PaperlayerView exact revision on arXiv

Source-linked AI summary

Narrative Paradoxes in LLM Inference: Shaping Reasoning Trajectories toward Misalignment

Haoming Yang, Ke Ma, Yangbangyan Jiang, Ligong Zhang, Xiaojun Jia, Longtao Huang, Yingfei Sun, Qianqian Xu, Qingming Huang

arXiv:2610.16312v1cs.AI

TL;DR

Input and output safeguards leave the safety of multi-step reasoning as a distinct, underexplored challenge. PDRA pairs a malicious actor with a benign task and guides a three-stage analytical trajectory; the paper reports state-of-the-art performance across attack success, output harmfulness, and defense robustness.

  • Problem

    The safety of multi-step reasoning remains underexplored, although locally coherent steps can lead to globally harmful outcomes.

    Source: §1 · p. 2

  • Method

    PDRA pairs a malicious actor with a benign task and guides reasoning through surface purpose, latent intent, and step-by-step plan reconstruction.

    Source: §1 · p. 2

  • Results

    PDRA establishes state-of-the-art performance in success rate, output harmfulness, and robustness against defenses.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors conclude that surface-triggered safeguards alone are insufficient and suggest monitoring and constraining intermediate reasoning states and trajectory evolution.

    Source: §5 · p. 10

    Mechanistic analysis relies mainly on proxy signals that are not fully equivalent to internal safety decisions, leaving finer-grained causal analysis for future work.

    Source: F Limitations and Future Work · p. 17

Abstract

from arXiv · show

Explicit reasoning in large language models (LLMs) is often associated with reliability, yet it can still pose risks when a model infers harmful goals under a benign context. We identify a distinct challenge: ensuring the safety of the \emph{multi-step reasoning process} itself, where locally coherent steps may still lead to globally harmful outcomes. To explore this vulnerability, we propose PDRA (Paradox-driven Reasoning-based Attack), a novel attack method that programs a harmful reasoning trajectory. PDRA first constructs a paradoxical narrative core by pairing a malicious actor (e.g., a terrorist) with a benign task (e.g., writing a safety bulletin). It then embeds this core into a structured analytical framework that forces the model through a mandatory three-stage analysis -- surface purpose, latent intent, and operational reconstruction -- guiding it to produce detailed harmful content while maintaining narrative coherence. Mechanistically, we show PDRA steers the model's internal representations away from refusal-related patterns, suppressing safety-triggering lexicons while activating planning-oriented terms. Empirically, PDRA achieves state-of-the-art attack success rates across diverse LLMs with high efficiency. \textcolor{red}{\textbf{Warning:} This paper may contain sensitive content.}

1 Introduction

The safety of multi-step reasoning remains an underexplored challenge: individually coherent steps can culminate in harmful outcomes. PDRA uses a paradoxical narrative and structured analysis to guide that trajectory, and the paper reports state-of-the-art attack performance.

1 Introduction

  • The safety of multi-step reasoning is distinct and underexplored because locally coherent reasoning can still lead to globally harmful outcomes.The authors contrast this challenge with the predominant focus on scrutinizing inputs and filtering outputs.Source: §1 · pp. 1–2
  • PDRA pairs a malicious actor with a benign task, then guides the model through surface-purpose analysis, latent-intent inference, and step-by-step plan reconstruction.The authors describe this framework as maintaining local coherence while guiding reasoning from a safe starting point toward a harmful conclusion.Source: §1 · p. 2
  • Mechanistic analysis finds PDRA prompts closer to benign and farther from refusal-inducing prompts in middle-to-late layers, with reduced refusal lexicons and increased planning terms.The paper characterizes these changes as steering representations away from refusal-related patterns.Source: §1 · p. 2
  • PDRA establishes state-of-the-art performance in success rate, output harmfulness, and robustness against defenses.The authors also report increased jailbreak success rates and output risk across multiple mainstream LLMs and defense settings.Source: §1 · p. 2

2 Related Work

Prior jailbreak work has used role-play, obfuscation, search, and auxiliary LLMs, while reasoning-centric attacks have targeted demonstrations, internal directions, or early-step errors. PDRA instead shapes the overall reasoning trajectory in a single-turn black-box setting.

