Does Chain-of-Thought Reasoning Really Reduce Harmfulness from Jailbreaking?
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
Jailbreak attacks have been observed to largely fail against recent reasoning models enhanced by Chain-of-Thought (CoT) reasoning. However, the underlying mechanism remains underexplored, and relying solely on reasoning capacity may raise security concerns. In this paper, we try to answer the question: Does CoT reasoning really reduce harmfulness from jailbreaking? Through rigorous theoretical analysis, we demonstrate that CoT reasoning has dual effects on jailbreaking harmfulness. Based on the theoretical insights, we propose a novel jailbreak method, FicDetail, whose practical performance validates our theoretical findings.
Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 15 of its 24 references that are in the map. First posted on arXiv 23 May 2025.
Builds on
15 of 24 references.
Closest ancestors · 7
Same direction, newest first
- 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
- 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
- 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
- 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 8
- 2022Large Language Models are Zero-Shot Reasonerscited by 4,374
- 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2021Ethical and social risks of harm from Language Modelscited by 966
- 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 86
- 2024Quantile Regression for Distributional Reward Models in RLHFcited by 60
- 2025Nuclear Deployed: Analyzing Catastrophic Risks in Decision-making of Autonomous LLM Agentscited by 27
- 2025o3-mini vs DeepSeek-R1: Which One is Safer?cited by 24
Built on by
Citing papers per year: 2025: 3; 2026: 6.
9 papers.
- 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
- 2025Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Trainingcited by 12
- 2026Chain-of-Sanitized-Thoughts: Plugging PII Leakage in CoT of Large Reasoning Modelscited by 5
- 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patchescited by 5
- 2026The Echo Chamber Multi-Turn LLM Jailbreakcited by 4
- 2025Argument-Based Consistency in Toxicity Explanations of LLMscited by 2
- 2026Unreal Thinking: Chain-of-Thought Hijacking via Two-stage Backdoorcited by 2
- 2026Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMscited by 1
- 2026Aligned in Form, Not in Meaning: The Comprehension - Containment Decoupling of LLM Safety in Low-Resource Bangla Derogatory Speechcited by 0
- 2026Aligned in Form, Not in Meaning: The Comprehension - Containment Decoupling of LLM Safety in Low-Resource Bangla Derogatory Speech3 Aug 2026
- 2026Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs13 Apr 2026
- 2026Unreal Thinking: Chain-of-Thought Hijacking via Two-stage Backdoor10 Apr 2026
- 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches24 Mar 2026
- 2026The Echo Chamber Multi-Turn LLM Jailbreak9 Jan 2026
- 2026Chain-of-Sanitized-Thoughts: Plugging PII Leakage in CoT of Large Reasoning Models8 Jan 2026
- 2025Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training23 Oct 2025
- 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models4 Sep 2025
- 2025Argument-Based Consistency in Toxicity Explanations of LLMs23 Jun 2025
Similar, not cited
Close in wording, no citation either way
- 2026Hidden in Thought: Transferable Chain-of-Thought Artifacts Induce Harmful Behavior
- 2025Chain-of-Thought Hijacking
- 2026Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning
- 2026Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs
- 2025Multi-Turn Jailbreaks Are Simpler Than They Seem
- 2025Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions
- 2025Confusion is the Final Barrier: Rethinking Jailbreak Evaluation and Investigating the Real Misuse Threat of LLMs
- 2025A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos