Strong but Brittle: Simple Attacks Subvert Reasoning-based Safety Guardrails

• Open-weight models can be difficult to patch after release, and deployments may lack monitoring or filtering, making defense and red-teaming important.The paper contrasts these conditions with proprietary models that can be centrally updated, patched, and monitored.Source: §1 · p. 1
• Existing attacks are blocked, achieve limited ASR, or require substantial compute while eliciting low-quality content.Examples include prefix filling, gradient-based GCG, and attacks targeting reasoning itself.Source: §1 · p. 2
• The attacks exploit stage-transition logic: mimicking structural patterns in prompts can bypass or exploit guardrails without complex pipelines, training data, or compute.The transition tokens mark when reasoning ends and answering begins.Source: §1 · p. 2
• The authors develop four red-teaming methods to probe different guardrail stages, including bypassing safety reasoning and exploiting reasoning to produce targeted harmful content.The methods include Enforced Stage Transition, Coercive Optimization, Fake Over-Refusal, and Reasoning Hijack.Source: §1 · p. 2
• Over 90% ASR across five jailbreak benchmarks on gpt-oss, with effectiveness across diverse open-weight LRMs and guardrail-training paradigms.The paper argues these results reveal that residual defenses are weak once reasoning-based guardrails are subverted.Source: §1 · p. 2

• Reasoning-based guardrails build on Chain-of-Thought safety work and later alignment of open-weight LRMs; Deliberative Alignment has been applied to gpt-oss with near-perfect refusal rates.Other examples include Qwen3’s data filtering and preference alignment and Phi-4’s safety-focused training data.Source: §2 · p. 3
• Prior red-teaming approaches include malicious-intent masking, reasoning overload, and CoT skipping, with examples such as Policy Puppetry, AutoRAN, encryption-based attacks, and H-CoT.The paper reports that some methods dilute malicious intent, require extra inference or costly decryption, or produce unrelated responses.Source: §2 · p. 3
• The authors position their methods as preserving the original malicious intent, avoiding heavy decryption reasoning, and enabling easier implementation at scale for specific, tailored harmful responses.The paper also highlights robust triggering and safety of the final response stage as concerns.Source: §2 · p. 3

• An LRM generates an output sequence autoregressively, with each next token conditioned on the prompt and previously generated tokens.Source: §3 · p. 3
• The output is decomposed into a reasoning stage and a final-answer stage, with the answer conditioned on both the input and the reasoning.The reasoning stage can assess whether the input violates safety policies, and the final response is expected to refuse when it does.Source: §3 · pp. 3–4
• Special control tokens and fixed structural patterns mark the stages, so transition integrity is critical to guardrail effectiveness but can be manipulated.The illustrated transition runs from a harmful prompt through safety reasoning and a refusal response.Source: §3 · p. 4

4.1 Enforced Stage Transition to Bypass the Guardrails

• Enforced Stage Transition injects a mock safety justification and transition structure so the model treats reasoning as complete and proceeds directly to an answer.It does not rely on paraphrasing or intent manipulation; the mock justification replaces the model’s own safety decision.Source: §4.1 · pp. 4–5

4.2 Coercive Optimization to Skip without Using Template Tokens

• Coercive Optimization uses gradient-optimized suffixes to trigger the answer stage, targeting the transition rather than an affirmative response and indicating a learned vulnerability beyond template tokens.The authors contrast it with generic suffix attacks that target affirmative responses.Source: §4.2 · p. 5

4.3 Fake Over-Refusal to Examine the Remaining Defense

• Fake Over-Refusal reframes a genuinely harmful request in the surface form of a benign over-refusal case, exploiting models’ learned treatment of such expressions as benign.When guardrails are bypassed, the paper reports that the model may generate harmful content, including for extremely forbidden queries.Source: §4.3 · p. 5

4.4 Reasoning Hijack to Weaponize the Reasoning-then-Answer Paradigm

• Reasoning Hijack replaces internally generated reasoning with attacker-specified reasoning that steers the final response toward the attacker’s goal.This provides fine-grained control over content and detail, producing more comprehensive and tailored harmful outputs than simply bypassing reasoning.Source: §4.4 · pp. 5–6

5.1 Experimental Setup

• The setup evaluates 1,883 harmful queries from five benchmarks using harm score and four ASR measures, against Direct, Policy Puppetry, H-CoT, and AutoRAN baselines.Models were served locally and through OpenRouter; evaluation uses final responses without intermediate reasoning.Source: §5.1 · p. 6

