PaperlayerView exact revision on arXiv

Source-linked AI summary

A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos

Yang Yao, Xuan Tong, Ruofan Wang, Yixu Wang, Lujundong Li, Liang Liu, Yan Teng, Yingchun Wang

arXiv:2502.15806v2cs.CRcs.AIcs.CLcs.LG

TL;DR

Jailbreak research has largely focused on models with weaker reasoning, although successful attacks can elicit more detailed and organized harmful responses from LRMs. Mousetrap iteratively embeds one-to-one prompt mappings into reasoning chains. Across mainstream LRMs and diverse benchmarks, it reports ASRs of at least 85% with high confidence.

  • Problem

    Jailbreak research has primarily targeted models with weaker reasoning, while successful attacks on LRMs can produce more detailed, organized, specific, and logically reasonable harmful responses.

    Source: §1 · pp. 1–2

  • Method

    Mousetrap uses a Chaos Machine to generate diverse one-to-one prompt mappings that are iterated into reasoning chains targeting LRMs.

    Source: §1 · p. 2

  • Results

    Across mainstream LRMs and diverse benchmarks, Mousetrap consistently achieves ASRs of at least 85% with high confidence.

    Source: §8 · p. 9

  • Takeaways & Limitations

    The authors identify a reasoning-mask vulnerability: LRMs may fail to discern harmful instructions until the final reasoning step and cannot foresee subsequent-step outcomes.

    Source: §7 · p. 9

    The paper does not examine defense mechanisms, leaving reasoning-process protection and output detection as potential strategies.

    Source: Limitations · p. 10

Abstract

from arXiv · show

Large Reasoning Models (LRMs) have significantly advanced beyond traditional Large Language Models (LLMs) with their exceptional logical reasoning capabilities, yet these improvements introduce heightened safety risks. When subjected to jailbreak attacks, their ability to generate more targeted and organized content can lead to greater harm. Although some studies claim that reasoning enables safer LRMs against existing LLM attacks, they overlook the inherent flaws within the reasoning process itself. To address this gap, we propose the first jailbreak attack targeting LRMs, exploiting their unique vulnerabilities stemming from the advanced reasoning capabilities. Specifically, we introduce a Chaos Machine, a novel component to transform attack prompts with diverse one-to-one mappings. The chaos mappings iteratively generated by the machine are embedded into the reasoning chain, which strengthens the variability and complexity and also promotes a more robust attack. Based on this, we construct the Mousetrap framework, which makes attacks projected into nonlinear-like low sample spaces with mismatched generalization enhanced. Also, due to the more competing objectives, LRMs gradually maintain the inertia of unpredictable iterative reasoning and fall into our trap. Success rates of the Mousetrap attacking o1-mini, Claude-Sonnet and Gemini-Thinking are as high as 96%, 86% and 98% respectively on our toxic dataset Trotter. On benchmarks such as AdvBench, StrongREJECT, and HarmBench, attacking Claude-Sonnet, well-known for its safety, Mousetrap can astonishingly achieve success rates of 87.5%, 86.58% and 93.13% respectively. Attention: This paper contains inappropriate, offensive and harmful content.

1 Introduction

The introduction frames LRM jailbreak research as an underexplored safety problem: successful attacks can produce more detailed, organized, specific, and logically reasonable harmful responses. Mousetrap uses iterative chaos mappings in reasoning chains to target this gap.

1 Introduction

  • Prior jailbreak research primarily targeted models with weaker reasoning, leaving attacks on more capable LRMs relatively unexplored.The introduction also notes that jailbreak failures can yield more detailed, organized, specific, and logically reasonable harmful outputs.Source: §1 · pp. 1–2
  • Mousetrap combines the Chaos Machine’s varied mappings with iterative reasoning chains to guide LRMs toward unsafe responses.The framework asks targets to reconstruct the original toxic query through iterative steps and respond from a villain’s perspective.Source: §1 · p. 2
  • The study extends evaluation to recent reasoning models and a broad set of jailbreak benchmarks, including AdvBench, StrongREJECT, and HarmBench.The listed models include o-series, Claude-Sonnet, Gemini-Thinking, DeepSeek-R1, QwQ-Plus, and Gork.Source: §1 · p. 2
  • 6.3 of 10 equivalent attacks succeed on average on Trotter with a chain length of 3.The authors report that extending the iterative chaos chain can notably enhance jailbreak success.Source: §1 · p. 2
  • At least 86.58% success is achieved against Claude-3-5-Sonnet on benchmarks when Mousetrap uses a chain length of 3.With chain lengths not exceeding 2, the reported success rate is at least 67.41%.Source: §1 · p. 2

