mlsanityData to 14 Oct 2026

AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models

arXiv 2505.10846 ↗First posted 16 May 2025cs.LG cs.CRcited by 7

On the map: LLM reasoning → Reasoning for agents, planning and code

Abstract (arXiv)

This paper presents AutoRAN, the first framework to automate the hijacking of internal safety reasoning in large reasoning models (LRMs). At its core, AutoRAN pioneers an execution simulation paradigm that leverages a weaker but less-aligned model to simulate execution reasoning for initial hijacking attempts and iteratively refine attacks by exploiting reasoning patterns leaked through the target LRM's refusals. This approach steers the target model to bypass its own safety guardrails and elaborate on harmful instructions. We evaluate AutoRAN against state-of-the-art LRMs, including GPT-o3/o4-mini and Gemini-2.5-Flash, across multiple benchmarks (AdvBench, HarmBench, and StrongReject). Results show that AutoRAN achieves approaching 100% success rate within one or few turns, effectively neutralizing reasoning-based defenses even when evaluated by robustly aligned external models. This work reveals that the transparency of the reasoning process itself creates a critical and exploitable attack surface, highlighting the urgent need for new defenses that protect models' reasoning traces rather than merely their final outputs.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 41 of its 47 references that are in the map. First posted on arXiv 16 May 2025.

Builds on

41 of 47 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning12 May
  2. 2025Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models3 Mar
  3. 2025A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos19 Feb
  4. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking18 Feb
  5. 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilities17 Feb
  6. 2025OverThink: Slowdown Attacks on Reasoning LLMs4 Feb
  7. 2025Adversarial Reasoning at Jailbreaking Time3 Feb
  8. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan

Other references · 33

  1. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
  2. 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 9,379
  3. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  4. 2023Tree of Thoughts: Deliberate Problem Solving with Large Language Modelscited by 3,211
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  7. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  9. 2025Understanding R1-Zero-Like Training: A Critical Perspectivecited by 1,345
  10. 2025s1: Simple test-time scalingcited by 1,341
  11. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  12. 2022Red Teaming Language Models with Language Modelscited by 1,026
21 more
  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  2. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  3. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  4. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
  5. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 423
  6. 2024A StrongREJECT for Empty Jailbreakscited by 385
  7. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  8. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
  9. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 172
  10. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritizationcited by 170
  11. 2024Free Process Rewards without Process Labelscited by 165
  12. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 156
  13. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 134
  14. 2025LLMs Can Easily Learn to Reason from Demonstrations Structure, not content, is what matters!cited by 132
  15. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 111
  16. 2024Weak-to-Strong Jailbreaking on Large Language Modelscited by 107
  17. 2024The Benefits of a Concise Chain of Thought on Problem-Solving in Large Language Modelscited by 63
  18. 2024Boosting Jailbreak Attack with Momentumcited by 40
  19. 2024Leveraging the Context through Multi-Round Interactions for Jailbreaking Attackscited by 36
  20. 2024Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detectioncited by 23
  21. 2025PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Samplingcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 3.

7 papers.

  1. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  2. 2025Chain-of-Thought Hijackingcited by 16
  3. 2025Strong but Brittle: Simple Attacks Subvert Reasoning-based Safety Guardrailscited by 5
  4. 2026Do Reasoning LLMs Refuse What They Infer in Long Contexts?cited by 3
  5. 2025Red Teaming Large Reasoning Modelscited by 2
  6. 2026Safety Context Injection: Inference-Time Safety Alignment via Static Filtering and Agentic Analysiscited by 0
  7. 2026Attention-Guided Reward for Reinforcement Learning-based Jailbreak against Large Reasoning Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025ReasoningGuard: Safeguarding Large Reasoning Models with Inference-time Safety Aha Moments
  2. 2025Safety in Large Reasoning Models: A Survey
  3. 2025When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Models
  4. 2026Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models
  5. 2026Self-Guard: Defending Large Reasoning Models via enhanced self-reflection
  6. 2026TRACE: An Evidence-Grounded Benchmark for Safety Evaluation of Large Reasoning Models
  7. 2025HauntAttack: When Attack Follows Reasoning as a Shadow
  8. 2025SafeRBench: Dissecting the Reasoning Safety of Large Language Models