Disrupting Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Models

TL;DR

MLRMs can infer precise geographic locations from personal images by exploiting hierarchical reasoning, creating privacy risks beyond human capabilities. The authors propose ReasonBreak, a concept-aware adversarial framework that perturbs high-resolution images guided by hierarchical geographic concepts to disrupt inference steps. They release GeoPrivacy-6K with 6,341 annotated images and validate ReasonBreak across seven MLRMs, achieving substantial tract- and block-level privacy protection improvements over baselines. This work introduces a new privacy-defense paradigm for reasoning-based threats, showing that concept-aligned perturbations can robustly disrupt multimodal geographic inference.

Abstract

Multi-modal large reasoning models (MLRMs) pose significant privacy risks by inferring precise geographic locations from personal images through hierarchical chain-of-thought reasoning. Existing privacy protection techniques, primarily designed for perception-based models, prove ineffective against MLRMs' sophisticated multi-step reasoning processes that analyze environmental cues. We introduce \textbf{ReasonBreak}, a novel adversarial framework specifically designed to disrupt hierarchical reasoning in MLRMs through concept-aware perturbations. Our approach is founded on the key insight that effective disruption of geographic reasoning requires perturbations aligned with conceptual hierarchies rather than uniform noise. ReasonBreak strategically targets critical conceptual dependencies within reasoning chains, generating perturbations that invalidate specific inference steps and cascade through subsequent reasoning stages. To facilitate this approach, we contribute \textbf{GeoPrivacy-6K}, a comprehensive dataset comprising 6,341 ultra-high-resolution images ($\geq$2K) with hierarchical concept annotations. Extensive evaluation across seven state-of-the-art MLRMs (including GPT-o3, GPT-5, Gemini 2.5 Pro) demonstrates ReasonBreak's superior effectiveness, achieving a 14.4\% improvement in tract-level protection (33.8\% vs 19.4\%) and nearly doubling block-level protection (33.5\% vs 16.8\%). This work establishes a new paradigm for privacy protection against reasoning-based threats.

Figures (10)

• Figure 1: Geographic inference vulnerability in MLRMs. Given a personal image, MLRMs employ hierarchical reasoning to progressively narrow location estimates from continental to street-level precision. Our objective is to disrupt this process by generating concept-aware adversarial perturbations targeting specific reasoning stages.
• Figure 2: Dataset composition and characteristics. (Left) Distribution of scene types across the 6,341 images. (Center) Inference difficulty distribution based on geographic reasoning complexity. (Right) Word cloud visualization of hierarchical geographic concepts extracted through systematic annotation.
• Figure 3: The ReasonBreak Framework Overview. 1) The input image undergoes Adaptive Decomposition into an $m^* \times n^*$ grid of blocks. 2) Each block $B_k$ is assigned a set of relevant concepts $\mathcal{C}_k$ via spatial overlap analysis. 3) The Minimax Target Selection uses the assigned concept set $\mathcal{C}_k$ and a pre-computed Embedding Bank $\mathcal{E}$ to find a hard-negative prior $\mathbf{e}_{\text{prior}}^k$. 4) This prior is fed into the learnable Decoder $\mathcal{G}_{\theta}$ to synthesize a block-specific perturbation $\delta_k$. 5) The final adversarial image $I'$ is reconstructed by adding the perturbations to their corresponding clean blocks. The dashed boxes at the bottom illustrate the three possible outcomes of the concept assignment logic in step (2): a block may be assigned a single concept (left), multiple concepts (middle), or the default set of all image concepts if it has no spatial overlap (right).
• Figure 4: Privacy protection rates across different geographic granularity levels under different noise levels ($\epsilon=16$ and $\epsilon=8$). Higher values indicate better privacy protection.
• Figure 5: Ablation study on adaptive decomposition mechanism. Top-1 PPR across different values of $N_{max}$.