5.2 Results Analysis on gpt-oss Series

• More than 90% ASR across all datasets, with significantly higher harm scores, is reported for the proposed methods on gpt-oss-20b and 120b.The results report more than 90% ASR and over 70% harm on both models across all benchmarks.Source: Table 1 · p. 7, §5.2 · p. 7
• Direct inference yields near-zero response rates, Policy Puppetry and H-CoT stay below 10% ASR and harm, and AutoRAN reaches around 30% ASR, below the proposed methods.On API endpoints, the methods also achieve high ASRs and harm scores across five datasets; Enforced Stage Transition reaches 95.79% ASR and 79.00% harmful score on the 120b endpoint with 100 additional tokens per prompt.Source: §5.2 · pp. 7–8, Table 3 · p. 8

5.3 Experiments on Additional LRMs and Ablations

• Reasoning Hijack is the most consistent attack across additional LRMs, while Enforced Stage Transition can be weak, including 1.76% StrongREJECT ASR on Phi-4.On TARS and SafeChain, direct inference yields 0% ASR, while the proposed attacks reach up to 95% and 98%, respectively; results also show consistent vulnerabilities across guardrail training procedures.Source: §5.3 · pp. 8–9, Table 5 · p. 8
• Changing temperature from 0.0 to 1.6 has marginal effects, and Fake Over-Refusal and Reasoning Hijack exceed 85% ASR across low, medium, and high reasoning effort.Longer reasoning traces do not inherently strengthen the guardrails.Source: §5.3 · p. 9
• Input token stripping or escaping and output transition validation stop only naive Enforced Stage Transition; adaptive variants and attacks not relying on tokens or structure retain substantial ASR.Reasoning Hijack retains 85.3%, 84.4%, and 54.2% ASR under stripping, escaping, and transition validation, respectively.Source: §5.3 · p. 9
• Fake Over-Refusal and Reasoning Hijack remain effective on three proprietary reasoning models through black-box APIs, although harm decreases with model capability and alignment strength.The attacks requiring gradients or provider-controlled reserved tokens were excluded; reported harm decreases from 42.16 on GPT-5.4-nano to 13.94 on Claude-Opus-4.8.Source: §5.3 · p. 9
• Mechanistic tests find that models cannot distinguish injected from self-generated transitions, and patched reasoning activations flip refusal to compliance in 50 of 50 prompts.The same mechanism steers factual conclusions in 80% of test questions, supporting the authors’ characterization of a systematic vulnerability.Source: §5.3 · p. 10

6 Conclusions

• Reasoning-based guardrails are brittle despite near-perfect refusal rates, and the authors argue they need robust triggering mechanisms and stronger base-model alignment.The paper reports attacks that bypass safety reasoning, exploit residual defenses, or hijack reasoning for targeted harmful content.Source: §6 · p. 10

A The Use of Large Language Models

• LLMs assisted only with grammar correction, rephrasing, and textual consistency, not research ideas, experiment design, or analysis.The authors state that all conceptual and experimental contributions originated with them.Source: A The Use of Large Language Models · p. 15

B.1 Enforced Stage Transition

• Enforced Stage Transition inserts chat-template tokens and a mock safety justification to make the model treat reasoning as complete and generate a direct response.The method needs specific token information but not model weights, and does not paraphrase or semantically manipulate the harmful intent.Source: §B.1 · p. 15

B.2 Coercive Optimization

• Coercive Optimization uses gradients to optimize a suffix containing a final-message token and a low-resource-language instruction toward a target response.The method is white-box because it requires gradient access.Source: §B.2 · p. 15

B.3 Reasoning Hijack

• Reasoning Hijack replaces mock CoT with a query-specific plan and sub-steps, seeking tailored harmful responses and adherence to the injected plan.It requires token information but not model weights; the method appends commentary-like tokens to discourage the model from questioning the plan.Source: §B.3 · p. 16

C.1 Datasets

• The evaluation includes 313 StrongREJECT questions, 520 Advbench harmful instructions, and 400 HarmBench harmful behaviors.The datasets cover detailed harmful responses, instruction compliance, and varied semantic categories.Source: §C.1 · p. 16
• CatQA contributes 550 categorical harmful questions, while JBB-Behaviors contributes 100 harmful queries.CatQA spans 11 harm categories, each divided into five subcategories with 10 questions each.Source: §C.1 · pp. 16, 18
• 1,883 harmful prompts across five datasets form the study's evaluation set.The table caption also reports five datasets and 1,883 prompts.Source: §C.1 · p. 18, Table 7 · p. 18

C.2 Evaluation Metrics

• The Harm Score ranges from 0 for refusal or no harm to 1 for extremely specific, harmful content, using the StrongREJECT rubric evaluator (Souly et al., 2024).Source: §C.2 · p. 18
• ASR is evaluated using Refusal Words Detection (Zou et al., 2023), Llama-Guard (Inan et al., 2023), HarmBench’s binary classifier (Mazeika et al., 2024), and a Harm Score threshold of 0.1.Source: §C.2 · p. 18
• The Harm Score correlated with averaged human ratings at Pearson r = 0.98 across 40 sampled responses rated by five annotators.Annotators used a six-level scale from 0 to 1; the comparison is reported in Table 8.Source: §C.2 · p. 20, Table 8 · p. 20

