Large Reasoning Models (LRMs) are a class of artificial intelligence systems designed to solve complex problems by combining natural language understanding with explicit logical reasoning. Rather than immediately generating a direct response to a user's input, LRMs are trained to first generate intermediate "reasoning steps" and only then arrive at a final answer.

Because they "think before answering," reasoning models are widely assumed to be safer and more reliable than traditional language models. However, the following study shows that rather than strengthening refusals, long reasoning sequences weaken them, creating a new surface of attack.

The new introduced attack is named Chain-of-Thought Hijacking (CoT-Hijacking), a simple jailbreak where harmless reasoning is prepended before a harmful instruction. The key insight is that when a model is forced to produce a long, benign reasoning trace before encountering a harmful request, the model's internal safety mechanisms become less effective. As a result, the model is significantly more likely to comply with requests it would normally refuse.

Large Reasoning Models (LRMs)

A Large Reasoning Model (LRM) is an artificial intelligence system that combines natural language understanding with logical reasoning to solve complex problems. Although LRMs are built on the same Transformer-based architecture as Large Language Models (LLMs), they differ in how they operate at inference time. Instead of producing an immediate response, LRMs intentionally utilize additional time to generate intermediate reasoning steps, enabling them to arrive at more accurate and logically sound conclusions.

To facilitate this process, LRMs employ chain-of-thought (CoT) prompting, a technique that encourages the model to articulate its reasoning explicitly. CoT improves interpretability by making the reasoning process visible to the user. However, transparency does not inherently guarantee correctness. LRMs can still generate reasoning that appears coherent and convincing while being incorrect. While LLMs and LRMs share a common architecture, they are designed with different goals in mind. LLMs primarily focus on producing fluent text outputs, whereas LRMs emphasize logical structure and problem-solving accuracy.

Jailbreak attacks

Jailbreak attacks are techniques designed to manipulate Artificial Intelligence (AI) models into bypassing their embedded safety and ethical safeguards. In these attacks, adversaries carefully craft specialized prompts to deceive the model into producing content it would normally refuse to generate.

It is important to distinguish jailbreak attacks from prompt injection. Prompt injection attacks aim to alter an application's intended functionality by manipulating input prompts, potentially leading to unexpected or harmful outputs. Jailbreaking, by contrast, focuses bypassing the model's internal safety controls themselves.

Despite continuous improvements in safety alignment, new jailbreaking methods are continually being proposed. This highlights that model refusals (e.g., "I cannot provide an answer to your question") are related to specific activation patterns within the models. These activation patterns, referred to as "safety patterns", significantly contribute to the model's ability to reject malicious queries.

Chain-of-Thought Hijacking

Chain-of-Thought Hijacking (CoT-Hijacking) is a simple jailbreak where benign reasoning is prepended before a harmful instruction. The attack works by placing a long, harmless reasoning preface, followed by a harmful instruction and an explicit response instruction. This prompt structure systematically reduces refusals, as the harmless reasoning weakens internal safety patterns while the concluding response instruction redirects the model's focus toward answer generation.

To enable large-scale generation of such attacks, the authors implemented an automated pipeline known as Seduction. This pipeline leverages a secondary language model to produce diverse benign reasoning prefixes and integrate malicious payloads. Each generated prompt is evaluated leveraging the target model, which serves as a judge by providing whether the output was a refusal and the Chain-of-Thought length. Using this feedback, the system iteratively optimizes prompt construction, yielding highly effective jailbreak prompts without requiring any visibility into the target model's internals.

Results

The approach was evaluated against several established jailbreak techniques designed specifically for large reasoning models, including Mousetrap, H-CoT, and AutoRAN. Due to the high computational expense associated with generating each jailbreak instance, the experiments were conducted on a reduced benchmark consisting of the first 100 samples from HarmBench. HarmBench is a standardized benchmark designed to evaluate how effectively large language models resist malicious prompts, enabling systematic comparison of jailbreak attacks and safety defenses.

