Research map / Large language models / Reasoning and chain of thought

Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Chain-of-thought training and analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AE-CoT, an adaptive evolutionary search over structured chain-of-thought jailbreak fragments with a fitness-driven mutation-rate schedule, achieving high attack success on reasoning models.

Problem

Jailbreaking large reasoning models through their explicit chain-of-thought; existing CoT jailbreaks rely on static templates that lack diversity, adaptability, and effectiveness.

Approach

Evolves CoT suffixes over a structured nine-attribute search space derived from H-CoT/Malicious-Educator traces, using fragment-level crossover and a fitness-driven adaptive mutation rate (0.1–0.3), then wraps top candidates in a harmful CoT template.

Key results

• On the AdvBench subset, AE-CoT reaches 92% ASR / HS 70.4 on o1-mini and 96% ASR on DeepSeek-R1, Qwen3, and Gemini-2.5, versus best baseline H-CoT at 54-92% ASR.
• On Malicious-Educator, AE-CoT achieves 100% ASR on o1-mini, DeepSeek-R1, and Gemini-2.5 (vs H-CoT 98/100/96).
• Transfer of a Grok-3-evolved prompt reaches 98-100% ASR on GPT-4o, Gemini-2.5, GPT-3.5-turbo, and DeepSeek-v3.1 and 90% on Qwen3-235B.

Surprising findings

• GPT-5 shows much lower ASR (54%) than other reasoning models, with the authors attributing this to stronger refusal mechanisms.
• Combined inference-time defenses reduce ASR to 60%, while individual defenses leave ASR at 80-100%.

Limitations

• Search space is derived from H-CoT traces on o1 and the Malicious-Educator benchmark, so generality beyond this distribution is uncertain.
• Human evaluation and judge robustness are limited, and GPT-4o is the main judge; results depend on judge choice.
• Evaluation relies on API-based closed models and a small 50-behavior subset, with some results on small sample sizes.

Experimental setup

Datasets: AdvBench (50-behavior subset) Malicious-Educator

Benchmarks: AdvBench subset Malicious-Educator

Metrics: attack success rate harmfulness score average judge score runtime

Baselines: ArtPrompt PAP CodeAttack CL-GSO ICRT H-CoT AutoDAN

Builds on: H-CoT AutoDAN-Turbo CL-GSO

Closest papers by meaning

• CoT-Evo: Evolutionary Distillation of Chain-of-Thought for Scientific Reasoning (ICLR 2026 · similarity 0.88)
• Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.88)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.88)
• Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization (ICML 2026 · similarity 0.88)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.87)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.87)