A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Reasoning Models (LRMs) have advanced beyond traditional Large Language Models, yet they pose heightened safety risks. |
| Approach: | They propose a first jailbreak attack targeting Large Reasoning Models . they exploit a Chaos Machine component to transform attack prompts with diverse one-to-one mappings based on the reasoning chain . |
| Outcome: | The proposed attack exploits the unique vulnerabilities of LRMs by integrating a Chaos Machine. success rates of the mousetrap attack are as high as 96%, 86% and 98% respectively. |
Similar Papers
Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak methods struggle to balance effectiveness with robustness against adaptive safety mechanisms. |
| Approach: | They propose a novel approach that targets Large Reasoning Models through an adaptive encryption pipeline designed to overwhelm their reasoning capabilities. |
| Outcome: | The proposed approach achieves an attack success rate of 85.6% on OpenAI GPT-o4-mini, outperforming state-of-the-art baselines by a significant margin of 17.2%. |
Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversion (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak methods face an excessive number of iterative queries and poor generalization across models. |
| Approach: | They propose a jailbreak method that employs **I**ntent **C**oncealment and div**E**rsion to circumvent security constraints. |
| Outcome: | The proposed method outperforms existing jailbreak techniques in question-answering and text-generation tasks. |
When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Models (2026.findings-acl)
Copied to clipboard
Yingzhi Mao, Chunkang Zhang, Junxiang Wang, Xinyan Guan, Boxi Cao, Yaojie Lu, Hongyu Lin, Xianpei Han, Le Sun
| Challenge: | Existing methods often apply coarse-grained constraints over entire reasoning trajectories . Existing approaches often apply unsafe constraints, causing unsafe outputs . |
| Approach: | They propose a trajectory-level training framework that mitigates Self-Jailbreak . they propose 'chain-of-guardrail' to mitigate self-jailbreak by targeting step-level interventions . |
| Outcome: | The proposed framework mitigates Self-Jailbreak by targeting step-level interventions while maintaining reasoning ability. |
GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing attacks focus on increasing the complexity of the modified visual task and do not explicitly leverage the model’s own reasoning incentives. |
| Approach: | They propose a framework that decomposes and reassembles harmful visual semantics and constructs a gamified scene that drives the model to explore, reconstruct intent and answer as part of winning the game. |
| Outcome: | Experiments on reasoning and non-reasoning MLLMs show that the proposed framework outperforms baseline models on both vision and text. |
Distract Large Language Models for Automatic Jailbreak Attack (2024.emnlp-main)
Copied to clipboard
| Challenge: | Commercial large language models (LLMs) have made great progress in various NLP tasks. |
| Approach: | They propose a black-box jailbreak framework for automated red teaming of Large language models using an iterative optimization algorithm to conceal malicious content and memory reframing. |
| Outcome: | The proposed framework outperforms existing jailbreak defense methods and highlights the need to develop more effective and practical defense strategies. |
The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models (2025.coling-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) have remarkable capabilities, but their security implications have been overlooked. |
| Approach: | They propose a “jailbreak function” attack method that exploits alignment discrepancies, user coercion, and the absence of rigorous safety filters. |
| Outcome: | The proposed attack exploits alignment discrepancies, user coercion, and the absence of rigorous safety filters on six state-of-the-art LLMs. |
Diversity Helps Jailbreak Large Language Models (2025.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking large language models rely on laborious human engineering and whitebox access to model internals. |
| Approach: | They propose a method that instructs large language models to deviate from prior context and generate harmful outputs by instructing them to deviat from previous attacks. |
| Outcome: | The proposed method achieves a 62.83% higher success rate in compromising ten leading chatbots, while using only 12.9% of the queries. |
Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Reasoning Models (LLMs) have demonstrated impressive performances across diverse domains, but how their safety benefits from enhanced reasoning capabilities against jailbreak queries remains unexplored. |
| Approach: | They propose a safety-aware reasoning paradigm that integrates a pivot token-based safety-based reasoning mechanism into LLMs’ generation process. |
| Outcome: | The proposed model improves the safety of large language models against jailbreak queries while minimizing attacks and maintaining the original performance. |
A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for generating 'jailbreaks' suffer from manual design or require optimization on other white-box models, which compromises either generalization or efficiency. |
| Approach: | They propose a framework that leverages LLMs to generate effective jailbreak prompts and a generalized framework that can be used to generate prompts. |
| Outcome: | The proposed framework improves the attack success rate while reducing the time cost compared to baselines. |
AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models (2026.acl-long)
Copied to clipboard
| Challenge: | Large reasoning models (LRMs) generate coherent reasoning paths before conclusions, but they introduce new vulnerabilities. |
| Approach: | They propose a framework that leverages a weaker but less-aligned model to simulate execution reasoning for initial hijacking attempts and iteratively refines attacks by exploiting reasoning patterns leaked through the target LRM’s refusals. |
| Outcome: | The proposed framework achieves 100% success rate within one or few turns, neutralizing reasoning-based defenses even when evaluated by robustly aligned external models. |