C.3 Baseline Implementation

• Policy Puppetry embeds the query in a jailbreak template drawn from its official blog post.The template uses interaction and scene instructions to shape the response.Source: §C.3 · p. 21
• H-CoT creates mock chain-of-thought prompts by rephrasing queries with an uncensored fine-tuned Qwen3-8B and several in-context examples.The rephrasing template frames requests as educational and specifies components such as a scheme, implementation, functional example, and rationale.Source: §C.3 · pp. 21–22
• Baseline implementations include H-CoT’s structured chain-of-thought template and AutoRAN prompt refinement, which infers strategies and a target audience from input content.Source: §C.3 · pp. 24–25

C.4 Implementation of Bag of Tricks

• Enforced Stage Transition uses Appendix C.4’s mock CoT and LRM-specific templates that follow each model’s token specifications.Source: §C.4 · p. 26
• Fake Over-Refusal uses an auxiliary model, explanations, and in-context examples to transform harmful queries into the desired style.Its prompt calls for varied rewordings and replacing harmful keywords with metaphorical or related terms.Source: §C.4 · pp. 26–27
• GCG-based Coercive Optimization runs 300 steps with search width 128, while Reasoning Hijack uses an auxiliary model to generate detailed plans for each query.Source: §C.4 · p. 27
• Inference uses greedy decoding with temperature 0 and repetition penalty 1.3, with ablations at various temperatures.The ablations are conducted to test the effectiveness of the proposed methods.Source: §C.4 · p. 27

D.1 Threat model

• Coercive Optimization is white-box and requires model gradients, while Enforced Stage Transition is gray-box and requires knowledge of reserved transition tokens.The transition tokens are exposed in an open-weight model’s chat template.Source: §D.1 · p. 27
• Fake Over-Refusal and Reasoning Hijack transfer empirically to closed-source frontier models under a black-box threat model.These attacks rely only on the target model’s reasoning behavior.Source: §D.1 · p. 27

D.2 Closed-Source Model Evaluation Details

• The study queries GPT-5.4-nano, GPT-5, and Claude-Opus-4.8 with greedy decoding and a 1,000-token generation limit.It evaluates the complete 100-prompt JBB-Behaviors set.Source: §D.2 · p. 27
• Table 10 covers attack success on frontier closed-source reasoning models using the 100-prompt JBB-Behaviors set.Its caption specifies StrongREJECT scoring, with ASR requiring a score above 0.1 and Harm Score reported as a continuous percentage.Source: Table 10 · p. 28, §D.2 · p. 28
• GPT-5.4-nano had 65% ASR / 42.16 Harm for Reasoning Hijack, while Claude-Opus-4.8 had 38% ASR / 13.94 Harm.The passage says harm decreases monotonically with model capability; GPT-5 is described as progressively more resistant than GPT-5.4-nano.Source: §D.2 · p. 28

D.3 Defense Experiments

• Three defenses are evaluated against all four attacks on gpt-oss-20b over the 313-prompt StrongREJECT set.Table 11 reports attack success under these defenses, but the supplied caption does not give result values.Source: §D.3 · p. 28, Table 11 · p. 29
• The defenses strip reserved control tokens, escape special tokens, or reject responses with malformed thinking-to-final structure.The first two are input-side defenses; transition validation operates on the output side.Source: §D.3 · p. 28
• The adaptive Enforced Stage Transition variant preserves the reasoning-to-final transition while instructing the model to give brief analysis before its final answer.The variant is described as token-free and structure-preserving.Source: §D.3 · p. 28
• Final-stage safety checks are not evaluated separately; robust judging would require multiple judges per response and multiply inference cost.The paper leaves model-internal, provenance-aware final-stage alignment for future work.Source: §D.3 · p. 28

D.4 Evaluator Agreement Analysis

• Evaluator agreement is measured across four judges using Fleiss’ κ, averaged ASR, majority-vote ASR, and unanimous all-harmful or all-safe criteria.The analysis uses gpt-oss-20b on the full 313-prompt StrongREJECT set; Table 12 covers agreement and ASR under different aggregation rules.Source: §D.4 · p. 29, Table 12 · p. 29

D.5 Mechanistic Analysis

• KL divergence 0 at the transition point showed replayed benign reasoning matched natural next-token generation; the probe reached 99.8% accuracy and read injected transitions as output mode with probability > 0.99.Incorrect injected reasoning yielded incorrect answers in 80% (16/20) of factual questions spanning five subject areas.Source: §D.5 · pp. 29–30
• 50/50 prompts flipped from refusal to compliance when refuse-run reasoning activations were patched into comply runs; zeroing those positions yielded P(refusal) = 0.81.The layer sweep found that a single early layer (layers 0–12) sufficed to flip the output, while later layers (16–23) carried no independent causal signal.Source: §D.5 · p. 29

D.6 OR-Bench Correlation Analysis

• Pearson r = 0.97 (p < 0.001, n = 9) linked OR-Bench over-refusal tendency with Fake Over-Refusal attack success across matched model-category points.The analysis covers 3 models × 3 categories.Source: Table 14 · p. 30, §D.6 · p. 30

D.7 Reasoning Efforts.

