833	.0833	.0664	.0655	0.20	0.26

Table 1. Main results on the SafeMovie (left) and SafeGame (right) benchmarks.

\uparrow

: higher is better;

\downarrow

: lower is better. Best results are in bold and second-best are underlined . KBRD and NBCRS are closed-vocabulary models restricted to fixed movie catalogs and cannot generalize to the game domain. The left part of the table reports results on SafeMovie , while the right part reports results on SafeGame .

Figure 4. Safety–relevance trade-off across all methods on SafeRec

Backbone	Training Stage	Recall $\uparrow$		NDCG $\uparrow$		SVR $\downarrow$		S-DCG $\downarrow$
Backbone	Training Stage	@5	@10	@5	@10	@5	@10	@5	@10
Qwen2.5-0.5B	Zero-shot	.0008	.0008	.0005	.0005	.0562	.0503	0.14	0.16
	+ Safe-SFT	.0467	.0732	.0333	.0422	.0177	.0133	0.54	0.68
	+ Safe-GDPO	.0732	.0922	.0547	.0597	.0011	.0006	0.32	0.35
Qwen3-8B	Zero-shot	.0182	.0265	.0127	.0154	.1253	.1135	0.32	0.46
	+ Safe-SFT	.0687	.0918	.0506	.0588	.0135	.0089	0.043	0.049

Table 2. Ablation study on SafeMovie . For each backbone model, we compare the zero-shot baseline, Safe-SFT only, and the full SafeCRS pipeline (Safe-SFT + Safe-GDPO). Metrics follow the same notation as Table 1 .

Metric	Value
SafeRec – constraint naturalness (1–5)	4.44
SafeRec – retained GT respects constraint	74%
SafeRec – assigned trait fits user	93.3%
SafeCRS -Qwen2.5-0.5B – human-eval violation rate@10 $\downarrow$	.0043
SafeCRS -Qwen3-8B – human-eval violation rate@10 $\downarrow$	.0041

Table 3. Human evaluation results. The top three rows audit the SafeRec construction pipeline (

n=50

); the bottom two rows audit human-perceived safety of SafeCRS recommendations on top-

10

outputs (

n=150

Backbone	Training Stage	Recall $\uparrow$		NDCG $\uparrow$		SVR $\downarrow$		S-DCG $\downarrow$
Backbone	Training Stage	@5	@10	@5	@10	@5	@10	@5	@10
Qwen2.5-0.5B	Zero-shot	.0032	.0048	.0065	.0072	.0188	.0132	0.07	0.09
	+ Safe-SFT	.1162	.1206	.1635	.1688	.1017	.1056	0.19	0.19
	+ Safe-GDPO	.1542	.1789	.1884	.1902	.0774	.0792	0.11	0.12
Qwen3-8B	Zero-shot	.0140	.0141	.0174	.0173	.0085	.0086	0.02	0.04
	+ Safe-SFT	.2205	.2219	.2916	.2928	.0305	.0316	0.04	0.04

Table 4. Ablation study on SafeGame . For each backbone, we compare the zero-shot baseline, Safe-SFT only, and the full SafeCRS pipeline (Safe-SFT + Safe-GDPO). Metrics follow the same notation as Table 1 .

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Explicit trait	%	Explicit trait	%
Happy-ending preference	43.64	Medical/health trauma avoider	0.87
Horror avoider	15.20	Self-harm & suicide sensitive	0.82
Mental health portrayal sensitive	10.07	Photosensitivity & motion sickness	0.75
Avoid torture & extreme violence	9.15	Animal lover (animal harm/death)	0.50
Disaster/accident avoider	5.07	Domestic abuse / stalking	0.50
Anti-gore / squeamish	4.83	Hate speech / slur-sensitive	0.48

Appendix

Table 5. Distribution of explicit user traits in SafeMovie .

