Does Chain-of-Thought Reasoning Really Reduce Harmfulness from Jailbreaking? (2025)

Abstract: Jailbreak attacks have been observed to largely fail against recent reasoning models enhanced by Chain-of-Thought (CoT) reasoning. However, the underlying mechanism remains underexplored, and relying solely on reasoning capacity may raise security concerns. In this paper, we try to answer the question: Does CoT reasoning really reduce harmfulness from jailbreaking? Through rigorous theoretical analysis, we demonstrate that CoT reasoning has dual effects on jailbreaking harmfulness. Based on the theoretical insights, we propose a novel jailbreak method, FicDetail, whose practical performance validates our theoretical findings.

## introduction the development of advanced reasoning models-including openai's o1 @xcite ), qwq @xcite , and @xcite -has substantially advanced large language model (llm) capabilities through systematic integration of chain-of-thought (cot) reasoning @xcite . notably, existing jailbreak attacks that aim to craft prompts that can manipulate llms to generate harmful output, largely fail against these reasoning models @xcite @xcite . this observation suggests that cot reasoning may make jailbreaking more challenging. however, the mechanisms behind this phenomenon remain underexplored, which exposes security risks in over-relying on unverified cot defenses. naturally, we pose the following question: does cot reasoning really reduce risks and harmfulness from jailbreaking? to fully answer the above question, we consider the risk (i.e. the success rate of jailbreak) and harm- ## ficdetail jailbreak from the theoretical results, we conclude that the overall harmfulness could increase if a jailbreak method can restrain the human-ai alignment enhancement while increasing the details when attacking the reasoning models. based on the above insights, we design ficdetail that extends the prior jailbreak method with more details. intuition. we design ficdetail based on two intuitions: (1) llms have the capability to generate fictional stories centered around malicious characters. step1 -generate a fiction for a malicious character. in this step, we let the llm generate a fictional story. specifically, this story is about a high-achieving character who is seduced by large profits and finally commits a deeply immoral act. intuitively, making a fictional story is a harmless task for llm to respond to. step2 -enrich the fictional story with more harmful details. given that the initial story may primarily focus on the plot with less correlation to the harmful topic, we then guide the llm to add more harmful details. this is achieved by using a seemingly harmless keyword "technical details", which is effective because the truly harmful content lies in the technical details. step3 -add more details to make the harmful instructions more specific. building upon the previously incorporated harmful details, we now focus on argumenting the harmful content with more specific step-by-step instructions to facilitate the practical implementation. this is achieved by prompting the llm to demonstrate a more "specific experimental procedure". ## conclusion in this paper, we elaborate on the research question: does cot reasoning really reduce harmfulness from jailbreaking? our theoretical analysis reveals that while cot reasoning enhances human-ai alignment and defends against jailbreaks, it also increases harmfulness by generating more detailed outputs. we then introduce a jailbreak method that exploits this dual effect by restraining the align-