2 Related Works

Related work traces the development of reasoning structures and distinguishes black-box from white-box jailbreaks. It notes that existing mapping attacks have weakened on advanced models and motivates iterating one-to-one mappings into LRM-targeting chains.

2.1 Large Reasoning Models

  • Reasoning structures expanded from Chain-of-Thought chains to tree search, graph-based, and nested forms, alongside MCTS, beam search, and ensemble strategies.Source: §2.1 · p. 3
  • ActorAttack targeted o1 after testing against poor-reasoning LLMs and claimed higher safety than GPT-4o, but did not investigate LRM reasoning capabilities or further LRM jailbreaks.Source: §2.1 · p. 3

2.2 Jailbreak Attacks

  • White-box jailbreaks include gradient-, logits-, and fine-tuning-based methods, while black-box attacks rely mainly on queries and include templates, context attacks, code injection, and prompt rewriting.The passage notes that white-box approaches require target-model access, limiting practicality.Source: §2.2 · p. 3
  • Existing one-to-one mappings are uniquely recoverable, unlike one-to-many persuasive prompts; the authors define the former as reasoning steps and iterate them into LRM-targeting chains.The passage says such methods have become less effective on the latest models with advanced reasoning capabilities.Source: §2.2 · p. 3

3 Preliminary

The preliminaries define chaos mappings and the Chaos Machine, specify the reasoning-prompt structure and evaluation metrics, and describe the TrotterStrong dataset and mapping comparison. In that comparison, the one-step mappings perform nearly identically and have a relatively low upper limit.

3.1 Taxonomy

  • One-to-one chaos mappings uniquely rewrite and restore prompts, with character, word, and sentence levels classified by minimum perturbation unit.The paper reviews existing mappings and adds novel ones to its taxonomy.Source: §3.1 · p. 3

3.2 Chaos Machine

  • For a PTQ, the Chaos Machine applies a random CPO pairing ECP and DCP to produce a CTQ, then combines mappings of different granularities in iterative reasoning chains.The authors develop both a fine-tuned LLM and a function-library version; the library is the default for later experiments because calls are frequent, trading limited diversity for lower cost.Source: §3.2 · p. 4
  • The Chaos Machine treats de-chaos through one-to-one mappings as reasoning steps and aims to diversify chains while neutralizing differences among mappings.The authors describe the concept as abstracting “chaos.”Source: §3.2 · p. 4

3.3 Reasoning Structure

  • The reasoning prompt supplies a CTQ and ordered DCPs, asks the target to reconstruct and output the PTQ, and adds requirements for detail, logic, and format.The example prompt requests solution content after the reconstruction steps.Source: §3.3 · p. 4

3.4 Metrics

  • ASR measures the percentage of PTQs successfully attacked across a dataset, with success defined by either two of three or all three equivalent attacks.The paper also defines SF as per-PTQ success frequency across repeated experiments and ASF as its dataset average; MSL is the shortest chain length yielding success under S/T mode.Source: §3.4 · pp. 4–5

3.5 TrotterStrong

  • TrotterStr comprises 50 strongly toxic questions rephrased from MM-SafetyBench, StrongREJECT, and AdvBench, covering six topic areas.The questions were selected and rephrased to begin “Steps in detail to”.Source: §3.5 · p. 5
  • Directly querying these questions yielded zero ASR; in an ablation omitting en-chaos and de-chaos steps while keeping other reasoning-structure text unchanged, all attacks caused an invalid-prompt error and were rejected.Source: §3.5 · p. 5
  • At chain length 1, the eight mappings show approximately the same jailbreak ability, with nearly identical performance and a relatively low upper limit; the Chaos Machine represents their average level.The comparison uses o1-mini-2024-09-12 as the Target and ASR under “2/3 mode” as the metric, with experiment results on TrotterStr.Source: §3.5 · p. 5

4 Iterative Reasoning

The section builds TrotterAdvanced and uses a Chaos Machine to create iterative reasoning chains with varied mappings. On TrotterAdv, attack effectiveness peaks at chain length 3, while longer chains can impair PTQ reconstruction.