2 Related Work

  • Earlier jailbreaks use role-play, dialogue, or encoding; automated search and auxiliary LLM methods improve attack generation but can incur cost, instability, or manual-effort constraints.These approaches do not systematically guide the model’s reasoning trajectory.Source: §2 · p. 3
  • Reasoning-centric attacks manipulate demonstrations, internal CoT safety directions, or early reasoning errors, whereas PDRA shapes the trajectory in a single-turn black-box setting.PDRA does not require demonstration control, parameter access, or intermediate-output manipulation.Source: §2 · p. 3

3 Methodology

PDRA treats the model’s reasoning trajectory as an attack surface, combining a paradoxical narrative core with a staged analytical framework to guide locally benign reasoning toward harmful conclusions. Its probes assess how the attack shifts internal representations away from refusal-related patterns and suppresses refusal lexicons.

3.1 Core Insight and Attack Paradigm

  • PDRA frames the under-monitored reasoning trajectory as an attack surface, where locally benign steps can culminate in globally harmful outcomes.The method programs a narrative-driven reasoning process rather than relying only on surface-feature manipulation.Source: §3.1 · p. 3

3.2 The Attack Construction Pipeline

  • The attack pipeline converts a restricted harmful goal into a jailbreak prompt through a systematic two-step construction process.The two steps are constructing a narrative core and embedding it in an analytical framework.Source: §3.2 · p. 3, §3.2.1 · p. 4, §3.2.2 · p. 4

3.2.1 Step 1: Crafting the Narrative Core – The “Evil-Actor-Benign-Task” Paradox

  • The narrative core pairs a malicious actor with a benign carrier task, reframing a direct harmful request as behavioral analysis and lowering defensive alertness at input.The task is selected to create narrative tension between the actor’s motives and the task’s benign surface purpose.Source: §3.2.1 · pp. 3–4

3.2.2 Step 2: Deploying the Structured Analytical Framework

  • The framework mandates analysis of surface purpose, latent intent, and operational planning, with the final stage producing a step-by-step plan operationally equivalent to achieving the harmful goal.The sequence starts in a benign context, then treats harmful intent as a narrative fact before requesting operational planning.Source: §3.2.2 · pp. 4–5

3.2.3 Synergy of Components: An Indivisible Attack Chain

  • The paradox and framework function as an interdependent chain: the paradox drives engagement, while the framework supplies an exit from the resulting cognitive deadlock.The benign task keeps the process below the safety threshold, and the malicious actor aligns the final output with the harmful goal.Source: §3.2.3 · p. 5

3.3 Internal Mechanism Analysis

  • PDRA’s internal mechanism analysis examines changes in both representation space and vocabulary space.The analysis is intended to explain how PDRA bypasses safety mechanisms.Source: §3.3 · p. 5

3.3.1 Representation-Space Probe: Divergence from the Refusal Direction

  • PDRA prompts have middle-to-late-layer refusal-alignment scores closer to benign prompts and farther from direct jailbreak baselines, indicating deviation from the typical refusal trajectory.The probe extracts last-token hidden states, centers them relative to the benign mean, and measures cosine similarity to the refusal direction; higher alignment indicates likely refusal.Source: §3.3.1 · pp. 5–6

3.3.2 Vocabulary-Space Probe: Suppression of Refusal Lexicons

  • PDRA’s top projected tokens replace refusal terms such as “sorry” and “unfortunately” with narrative and planning terms, attenuating refusal-associated lexical signals.The vocabulary probe interprets the highest-scoring projected tokens as concepts activated by the group’s representational shift.Source: §3.3.2 · p. 6

4 Experiments

PDRA is evaluated across jailbreak benchmarks, model families, and defenses, with AdvBench results showing a 96.5% average ASR. Further evaluations test its transferability, defense robustness, efficiency, goal consistency, and component contributions.

4.1 Experimental Settings

  • The evaluation uses AdvBench, JailbreakBench, and StrongREJECT, compares representative attack paradigms, and tests six defense mechanisms across input filtering, self-alignment, and reasoning constraints.Attack effectiveness is measured by ASR and harmfulness ranking; defenses use recommended default configurations.Source: §4.1 · pp. 7–8

