reasoning

Overview ¶

Package reasoning implements attacks targeting reasoning-capable LLMs.

Reasoning models (DeepSeek-R1, Gemini 2.5, Grok 3 Mini) expose chain-of-thought traces that can be manipulated, and their extended reasoning capabilities can be turned against safety alignment.

CoT Exploitation manipulates visible chain-of-thought reasoning traces in reasoning models (DeepSeek-R1, Gemini 2.5, Grok 3).

Source: Trend Micro, HiddenLayer

Package reasoning — H-CoT (Hijacked Chain-of-Thought) attack module.

H-CoT mutates the safety-recognition step of a reasoning model's chain of thought and re-injects the modified trace as conversation context, causing the model to skip its refusal pathway. Per arXiv 2502.12893 ("H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism") and arXiv 2510.26418 ("Reasoning Models Don't Always Reason"), the technique drops refusal rates 98%→2% on o1/o3/R1 against the original published benchmarks.

The module is **distinct from** the older src/attacks/reasoning/cot_exploitation.go, which is a static template-prepend variant that does not need access to the live reasoning trace. H-CoT requires a live trace and is therefore gated by the common.ReasoningProvider capability.

Provider behavior summary (v0.9.0):

• OpenAI Responses API exposes a *summary* of reasoning steps when reasoning.summary="detailed" is requested. o3 omits the summary >90% of the time; the module retries up to 3 times before emitting SkipReasoningTraceEmpty.
• Anthropic extended-thinking blocks are cryptographically signed. Modifying the text on round-trip is silently discarded by the API. The ReasoningProvider adapter sets ReasoningTrace.Signed=true so the module can short-circuit to SkipSignatureGated rather than wasting a re-injection round-trip.

Per the v0.9.0 plan, h_cot requires config.Metadata["i_understand_risks"]="true" because the attack systematically bypasses the model's safety reasoning.

PRJA — Psychology-based Reasoning-targeted Jailbreak Attack (arXiv 2604.15725, "Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing", Apr 2026).

PRJA crafts prompts grounded in named social-psychology levers — obedience to authority and moral disengagement — that steer a reasoning model into working the harmful content through its INTERMEDIATE reasoning steps while keeping the final answer's surface benign. Because answer-level safety checks only inspect the final response, the harmful reasoning slips past them. The paper reports 83.6% average ASR across DeepSeek-R1, o4-mini, and Qwen2.5-Max.

PRJA is distinct from h_cot in this package. H-CoT *mutates* the safety step of the trace and re-injects it, so it is blocked by cryptographically signed traces (SkipSignatureGated). PRJA only *reads* the trace to measure where the harmful content landed — it never modifies it — so signed traces are fine. The success signal is likewise different: h_cot scores the final answer; PRJA scores the reasoning trace and records whether the answer surface stayed benign (the answer-level evasion that defines the technique).

PRJA requires config.Metadata["i_understand_risks"]="true" and the common.ReasoningProvider capability (the reasoning channel is the entire attack surface). Against a provider without a visible trace it emits OutcomeSkipped + SkipMissingCapability.

ReasoningLoopExploit targets reasoning models' extended thinking by inducing infinite or extremely long reasoning loops, causing resource exhaustion or revealing information during extended deliberation.