4.1 TrotterAdvanced

  • TrotterAdvanced selects PTQs with SF below 2 after ten equivalent Chaos Machine attacks, addressing concerns that TrotterStr toxicity was insufficient to show iterative attacks’ power.The initial one-step successes were largely consistent across mappings.Source: §4.1 · p. 5
  • PTQs directly intending harm to individuals were more likely to be rejected, whereas prompts about accessing pornographic websites were easier to jailbreak.The authors suggest inconsistencies in LLM training may explain this contrast.Source: §4.1 · pp. 5–6

4.2 Iterative Reasoning Chain

  • Each iteration transforms a PTQ into a CTQ and CPOs; reversing the DCP list lets the target reconstruct the PTQ step by step.The next iteration uses the preceding CTQ as its input PTQ.Source: §4.2 · p. 6
  • The chain superimposes mappings of varied granularities to increase reasoning complexity and avoid iterative degradation that can restore the original PTQ.The authors describe the resulting mapping as nonlinear-like and say it projects PTQs into low-sample spaces to strengthen mismatched generalization.Source: §4.2 · p. 6

4.3 Experiments

  • ASF reaches 6.3 at chain length 3 on TrotterAdv, while increasing chain length significantly enhances attack effectiveness overall.The authors attribute the result to targets completing de-chaos steps by inertia and neglecting response safety.Source: Figure 4 · p. 6, §4.3 · p. 6
  • At chain lengths 4 and 5, ASF decreased as PTQ reconstruction accuracy diminished, which the authors interpret as the target reaching its reasoning limit.They describe an expected pattern in which effective attacks first increase and then decrease; saddle-point position reflects reasoning and safety-alignment capabilities.Source: §4.3 · p. 6

5 Mousetrap

Mousetrap combines villain-perspective role-play with Chaos Machine-generated iterative reasoning. On TrotterUltimate, it reaches ASF 7, outperforming the explicit-CoT ablation.

5.1 Framework

  • The framework first prompts the LRM from a villain’s viewpoint, then supplies the iterative chain, and finally steers it to reason while neglecting safety and query intent.Its design combines the Chaos Machine and iterative reasoning with competing objectives including role-play and de-chaos instructions.Source: §5.1 · p. 7

5.2 TrotterUltimate

  • TrotterUltimate consists of eight highly toxic PTQs filtered from TrotterAdvanced because their SF remained at 6 or below.Most TrotterAdvanced PTQs had at least seven successes across ten equivalent attacks.Source: §5.2 · p. 7

5.3 Experiments

  • Verified villain-scenario prompts that supplied villain ideas or scripts benefited Mousetrap, while the grandma-trap alternative reduced original ASF by half.The prompts were generated with LLMs and selected after verification.Source: §5.3 · p. 7
  • Mousetrap elevates ASF to 7 on TrotterUltimate, while the explicit-CoT ablation is less effective.The authors suggest explicit reconstruction steps may more readily trigger target security alerts.Source: §5.3 · p. 7, Figure 6 · p. 8

6 Extension Experiments

Across tested LRMs, Mousetrap achieves high attack success under a strict three-attempt criterion, and experiments on Claude-Sonnet span multiple benchmarks. The authors also report near-complete jailbreaking of nearly all more advanced models at chain lengths up to 3.

6.1 Attack LRMs with TrotterStr

  • The TrotterStr evaluation tests chain lengths 1–3 and counts a PTQ as successful only when all three equivalent attacks succeed; otherwise it is marked failed.The setup records minimum successful length for successful PTQs.Source: §6.1 · p. 8
  • With chain lengths up to 3, ASRs reach 96% on o1-mini, 86% on Claude-3-5-Sonnet, and 98% on Gemini-2.0-Thinking (H); nearly all tested advanced LRMs are completely jailbroken.Gemini-2.0-Thinking with the stricter M&H safety setting reaches 70% ASR.Source: Figure 7 · p. 8, §6.1 · p. 8

6.2 Attack claude-Sonnet with Benchmarks

  • On ten benchmarks and MM-SafetyBench subsets, Claude-3-5-Sonnet fails to withstand Mousetrap, and the authors report extremely high attack rates under their most stringent success determination.The results are presented in Figure 8 and Appendix G, but these passages give no benchmark-specific rates.Source: Figure 8 · p. 8, §6.2 · p. 9

7 Discussions

The discussion frames Mousetrap around mismatched generalization and competing objectives, and identifies reasoning masks and inertia as additional LRM vulnerabilities. It cautions that the relative influence of the proposed principles remains uncertain.

