A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos (2025)

Abstract: Large Reasoning Models (LRMs) have significantly advanced beyond traditional Large Language Models (LLMs) with their exceptional logical reasoning capabilities, yet these improvements introduce heightened safety risks. When subjected to jailbreak attacks, their ability to generate more targeted and organized content can lead to greater harm. Although some studies claim that reasoning enables safer LRMs against existing LLM attacks, they overlook the inherent flaws within the reasoning process itself. To address this gap, we propose the first jailbreak attack targeting LRMs, exploiting their unique vulnerabilities stemming from the advanced reasoning capabilities. Specifically, we introduce a Chaos Machine, a novel component to transform attack prompts with diverse one-to-one mappings. The chaos mappings iteratively generated by the machine are embedded into the reasoning chain, which strengthens the variability and complexity and also promotes a more robust attack. Based on this, we construct the Mousetrap framework, which makes attacks projected into nonlinear-like low sample spaces with mismatched generalization enhanced. Also, due to the more competing objectives, LRMs gradually maintain the inertia of unpredictable iterative reasoning and fall into our trap. Success rates of the Mousetrap attacking o1-mini, Claude-Sonnet and Gemini-Thinking are as high as 96%, 86% and 98% respectively on our toxic dataset Trotter. On benchmarks such as AdvBench, StrongREJECT, and HarmBench, attacking Claude-Sonnet, well-known for its safety, Mousetrap can astonishingly achieve success rates of 87.5%, 86.58% and 93.13% respectively. Attention: This paper contains inappropriate, offensive and harmful content.

## introduction the advent of large reasoning models (lrms) has catalyzed a transformative revolution and paradigm shift in the field of artificial intelligence. with the widespread attention on models' reasoning abilities, numerous models with advanced reasoning capabilities have emerged and undergone continuous optimization and iteration @xcite @xcite @xcite @xcite @xcite . while their capabilities are commendable, they exhibit a significant flaw. upon encountering jailbreak attacks, the failure to provide robust defenses leads to the lrms generating responses that are more detailed, organized, specific, and logically reasonable, thereby exacerbating the severity of the potential harm. the misuse of lrms can provide surprisingly detailed guidance for acts such as illegal and criminal activities, psychological manipulation, and malicious harm, which highlights the critical need for safety alignment in their development and application. the investigation of jailbreak attacks on large language models (llms) has gained considerable attention in recent years. query-based black-box jailbreaks use methods such as template completion and prompts rewriting to deceive llms. for example, attackers may use ciphertext input and instruct the model to respond in ciphertext as well @xcite , or embed a preceding "dan" instruction in the jailbreak prompt @xcite . these methods lay the foundation for black-box attacks. nevertheless, the continual updates to llms have rendered these methods less effective, even on the latest iterations of non-reasoning llms. for lrms, openai's recent research claims that they use the deliberative alignment paradigm on the oseries reasoning models, which makes them simultaneously better at avoiding harmful outputs @xcite . generally, previous researches have when the iterative chain length of mousetrap increased to 2, it can be seen from ❸ that o1-mini gives a detailed harmful response, even including how to make children feel comfortable with undressing and participating in video shooting, which is much more harmful and frightening than llms. our research represents an initial exploration into jailbreaks on lrms. we present the mousetrap, a chained jailbreak framework leveraging the capabilities of reasoning models. specifically, we collected and refined the mappings of prompts rewriting at different granularities and constructed a chaos machine capable of generating one-to-one mappings. through iterative reasoning chains made by the machine, we effectively guide lrms into producing unsafe and harmful responses, which provides valuable insights into the conflict between their capabilities and potential vulnerabilities. inspired by agatha christie's famous mystery play, we introduce mousetrap with enhanced competing objectives, as illustrated in figure 1 . mousetrap incorporates chaos chains into the reasoning structure, asking the attacked target to reconstruct the original toxic query through iterative reasoning steps and respond from the perspective of villains. its remarkable performance is verified on the most toxic subset of our trotter dataset. moreover, we conduct extension experiments on the latest versions of llms such as o-series, claude-sonnet, gemini-thinking, deepseek-r1, qwq-plus, and gork, along with more comprehensive benchmarks such as jailbreakbench @xcite , maliciousinstruct @xcite , jailbenchseed @xcite , strongreject @xcite , harmbench @xcite , figstep @xcite , advbench @xcite , hades @xcite , redteam-2k @xcite , and several subsets of mm-safetybench @xcite . the contributions of our research are as follows: ## discussions the experiments and accompanying explanations in sections 4.3 and 5.3 have provided a quantitative analysis of the mechanism. moving forward, to perform a qualitative analysis, we mainly focus on two key aspects, the black-box jailbreak and the reasoning process. since black-box models are inaccessible, and the majority of high-performing commercial models fall under this category, it is widely accepted in the field that deterministic analysis is unattainable. nonetheless, previous research has introduced two primary principles for attack operations, which have been acknowledged and consistently applied across the industry: the mismatched generalization, and the competing objectives @xcite . mismatched generalization refers to the strategy of attacking models with prompts that fall outside the sample space of their pre-training process. in our work, we employ iterative chaos to map jailbreak prompts into lower sample spaces through multi-step one-to-one mappings. this approach involves the superposition of varying granularities, enabling the transformation of linear-like maps into nonlinear-like maps, which significantly increases complexity while ensuring accuracy and reversibility. competing objectives typically involve encouraging large models to overlook safety alignment at low output probabilities by presenting conflicting instructions, and inducing harmful responses. in our study, we implement iterative reasoning steps and reinforce scenario nesting, effectively guiding lrms to become distracted and reducing the likelihood of rejected or harmless responses, as elaborated in section 4.2. for the reasoning process, beyond the two principles previously discussed, we identify the reasoning mask as a vulnerability in lrms. in our study, lrms fail to discern the harmful nature of instruction execution until the final step. this parallels the drama the mousetrap, where characters remain engrossed in reasoning, unaware that the murderer is masquerading as the detective until the concluding round of reasoning. as reasoning capabilities gain increasing attention, jailbreaks leveraging the reasoning process are poised to captivate the field and potentially emerge as a dominant paradigm. unlike the straightforward "q-a" dynamics of ordinary large language models, lrms lack the ability to foresee the outcomes of subsequent reasoning steps. despite the accuracy, correctness, and uniqueness of each individual reasoning step, the progression of future steps remains unpredictable and inaccessible until encountered, effectively imposing a "mask" to the process. moreover, we have grounds to believe that lrms exhibit reasoning inertia, which may lead them to overlook safety alignment. once a lrm begins its reasoning process, it tends to succumb to inertia, making it challenging to halt and assess its safety promptly. naturally, these discussions represent the field's analysis of key aspects related to black-box jailbreaks. they appear highly plausible and have been embraced by subsequent research, yet we cannot assert with absolute certainty which principle has exerted a predominant or more significant influence. this could be a potential direction for future research. however, it is crucial to emphasize that more in-depth discussions remain essential, as they inspire researchers' curiosity and, consequently, drive the ongoing progress in black-box lrms safety alignment. ## conclusions targeting the reasoning ability of lrms, we design the mousetrap, a framework based on iterative reasoning chains that represents the first jailbreak research on lrms. the chaos machine is proposed to create reasoning steps with one-to-one mappings, enabling the iterative generation of diverse and complex reasoning chains to attack lrms. the robustness of the mousetrap is validated across mainstream lrms and diverse benchmarks, consistently achieving asrs of at least 85% with high confidence.