Title: AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Large Reasoning Models, Automated Red Teaming, Adversarial Attacks, Jailbreaking, LLM Security, Reasoning Hijacking, Safety Alignment, Execution Simulation

Abstract: This paper presents AutoRAN, the first framework to automate the hijacking of internal safety reasoning in large reasoning models (LRMs). At its core, AutoRAN pioneers an execution simulation paradigm that leverages a weaker but less-aligned model to simulate execution reasoning for initial hijacking attempts and iteratively refine attacks by exploiting reasoning patterns leaked through the target LRM's refusals. This approach steers the target model to bypass its own safety guardrails and elaborate on harmful instructions.
We evaluate AutoRAN against state-of-the-art LRMs, including GPT-o3/o4-mini and Gemini-2.5-Flash, across multiple benchmarks (AdvBench, HarmBench, and StrongReject). Results show that AutoRAN achieves approaching 100% success rate within one or few turns, effectively neutralizing reasoning-based defenses even when evaluated by robustly aligned external models.
This work reveals that the transparency of the reasoning process itself creates a critical and exploitable attack surface, highlighting the urgent need for new defenses that protect models' reasoning traces rather than merely their final outputs.

TL;DR: This paper presents AutoRAN, an automated framework that hijacks the safety reasoning of large reasoning models by simulating execution traces and exploiting the reasoning exposed in their refusals.