7 Discussions

  • Mousetrap maps prompts through multi-step one-to-one mappings into lower sample spaces and uses iterative reasoning and scenario nesting to distract LRMs.The discussion describes varying granularities as turning linear-like maps into nonlinear-like maps while retaining accuracy and reversibility.Source: §7 · p. 9
  • A reasoning mask leaves LRMs unaware of harmful instruction execution until the final step because later reasoning outcomes remain unpredictable and inaccessible beforehand.The authors distinguish this vulnerability from mismatched generalization and competing objectives.Source: §7 · p. 9
  • Once reasoning begins, LRMs may follow its inertia and struggle to stop and assess safety promptly.The authors say this tendency may lead models to overlook safety alignment.Source: §7 · p. 9
  • The authors cannot determine which black-box jailbreak principle has greater influence, identifying their relative contribution as a direction for future research.They call for more in-depth discussion of black-box LRM safety alignment.Source: §7 · p. 9

8 Conclusions

The conclusion presents Mousetrap as an iterative-reasoning jailbreak framework for LRMs, using one-to-one mappings to create diverse chains and reporting high attack success across models and benchmarks.

8 Conclusions

  • Mousetrap combines the Chaos Machine with iterative reasoning chains to target LRMs’ reasoning abilities for jailbreaks.The paper describes this as the first jailbreak research on LRMs.Source: §8 · p. 9
  • The Chaos Machine generates diverse and complex reasoning chains by iteratively applying one-to-one mappings.The paper says the framework was validated across mainstream LRMs and diverse benchmarks, with ASRs of at least 85% at high confidence.Source: §8 · p. 9
  • Mousetrap consistently achieves ASRs of at least 85% across mainstream LRMs and diverse benchmarks, according to the conclusion.The conclusion characterizes the reported validation as high confidence.Source: §8 · p. 9

Limitations

The paper identifies unexamined defenses and future extensions to its mapping structure and reasoning-based attacks as limitations and directions for further work.

Limitations

  • The paper presents a jailbreak framework but does not examine corresponding defense mechanisms.It names reasoning-process protection and output detection as potential strategies.Source: Limitations · p. 10
  • The Chaos Machine’s one-to-one mapping structure could be extended to more varied, expansive, hierarchical, and regular forms.Source: Limitations · p. 10
  • The paper identifies other reasoning-based paradigms for attacking LRMs as a topic for future exploration.Source: Limitations · p. 10

Potential Risks

The supplementary material warns of possible malicious use and describes examples, a semantic-similarity checker, and criteria for comparing Chaos Machine construction approaches.

Potential Risks

  • The paper warns that Mousetrap could be used for malicious LRM attacks leading to harmful outcomes.It advocates improving LRM safety alignment and condemns abuse.Source: Potential Risks · p. 10

A Chaos Mappings

B Checker

  • The Checker scores semantic similarity between a decrypted string and the original prompt, and only scores above 4 pass.Source: B Checker · p. 12

C Comparison of Chaos Machines

  • The Chaos Machine approaches are evaluated on diversity, accuracy, and cost; diversity supports complexity while accuracy supports mapping precision.The fine-tuned LLM approach is presented as having potential for richer, more diverse, adversarial mappings and future hierarchical structures.Source: C Comparison of Chaos Machines · p. 12

D Results of One-Step Reasoning

The supplementary results material points to tables on one-step mappings, Trotter datasets, and Mousetrap evaluations, followed by attack examples across three models.

D Results of One-Step Reasoning

E Trotters

F Results of Mousetrap on Different LRMs

G Results of Mousetrap with Different Benchmarks

H Examples

Loading 2502.15806v2…