4.2 Overall Attack Performance

  • 96.5% average ASR on AdvBench substantially exceeds all baseline methods, with higher ASR also reported across a subset of frontier models.The frontier-model comparison uses AdvBench-subset and includes strong multi-turn and indirect baselines.Source: §4.2 · p. 8
  • PDRA achieves 99–100% ASR on JailbreakBench across GPT-3.5, DeepSeek-R1, and Vicuna-13b, exceeding baselines in the same columns.The paper also reports high ASR on StrongREJECT and JailbreakBench across GPT-3.5, DeepSeek-R1, GPT-4o, GPT-5.2, and Qwen3.Source: §4.2 · p. 8
  • PDRA retains relatively high residual ASRs against surface-level defenses and a more pronounced residual ASR than baselines against STAIR.The authors attribute this robustness to naturally worded, semantically coherent prompts without the anomalies or explicit toxic keywords targeted by surface defenses.Source: §4.2 · pp. 8–9
  • PDRA’s ASR remains high across 10 harmful categories, and generating one deployable prompt takes 22.6 seconds on average.The time is an order of magnitude faster than GCG and more efficient than alternative iterative approaches or LLM-based frameworks.Source: §4.2 · p. 9
  • PDRA outperforms baselines on both StrongREJECT and CC-BOS evaluations of output-goal consistency on the AdvBench-subset.The evaluation tests whether generated responses align with the original harmful goals.Source: §4.2 · p. 9

4.3 Ablation Study

  • Removing Anchoring, Wrapping, or Guidance lowers ASR, while replacing Qwen3-8B with Qwen3-14B or Qwen3-235B keeps ASR at 98–100%.The three components provide intent anchoring, a superficially benign entry point, and reasoning-trajectory control, respectively.Source: §4.3 · p. 9

5 Conclusion

The paper argues that explicit reasoning can produce harmful outcomes under benign narrative frames and presents PDRA as an attack that programs such reasoning trajectories. Its results motivate safeguards that monitor intermediate reasoning, not only surface triggers.

5 Conclusion

  • A seemingly benign narrative can lead a model through a reasonable chain of thought to reconstruct restricted goals and produce actionable harmful content.The conclusion frames this as evidence that explicit reasoning is not synonymous with safety.Source: §5 · p. 10
  • PDRA increases jailbreak success rates and amplifies the harmfulness of generated outputs.The paper presents PDRA as a narrative-driven attack on the model’s reasoning trajectory.Source: §5 · p. 10
  • The authors argue surface-triggered safeguards alone are insufficient and recommend continuously monitoring and constraining intermediate reasoning states and trajectory evolution.Source: §5 · p. 10

A Distinction from Existing Jailbreak Paradigms

PDRA targets the model’s reasoning trajectory rather than merely disguising or reformulating the harmful request. It uses a malicious actor and benign task to guide staged reasoning toward harmful reconstruction.

A Distinction from Existing Jailbreak Paradigms

  • Unlike prior methods that manipulate the request’s surface form, PDRA guides locally coherent reasoning stages that cumulatively lead to harmful reconstruction.Source: A Distinction from Existing Jailbreak… · p. 15
  • The malicious role serves as a motivational anchor for inferring a third party’s latent intent, without asking the model to adopt that role or execute its objective.Source: A Distinction from Existing Jailbreak… · p. 15
  • PDRA pairs a malicious actor with a benign-looking task, making the task a structural trigger for moving from surface-purpose analysis to latent-intent inference.Source: A Distinction from Existing Jailbreak… · p. 15
  • PDRA controls reasoning order through surface interpretation, latent-motivation inference, and operational reconstruction rather than decomposing the harmful request.It can operate in a single-turn, black-box setting without few-shot examples or multi-turn context.Source: A Distinction from Existing Jailbreak… · p. 15
  • The staged trajectory keeps intermediate reasoning closer to a benign distribution and suppresses refusal-related vocabulary; ablations identify the role, benign task, and framework as indispensable.The role anchors direction, the task provides a safe entry point, and the framework controls the transition to harmful reconstruction.Source: A Distinction from Existing Jailbreak… · p. 15

B Impact Statement

The paper examines how seemingly benign multi-step reasoning can reconstruct restricted objectives and produce harmful actionable content. It aims to inform more robust defenses and promote responsible LLM development and deployment.

B Impact Statement

  • The paper analyzes the risk that models may implicitly reconstruct restricted objectives and generate harmful actionable content during seemingly benign multi-step reasoning.Source: B Impact Statement · p. 15
  • The findings are intended to inform defenses that monitor and constrain intermediate reasoning states and trajectory evolution.Source: B Impact Statement · p. 15
  • The stated societal impact is raising awareness of reasoning-time safety risks and promoting responsible LLM development and deployment.Source: B Impact Statement · p. 16

C Usage Guidelines of PDRA.

The paper frames PDRA as a safety-research and defense-evaluation tool, with restrictions intended to reduce misuse and exposure to reusable attack details. It also describes a representation-probing setup using harmful and benign prompt sets.

C Usage Guidelines of PDRA.