The approach evaluation was performed across the following target models: Gemini 2.5 Pro, ChatGPT o4 Mini, Grok 3 Mini, and Claude 4 Sonnet. Jailbreak performance was measured using Attack Success Rate (ASR) as the primary metric. The results demonstrated a significant advantage for Chain-of-Thought Hijacking. On Gemini 2.5 Pro, this method achieved an attack success rate of 99%, dramatically outperforming the baseline techniques. By comparison, Mousetrap attains an ASR of 4%, H-CoT reaches 60%, and AutoRAN achieves 69%, highlighting the effectiveness of CoT Hijacking in overcoming reasoning-based safety mechanisms.

CoT Hijacking was also evaluated against GPT-5-mini under varying reasoning-effort configurations, specifically minimal, low, and high, using 50 randomly selected samples from HarmBench. At the minimal setting, the model is encouraged to produce answers quickly with no explicit multi-step reasoning. The low setting enables a moderate level of reasoning. The model performs some internal analysis and may generate short or partial chains of thought. At the high setting, the model allocates more computation to inference-time reasoning. It is encouraged to decompose problems into detailed, multi-step chains of thought, explore intermediate conclusions, and verify its own logic before producing a final answer.

Notably, the attack achieves its highest success rate when the model operates under the low-effort setting. This observation indicates that reasoning effort and chain-of-thought length function as related but independent mechanisms. Longer reasoning does not guarantee greater robustness - in some cases it reduces it.

Mechanistic Analysis

Note: The following section introduces additional technical detail. Feel free to jump to the Conclusion if you wish to avoid these details.

In the following paper, the authors investigated why large language models refuse malicious or harmful instructions. They found that refusal behavior is controlled by a single one-dimensional direction in the model's internal activations. Removing this direction stops the model from refusing harmful prompts, while adding it causes refusal even on harmless input.

CoT-Hijacking complements this view: instead of editing the signal of refusal, it weakens its formation. This effect was named refusal dilution. During inference, the next-token activation reflects attention over prior tokens. Tokens that convey harmful intent tend to amplify the refusal direction, whereas benign tokens decrease it. By inducing the model to produce extended sequences of harmless reasoning, harmful tokens constitute only a small fraction of the attended context. Consequently, the refusal signal is diluted below threshold, allowing harmful outputs to be generated.

To investigate the underlying mechanism, the authors examined how attention is allocated between tokens corresponding to the harmful instruction and those belonging to the benign puzzle content (see Figure 1 for an example of prompt). Defining the attention ratio as the sum of attention weights assigned to harmful tokens divided by the sum assigned to puzzle tokens, they observed that this ratio declines as CoT length increases. This indicates that harmful instructions receive progressively less weight, thus diluting the safety mechanisms that detect and refuse unsafe requests.

Mechanistic analysis of both refusal components and attention patterns indicates that longer chain-of-thought sequences attenuate safety signals in the later layers of the model. Collectively, these observations suggest that jailbreaks are effective not only because refusal is governed by a one-dimensional internal feature, but also because its activation diminishes as benign reasoning tokens increasingly dominate the model's contextual attention.

Conclusion

Chain-of-Thought (CoT) Hijacking is a simple yet highly effective jailbreak targeting reasoning models. The attack works by embedding harmful instructions within long sequences of benign reasoning, followed by a cue prompting the final answer. This strategy systematically dilutes the model's refusal signals, leading to consistently high attack success across both open-source and proprietary large reasoning models.

CoT Hijacking leverages that fact that safety checks depend on residual activations that become less discriminative as chain-of-thoughts length increases. Long CoT sequences weaken the refusal signals, redirecting attention away from harmful tokens and flattening refusal directions. This demonstrates that reasoning models, despite higher task accuracy, are more vulnerable to jailbreaks when CoT traces are exploited. From a defensive standpoint, CoT Hijacking could be mitigated by strengthening the model's attention to harmful content or making refusals robust to long reasoning.