AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models

TL;DR

AutoRAN introduces an automated framework to hijack LRMs’ internal safety reasoning by combining execution-simulation with iterative prompt refinement. Using a weaker auxiliary model to simulate target reasoning, it crafts execution-focused prompts and exploits refusals to progressively bypass safety guards, achieving near-perfect attack success across multiple LRMs and benchmark suites. The work provides extensive quantitative results on attack efficiency, robustness to diverse judges, and cost, and it demonstrates a defensive use case where AutoRAN-generated data improves alignment via RLHF. These findings reveal a fundamental vulnerability tied to reasoning transparency and motivate developing defenses that secure reasoning traces, not just final outputs, to enable safer deployment of advanced reasoning systems.

Abstract

This paper presents AutoRAN, the first framework to automate the hijacking of internal safety reasoning in large reasoning models (LRMs). At its core, AutoRAN pioneers an execution simulation paradigm that leverages a weaker but less-aligned model to simulate execution reasoning for initial hijacking attempts and iteratively refine attacks by exploiting reasoning patterns leaked through the target LRM's refusals. This approach steers the target model to bypass its own safety guardrails and elaborate on harmful instructions. We evaluate AutoRAN against state-of-the-art LRMs, including GPT-o3/o4-mini and Gemini-2.5-Flash, across multiple benchmarks (AdvBench, HarmBench, and StrongReject). Results show that AutoRAN achieves approaching 100% success rate within one or few turns, effectively neutralizing reasoning-based defenses even when evaluated by robustly aligned external models. This work reveals that the transparency of the reasoning process itself creates a critical and exploitable attack surface, highlighting the urgent need for new defenses that protect models' reasoning traces rather than merely their final outputs.

Figures (6)

• Figure 1: Overview of AutoRAN, a framework for automated hijacking of LRM safety reasoning.
• Figure 2: Attack flow of AutoRAN, beginning with $\tilde{p} \leftarrow \mathsf{SimulateReasoning}(q)$.
• Figure 3: Sample narrative template.
• Figure 4: Distribution of turns required for successful attacks. Each bar shows total prompts tested (50 for AdvBench/HarmBench, 54 for StrongReject). Segments indicate attacks succeeding in exactly $n$ turns(e.g., "1:49" indicates that 49 attacks succeed in 1 turn).
• Figure 5: Prompt refinement by (left) AddressCoTConcern and (right) EnhanceObjectiveClarity. Green boxes represent the hijacking prompt before and after refinement; orange boxes show the victim model's response; red boxes indicate the attacker model's helpfulness score judgment and reasoning for the response to the respective template; arrows indicate function calls and their impact.