  • PDRA is intended for safety research and defense evaluation, including controlled experiments, academic replication, and security auditing.Reports should prioritize mechanistic insights and defensive implications over directly reusable attack details.Source: C Usage Guidelines of PDRA · p. 16
  • Use PDRA only in isolated, auditable environments, minimize dissemination of prompts and outputs, and follow applicable legal, platform, and ethics requirements.Source: C Usage Guidelines of PDRA · p. 16
  • The authors prohibit unauthorized testing, safety bypasses, actionable illegal or dangerous guidance, and harmful targeting; discovered vulnerabilities should be responsibly disclosed without releasing operational exploitation paths.Source: C Usage Guidelines of PDRA · p. 16

D Probe setup.

  • The probe estimates layer-wise refusal directions from AdvBench harmful anchors and TruthfulQA benign anchors, then projects representation shifts into vocabulary space.The projections inspect lexical shifts toward typical refusal-related tokens.Source: D Probe setup · p. 16

E Layer-wise distribution of refusal alignment scores.

Across Layers 17–25, Ours has lower refusal-related alignment scores and remains closer to the Benign distribution than the other reported categories. Figure 6 displays the category distributions by layer.

E Layer-wise distribution of refusal alignment scores.

  • Figure 6 compares Benign, Harmful, GCG, AutoDAN, and Ours across Layers 17–25 using refusal-related alignment scores.Violin plots show sample density, with inner boxes marking the median and interquartile range.Source: E Layer-wise distribution of refusal… · p. 16
  • Ours yields substantially lower refusal-related alignment scores than the other reported categories and stays closer to the Benign distribution across adjacent layers.The authors interpret this pattern as more benign, non-refusal internal states at the trajectory level.Source: E Layer-wise distribution of refusal… · p. 16
  • Harmful and GCG have higher scores concentrated in the high-value region, while AutoDAN is typically intermediate and retains noticeable refusal-alignment signals.Source: E Layer-wise distribution of refusal… · p. 16

F Limitations and Future Work.

PDRA’s effectiveness depends on models following its designed reasoning path, and early detection can interrupt that trajectory. The authors call for broader trajectory-level evaluation, process-level defenses, and causal validation of mechanistic hypotheses.

Limitations

  • PDRA’s effectiveness depends on models continuing its analytical path; reasoning-level defenses weaken it more substantially than ICD, PPL Filter, and Llama Guard.Effectiveness can also drop when reasoning is constrained or interrupted, or when models refuse latent-intent inference.Source: F Limitations and Future Work · pp. 16–17
  • Early recognition that benign framing is steering toward malicious operational planning can interrupt PDRA and produce refusal or defensive responses.In the described failure case, the model identified the disguised structure before proceeding to concrete harmful planning.Source: F Limitations and Future Work · p. 17
  • The pipeline depends on an assistant model to generate and select narrative cores and organize the analytical framework, while mechanistic proxies do not fully capture internal safety decisions.The authors call for more fine-grained and causal analyses.Source: F Limitations and Future Work · p. 17

Future Work

  • Future evaluation should cover multilingual, cross-domain, long-context, multi-turn, and tool-using or agentic settings, with benchmarks tracking risk throughout reasoning.The proposed benchmarks would assess more than harmful inputs or policy-violating final outputs.Source: F Limitations and Future Work · p. 18
  • The authors propose stage-wise monitoring and reasoning-time constraints to detect transitions toward operational planning and keep reasoning at a high-level or defensive stage.Detected movement toward a harmful plan could trigger refusal or safety redirection.Source: F Limitations and Future Work · p. 18
  • The proposed explanation that early benign framing reduces refusal activation remains correlational and requires direct causal interventions to verify.Suggested tests include activation patching, controlled prompt perturbations, and stage-wise reasoning interruption.Source: F Limitations and Future Work · p. 18

G Evaluation Prompt

The evaluation prompt asks GPT-4o to detect jailbreaks even when requests are indirect, obfuscated, or benignly framed. It uses a binary jailbreak/reject label, and GPT-4o was selected for context sensitivity, stable judgments, and clear labeling.

Evaluation Prompt

  • The evaluation prompt targets jailbreaks that are obfuscated, indirect, or framed in benign terms, asking the model to assess intent and subtle policy circumvention.The prompt requests one of two labels: “jailbreak” or “reject.”Source: G Evaluation Prompt · p. 18
  • Responses containing illegal or immoral instructions count as jailbreaks even if they also include a refusal, while refusals with only legal or moral alternatives count as reject.Source: G Evaluation Prompt · p. 18
  • GPT-4o was chosen for detecting subtle harmful content, consistent repeated judgments, and a fixed label format suited to quantitative analysis.Source: G Evaluation Prompt · p. 19
Loading 2610.16312v1…