mlsanityData to 7 Oct 2026

Beyond a Single Direction: Chain-of-Thought Disrupts Simple Steering of Refusal

arXiv 2605.26772 ↗First posted 26 May 2026cs.AI cs.LGcited by 0

On the map: LLM reasoning → Prompting and chain-of-thought reasoning

Abstract (arXiv)

Large reasoning models (LRMs) generate chain-of-thought (CoT) traces before producing final outputs, introducing a dynamic internal state that may complicate control mechanisms such as refusal. Unlike instruction-tuned LLMs, where refusal is mediated by a single directional subspace, refusal in large reasoning models (LRMs) additionally depends on the CoT. In DeepSeek-R1-Distill-LLaMA-8B, activation steering reverses refusal in only 39% of cases when the CoT is kept fixed, but removing the CoT entirely increases this to 70%, indicating that the CoT actively reinforces refusal. In a two-stage intervention where the model regenerates its CoT under activation steering, refusal is reversed in 94% of cases, while the resulting CoT alone retains 48% of this effect even after steering is removed. This suggests that the CoT can carry and reconstruct the compliance signal independently. These findings indicate that refusal in LRMs is jointly encoded in residual stream activations and CoT. This joint activation makes LRM more robust against activation-level interventions alone, but exposes CoT to a possible alternative surface attack.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 14 of its 18 references that are in the map. First posted on arXiv 26 May 2026.

Builds on

14 of 18 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Where Do Reasoning Models Refuse?3 Jul
  2. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Models21 Mar
  3. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Models28 Jan

Other references · 11

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2024OpenAI o1 System Cardcited by 1,220
  6. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  8. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  9. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  10. 2025Chain-of-Thought Hijackingcited by 13
  11. 2025Why Safeguarded Ships Run Aground? Aligned Large Language Models' Safety Mechanisms Tend to Be Anchored in The Template Regioncited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025CoT is Not True Reasoning, It Is Just a Tight Constraint to Imitate: A Theory Perspective
  2. 2026Post-Hoc Reasoning in Chain of Thought: Decoding and Steering Pre-Committed Answers
  3. 2026When does Chain-of-Thought Help: A Markovian Perspective
  4. 2025How Chain-of-Thought Works? Tracing Information Flow from Decoding, Projection, and Activation
  5. 2026Bypassing the Rationale: Causal Auditing of Implicit Reasoning in Language Models
  6. 2025Path Drift in Large Reasoning Models:How First-Person Commitments Override Safety
  7. 2026On the Generalization of Steering Vectors for Chain-of-Thought Faithfulness
  8. 2023Measuring Faithfulness in Chain-of-Thought Reasoning