Safety in Large Reasoning Models: A Survey (2025)

Abstract: Large Reasoning Models (LRMs) have exhibited extraordinary prowess in tasks like mathematics and coding, leveraging their advanced reasoning capabilities. Nevertheless, as these capabilities progress, significant concerns regarding their vulnerabilities and safety have arisen, which can pose challenges to their deployment and application in real-world settings. This paper presents the first comprehensive survey of LRMs, meticulously exploring and summarizing the newly emerged safety risks, attacks, and defense strategies specific to these powerful reasoning-enhanced models. By organizing these elements into a detailed taxonomy, this work aims to offer a clear and structured understanding of the current safety landscape of LRMs, facilitating future research and development to enhance the security and reliability of these powerful models.

## introduction large language models (llms) @xcite @xcite have achieved remarkable proficiency across tasks ranging from open-domain conversation to program synthesis. central to their utility is reasoning: the ability to derive logically coherent conclusions by chaining together intermediate inferences. early work introduced chain-of-thought (cot) prompting, in which carefully designed prompts guide the model to articulate its step-by-step rationale @xcite . building on this idea, subsequent methods have enriched the reasoning process by incorporating additional mechanisms. self-critique frameworks enable a model to review and refine its own outputs @xcite ; plan-and-solve approaches decompose complex problems into ordered subgoals before execution @xcite ; debate protocols convene multiple agents to argue competing hypotheses and arrive at a consensus @xcite ; and structural transformations-such as tree-based deliberations @xcite or dynamically evolving tables of intermediate steps @xcite -reconfigure the underlying reasoning architecture to improve transparency and control. the recent release of openai's o1 series (openai, 2024) marks the emergence of large reasoning models (lrms), which are explicitly trained to produce richly formatted, human-readable reasoning traces. notable examples include @xcite , kimi-1.5 @xcite , and qwq @xcite , all of which leverage reinforcement learning to refine their deduction processes. lrms now set new benchmarks in mathematical problem solving @xcite , closed-book question answering @xcite , and code generation @xcite . as lrms become increasingly integrated into high-stakes domains-from scientific research to autonomous decision support-it is vital to rigorously assess their safety, robustness, and alignment. despite the existence of surveys on llm safety @xcite , the enhanced capabilities of lrms make it important to perform a dedicated analysis of their unique safety challenges. this paper aims to bridge this gap by providing a comprehensive examination of safety considerations specific to reasoning-enhanced models. ## background the success of modern lrms is deeply intertwined with advances in reinforcement learning @xcite , where agents learn decision-making policies through environ-mental interaction and reward feedback to maximize long-term returns @xcite . the integration of rl with deep neural networks has proven particularly effective in processing high-dimensional, unstructured data, as exemplified by breakthroughs like alphago's selfplay mastery of go and alphazero's generalization across chess variants @xcite . recent breakthroughs in reinforced fine-tuning (reft) paradigms, exemplified by deepseek models, have reinvigorated rl-based optimization for lrms @xcite . unlike conventional cot methods that optimize single reasoning trajectories, reft employs policy optimization to explore diverse reasoning paths through several key innovations: (1) multi-path exploration: generating multiple reasoning trajectories per query, overcoming cot's myopic optimization of single pathways. (2) rule-driven reward shaping: automating reward signals based on terminal answer correctness while preserving intermediate reasoning diversity. (3) dual-phase optimization: combining supervised fine-tuning (sft) with online rl for policy refinement. this paradigm demonstrates particular efficacy in complex multi-step tasks such as code generation, legal judgment analysis, and mathematical problem solving, where requiring models to maintain coherent reasoning across extended sequences while handling structured symbolic operations. ## safety risks of lrms the explicit reasoning processes that make lrms powerful introduce unique safety challenges even in non-adversarial scenarios, becoming potential vectors for harm during routine operation. we examine four key inherent safety risks: unsafe request compliance (sec. 3.1), multi-lingual safety disparities (sec. 3.3), concerning agentic behaviors (sec. 3.2), and multi-modal safety challenges (sec. 3.4). ## attacks on lrms this section categorizes attack methods targeting lrms based on their primary objectives. we identify four main categories: reasoning length attacks (sec. 4.1), answer correctness attacks (sec. 4.2), prompt injection attacks (sec. 4.3), and jail- safety in lrms: a survey defenses for lrms (sec. 5) guard models for lrms (sec. 5.3) reasoning-based guard model guardreasoner @xcite , thinkguard @xcite , x-guard @xcite classifier-based guard model llama guard 3 @xcite , aegis guard 2 @xcite , wildguard @xcite , shieldgemma @xcite , llama guard 3-vision (chi et al., 2024a), beaver guard-v @xcite inference-time defenses for lrms (sec. 5.2) safe decoding for reasoning zerothink/lessthink/morethink @xcite , thinking intervention @xcite inference-time scaling on reasoning inference-time compute @xcite safety alignment of lrms (sec. 5.1) ## defenses for lrms to mitigate safety risks and defend against attacks on lrms, various defense strategies have been proposed in recent research. we categorize these approaches into three main types: safety alignment (sec. 5.1), inference-time defenses (sec. 5.2), and guard models (sec. 5.3). ## future directions beyond our analysis of lrm safety, we identify key research priorities: (1) standardized evaluation benchmarks. the field needs benchmarks targeting reasoning-specific vulnerabilities to comprehensively test both safety and robustness of multistep reasoning processes. (2) domain-specific evaluation frameworks. healthcare, finance, and legal domains require specialized evaluation suites with expert-reviewed case studies and adversarial tests to ensure domain-appropriate accuracy and ethics. (3) human-in-the-loop alignment. interactive tools for expert inspection and refinement of reasoning traces can efficiently align lrms with stakeholder values and correct biases. ## conclusion this survey has comprehensively examined the emerging safety challenges posed by large reasoning models. through our analysis, we've identified several critical insights that distinguish lrm safety from traditional llms. first, lrms expose their reasoning chains, creating new attack surfaces where adversaries can manipulate intermediate steps rather than just outputs, enabling sophisticated attacks like reasoning-based backdoors and hijacking that target the deliberative process itself. second, traditional output-focused alignment methods prove insufficient for lrms, as harmful reasoning can persist internally even when final outputs appear safe, necessitating novel approaches that consider the entire reasoning trajectory. these insights underscore the need for specialized safety research targeting lrms, including standardized evaluation benchmarks for reasoning-specific vulnerabilities and human-in-the-loop alignment methods that can inspect and refine reasoning traces as these powerful models continue to advance into increasingly critical domains.