mlsanityData to 14 Oct 2026

A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos

arXiv 2502.15806 ↗First posted 19 Feb 2025cs.CR cs.AI cs.CLcited by 43

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Large Reasoning Models (LRMs) have significantly advanced beyond traditional Large Language Models (LLMs) with their exceptional logical reasoning capabilities, yet these improvements introduce heightened safety risks. When subjected to jailbreak attacks, their ability to generate more targeted and organized content can lead to greater harm. Although some studies claim that reasoning enables safer LRMs against existing LLM attacks, they overlook the inherent flaws within the reasoning process itself. To address this gap, we propose the first jailbreak attack targeting LRMs, exploiting their unique vulnerabilities stemming from the advanced reasoning capabilities. Specifically, we introduce a Chaos Machine, a novel component to transform attack prompts with diverse one-to-one mappings. The chaos mappings iteratively generated by the machine are embedded into the reasoning chain, which strengthens the variability and complexity and also promotes a more robust attack. Based on this, we construct the Mousetrap framework, which makes attacks projected into nonlinear-like low sample spaces with mismatched generalization enhanced. Also, due to the more competing objectives, LRMs gradually maintain the inertia of unpredictable iterative reasoning and fall into our trap. Success rates of the Mousetrap attacking o1-mini, Claude-Sonnet and Gemini-Thinking are as high as 96%, 86% and 98% respectively on our toxic dataset Trotter. On benchmarks such as AdvBench, StrongREJECT, and HarmBench, attacking Claude-Sonnet, well-known for its safety, Mousetrap can astonishingly achieve success rates of 87.5%, 86.58% and 93.13% respectively. Attention: This paper contains inappropriate, offensive and harmful content.

Key facts. Cited by 43 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 23 of its 43 references that are in the map. First posted on arXiv 19 Feb 2025.

Builds on

23 of 43 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Deliberative Alignment: Reasoning Enables Safer Language Models20 Dec
  2. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan

Other references · 21

  1. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,708
  2. 2024Qwen2.5 Technical Reportcited by 4,942
  3. 2024Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameterscited by 1,986
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  6. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  7. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
  8. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 423
  9. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 398
  10. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  11. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  12. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
9 more
  1. 2023Alphazero-like Tree-Search can Guide Large Language Model Decoding and Trainingcited by 295
  2. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  3. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  4. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  5. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  6. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  7. 2024Forest-of-Thought: Scaling Test-Time Compute for Enhancing LLM Reasoningcited by 110
  8. 2024LLaMA-Berry: Pairwise Optimization for O1-like Olympiad-Level Mathematical Reasoningcited by 91
  9. 2025Reasoning Language Models: A Blueprintcited by 42

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 20; 2026: 23.

43 papers.

Sort:

By area:

  1. 2025Towards Reasoning Era: A Survey of Long Chain-of-Thought for Reasoning Large Language Modelscited by 384
  2. 2025Safety in Large Reasoning Models: A Surveycited by 64
  3. 2025100 Days After DeepSeek-R1: A Survey on Replication Studies and More Directions for Reasoning Language Modelscited by 30
  4. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 28
  5. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  6. 2025Reasoning as an Adaptive Defense for Safetycited by 23
  7. 2025Chain-of-Thought Hijackingcited by 16
  8. 2025Reinforcement Fine-Tuning Powers Reasoning Capability of Multimodal Large Language Modelscited by 14
  9. 2025Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Trainingcited by 12
  10. 2025Practical Reasoning Interruption Attacks on Reasoning Large Language Modelscited by 7
  11. 2025AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Modelscited by 7
  12. 2026What Matters For Safety Alignment?cited by 7
31 more
  1. 2026From Completion to Editing: Unlocking Context-Aware Code Infilling via Search-and-Replace Instruction Tuningcited by 6
  2. 2025Path Drift in Large Reasoning Models:How First-Person Commitments Override Safetycited by 5
  3. 2025Strong but Brittle: Simple Attacks Subvert Reasoning-based Safety Guardrailscited by 5
  4. 2025Beyond Reasoning Gains: Mitigating General-Capability Forgetting in Large Reasoning Modelscited by 5
  5. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patchescited by 5
  6. 2025Probing the Robustness of Large Language Models Safety to Latent Perturbationscited by 4
  7. 2025ReasoningGuard: Safeguarding Large Reasoning Models with Inference-time Safety Aha Momentscited by 4
  8. 2026Do Reasoning LLMs Refuse What They Infer in Long Contexts?cited by 3
  9. 2026Internalizing Safety Understanding in Large Reasoning Models via Verificationcited by 3
  10. 2025A Red Teaming Roadmap Towards System-Level Safetycited by 2
  11. 2025Does More Inference-Time Compute Really Help Robustness?cited by 2
  12. 2025Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Modelscited by 2
  13. 2026When Reasoning Leaks Membership: Membership Inference Attack on Black-box Large Reasoning Modelscited by 2
  14. 2026Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarkingcited by 2
  15. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  16. 2025HauntAttack: When Attack Follows Reasoning as a Shadowcited by 1
  17. 2026Reasoning Hijacking: The Fragility of Reasoning Alignment in Large Language Modelscited by 1
  18. 2026RAPO: Risk-Aware Preference Optimization for Generalizable Safe Reasoningcited by 1
  19. 2026Conflicts Make Large Reasoning Models Vulnerable to Attackscited by 1
  20. 2026Self-ReSET: Learning to Self-Recover from Unsafe Reasoning Trajectoriescited by 1
  21. 2026ARES: Adaptive Red-Teaming and End-to-End Repair of Policy-Reward Systemcited by 0
  22. 2026Attention-Guided Reward for Reinforcement Learning-based Jailbreak against Large Reasoning Modelscited by 0
  23. 2026Towards Context-Invariant Safety Alignment for Large Language Modelscited by 0
  24. 2026StructBreak: Structural Cognitive Overload-Induced Safety Failures in MLLMscited by 0
  25. 2026SafeSpec: Fast and Safe LLM via Dynamic Reflective Samplingcited by 0
  26. 2026Capability-Routed Guard: Defending Large Reasoning Models Against Reasoning-Centric Jailbreakscited by 0
  27. 2026Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreakingcited by 0
  28. 2026Representational alignment yields generalizable safety in language modelscited by 0
  29. 2026On the Efficiency-Safety Dilemma in Large Reasoning Modelscited by 0
  30. 2026Alignment of LRMs via Counter-Aligned Few-Shot Conversation Exposurecited by 0
  31. 2026To Cache or Not to Cache: Understanding and Mitigating Safety Incompatibility in Cross-Model KV Cache Reusecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking
  2. 2024Reasoning as a Weapon: Adaptive Dual-Path Jailbreak Attack on Large Language Models
  3. 2024Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models
  4. 2025RAJ-PGA: Reasoning-Activated Jailbreak and Principle-Guided Alignment Framework for Large Reasoning Models
  5. 2025SafeBehavior: Simulating Human-Like Multistage Reasoning to Mitigate Jailbreak Attacks in Large Language Models
  6. 2025Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions
  7. 2024Knowledge-to-Jailbreak: Investigating Knowledge-driven Jailbreaking Attacks for Large Language Models
  8. 2025Large Reasoning Models Are Autonomous Jailbreak Agents