Threshold $\tau$				Reward weight $w_{\text{safe}}$
$\tau$	R@10	N@10	SVR@10	$w_{\text{safe}}$	R@10	N@10	SVR@10
0.50	.1075	.0706	.0050	0.5	.1118	.0740	.0110
0.66	.1111	.0737	.0087	1.0	.1111	.0737	.0087
0.80	.1132	.0749	.0130	2.0	.1095	.0728	.0060

Appendix

Table 6. Hyperparameter sensitivity on SafeMovie (Llama-3.1-8B). Left: unsafe-item threshold

\tau

(same value for training and evaluation). Right: safety reward weight

w_{\text{safe}}

. Both trace smooth, non-brittle safety–relevance trade-offs around our defaults (

\tau=0.66

w_{\text{safe}}=1.0

Model	Recall@10 $\uparrow$	NDCG@10 $\uparrow$	SVR@10 $\downarrow$	Coverage@10 $\uparrow$
SafeCRS-Qwen2.5-0.5B	.0922	.0597	.0006	.9174
SafeCRS-Qwen3-8B	.0951	.0614	.0022	.9521

Appendix

Table 7. Oracle coverage on SafeMovie for the two SafeCRS variants used in the human study. Coverage@10 is the fraction of top-

10

recommendations whose metadata is fully resolved by the SafeMovie Safety Oracle (higher is better); items outside this set are conservatively treated as unsafe.

Recommender Systems

Recommender systems predict and rank items for people using interaction histories, content, context, and feedback.

See all 514 papers

Personalization Meets Safety:Mechanisms,Risks,and Mitigations in Personalized LLMs
Jun 8, 2026Yanyan Luo, Xue Han, Ruiqiao Bai +10LLM Personalization LLM Safety
Jiutian Research, China Mobile Jiutian Artificial Intelligence Technology (Beijing) Co., Ltd., Beijing, China. · Xinjiang Technical Institute of Physics and Chemistry, Chinese2026 Academy of Sciences, Beijing, China.
Safety as a Constraint: Fine-Tuning a LLM Recommender to Explain Itself
Sep 12, 2026Jiashu He, Emma Yanyang Kong, JJ Tan +1Explainable Recommendation Large Language Model-Based Recommendation
University of Pennsylvania · Netflix
Configurable Reward Model for Balanced Safety Alignment
May 28, 2026Zhengping Jiang, Mehran Khodabandeh, Akash Bharadwaj +5Reward Modeling Language Model Safety Evaluation
Johns Hopkins University · Meta · Meta Superintelligence Labs

Jun 8, 2026J/K move · Enter open · S save

Personalization Meets Safety:Mechanisms,Risks,and Mitigations in Personalized LLMs

Yanyan Luo, Xue Han, Ruiqiao Bai, Xin Huang+9

Jiutian Research, China Mobile Jiutian Artificial Intelligence Technology (Beijing) Co., Ltd., Beijing, China. · Xinjiang Technical Institute of Physics and Chemistry, Chinese2026 Academy of Sciences, Beijing, China.

LLM Personalization LLM Safety LLM Safety Evaluation

Open paper AskPDF arXiv

Large Language Models (LLMs) have enabled increasingly personalized interactions by adapting to users' preferences, contexts, and long-term histories. However, the mechanisms that enable personalization also expand the safety landscape in ways not systematically addressed by existing literature. Existing reviews typically focus either on personalization or safety, leaving their intersection largely unexplored. We present the first comprehensive, safety-aware review of personalized LLMs. We organize personalization along three dimensions-user representation, personalization paradigm, and evaluation-and introduce a unified taxonomy of safety risks. At the representation level, we analyze risks arising from diverse user representations. Across mainstream personalization paradigms, we delineate vulnerabilities inherent to prompting, retrieval augmentation, parameter fine-tuning, reinforcement learning, Mixture-of-Experts (MoE), pruning, agent frameworks, and multimodal personalization, and synthesize mitigation strategies across the model lifecycle. Beyond these fine-grained risks, we characterize paradigm-agnostic safety risks arising from personalized adaptation. We further summarize personalized datasets and evaluation methodologies. Through a case study of OpenClaw, we analyze deployment trends in personalized agent ecosystems. Our analysis reveals three structural inadequacies in existing research: safety is evaluated as user-invariant rather than relational, personalization techniques are analyzed in isolation rather than in composition, and evaluation frameworks cannot capture emergent long-term risks. By jointly examining personalized representations, personalization paradigms, safety risks, defenses, and evaluation methods, we provide a unified framework for developing safe personalized LLMs and highlight key directions for future research.

Abstract

Recommender Systems

Explore similar work

Personalization Meets Safety:Mechanisms,Risks,and Mitigations in Personalized LLMs

Safety as a Constraint: Fine-Tuning a LLM Recommender to Explain Itself

Configurable Reward Model for Balanced Safety Alignment