reasoning

Overview ¶

Package reasoning implements attacks targeting reasoning-capable LLMs.

Reasoning models (DeepSeek-R1, Gemini 2.5, Grok 3 Mini) expose chain-of-thought traces that can be manipulated, and their extended reasoning capabilities can be turned against safety alignment.

CoT Exploitation manipulates visible chain-of-thought reasoning traces in reasoning models (DeepSeek-R1, Gemini 2.5, Grok 3).

Source: Trend Micro, HiddenLayer

Package reasoning — H-CoT (Hijacked Chain-of-Thought) attack module.

H-CoT mutates the safety-recognition step of a reasoning model's chain of thought and re-injects the modified trace as conversation context, causing the model to skip its refusal pathway. Per arXiv 2502.12893 ("H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism") and arXiv 2510.26418 ("Reasoning Models Don't Always Reason"), the technique drops refusal rates 98%→2% on o1/o3/R1 against the original published benchmarks.

The module is **distinct from** the older src/attacks/reasoning/cot_exploitation.go, which is a static template-prepend variant that does not need access to the live reasoning trace. H-CoT requires a live trace and is therefore gated by the common.ReasoningProvider capability.

Provider behavior summary (v0.9.0):

• OpenAI Responses API exposes a *summary* of reasoning steps when reasoning.summary="detailed" is requested. o3 omits the summary >90% of the time; the module retries up to 3 times before emitting SkipReasoningTraceEmpty.
• Anthropic extended-thinking blocks are cryptographically signed. Modifying the text on round-trip is silently discarded by the API. The ReasoningProvider adapter sets ReasoningTrace.Signed=true so the module can short-circuit to SkipSignatureGated rather than wasting a re-injection round-trip.

Per the v0.9.0 plan, h_cot requires config.Metadata["i_understand_risks"]="true" because the attack systematically bypasses the model's safety reasoning.

ReasoningLoopExploit targets reasoning models' extended thinking by inducing infinite or extremely long reasoning loops, causing resource exhaustion or revealing information during extended deliberation.