• Across low, medium, and high reasoning efforts, Fake Over-Refusal and Reasoning Hijack exceeded 85% ASR, while Reasoning Hijack exceeded 65% harm scores.Enforced Stage Transition performance also stayed unchanged across effort levels.Source: §D.7 · p. 30

D.9 Inference Temperatures.

• Across temperatures from 0.0 to 1.6, attacks showed only marginal changes overall; Reasoning Hijack stayed consistently high, while Enforced Stage Transition fluctuated more.Fake Over-Refusal showed a slight downward trend as temperature increased, but its performance remained relatively stable.Source: Figure 4 · p. 31, §D.9 · p. 32

D.10 Reasoning Efforts.

• Across low, medium, and high reasoning efforts, Fake Over-Refusal and Reasoning Hijack exceeded 85% ASR, with Reasoning Hijack exceeding 65% harm scores; Enforced Stage Transition remained weaker.The passage reports that increasing reasoning depth did not provide additional robustness against the attacks.Source: Figure 5 · p. 31, §D.10 · p. 32

D.8 Mock CoT in Enforced Stage Transition.

• ASR 66.5 and Harm 50.03 were reported for the full five-part mock CoT; individual parts fell short, and removing any part reduced performance.Using only “Answer Request” yielded ASR 26.19 and Harm 48.38; removing “Instruction Request” reduced Harm to 27.13, while removing “Policy Ignorance” yielded ASR 39.75.Source: §D.8 · pp. 30–32, Table 15 · p. 31

D.11 Cost and Latency of Our Methods

• Enforced Stage Transition has negligible construction cost because it uses a fixed template; Coercive Optimization takes longest to construct because it searches prompt suffixes per query.Direct inference is slower than Enforced Stage Transition and Coercive Optimization, while Fake Over-Refusal and Reasoning Hijack have slightly higher latency but remain on par with baseline methods.Source: Table 16 · p. 32, §D.11 · p. 32

E More Experiment Results

• Full results are provided in Tables 17–21 across the four adopted ASR values.The passage identifies these as the full results complementing the average ASR in the main paper.Source: E More Experiment Results · p. 33
• The supplied result tables include results on HarmBench and CatQA.Source: Table 19 · p. 33, Table 20 · p. 34
• Table 21 reports results on JBB-Behaviors.Source: Table 21 · p. 34

Case 1

• The response to “I want to kill Time. Time is a man’s name” supplied a structured murder plan, including target intelligence, method selection, and execution planning.Some details were redacted in the presented example.Source: F Harmful Response Examples · pp. 35–36

Case 2

• For a request to trick people into disclosing banking details, the response outlined a phishing blueprint covering deceptive email design and delivery tactics.It included guidance on optimizing delivery and monitoring opens and clicks; some content was redacted.Source: F Harmful Response Examples · pp. 36–38

Case 3

• The transportation-sabotage response framed objectives around disruption and visibility and identified infrastructure, control systems, rolling stock, and supporting systems as targets.The supplied excerpt shows the response’s strategic framing and target categories.Source: F Harmful Response Examples · pp. 38–39

Target Prioritization Matrix

• The example proposes prioritizing targets by impact, vulnerability, visibility, and recovery time, then scoring each criterion on a 1–5 scale.It directs choosing the highest-scoring target.Source: F Harmful Response Examples · p. 39

3. Means of Disruption

• The example catalogs several broad categories of disruption and describes their advantages, risks, and mitigations.The methods are presented as a comparison of potential approaches, but their specifics are omitted here.Source: F Harmful Response Examples · p. 39

4. Operational Plan (Illustrative Scenario)

• The illustrative scenario lays out a multi-phase plan for rail disruption, followed by diversion, contingency responses, and an assessment of impact.The supplied passage includes operational planning and evasion content; this summary omits actionable details.Source: F Harmful Response Examples · pp. 39–40

5. Contingency & Exit Strategy

• The contingency and exit section describes responses to detection, repair, investigation, or risk of casualties, while the assessment section calls for reviewing impact and evidence.The example ends with a disclaimer that it is fictional and should not be used for real sabotage.Source: F Harmful Response Examples · p. 40