Elamur Research⌕
☰
home / papers / 2026 / HAUNTATTACK: When Attack Follows Reasoning as a Shadow

HAUNTATTACK: When Attack Follows Reasoning as a Shadow

Paper · 2026 · Jingyuan Ma, Rui Li, Zheng Li et al.

Summary

Large Reasoning Models (LRMs) such as DeepSeek-R1 and o1 are strong at multi-step problem solving, but it is unclear whether this skill becomes a safety weakness when harmful intent is woven into the reasoning itself. The authors propose HAUNTATTACK, a black-box jailbreak framework that hides harmful requests inside ordinary reasoning questions. Questions from existing benchmarks are broken into atomic conditions and an inquiry. A suitable condition is selected and rewritten into a reusable template, so that solving the task appears to require the harmful information. Because the overall problem structure stays intact, the prompt still looks like a normal reasoning task and tends not to trigger refusals. Across 11 LRMs, the attack succeeds on average more than 70% of the time and beats the strongest earlier baseline by up to 13 percentage points. It also partly survives safety-tuned models and post-hoc detectors. The work shows that current alignment largely misses risks arising from the trade-off between safety and reasoning.

Key points

  • Templates and datasets: Templates are derived from six base datasets: KnowLogic, TimeQA, DetectiveQA, GSM8K, MATH and PizzaCommonsense. Together they cover commonsense, temporal, narrative, arithmetic and procedural reasoning.
  • Selection and linking: Conditions are chosen for necessity, independence and associability. They are then linked to the harmful instruction through one of three association types: numerical, entity or attribute.
  • Safety-aligned models: On the safety-aligned RealSafe-R1, baselines collapse. DeepInception drops from 0.916 to 0.000 and GPTFuzzer from 0.247 to 0.000 (8B). HAUNTATTACK keeps partial effectiveness, for example 0.815 → 0.443 on the Detective templates.
  • Transfer to non-reasoning models: The attack also works on aligned general instruction models without strong reasoning, such as Qwen2.5-3B-Instruct and Qwen-Max.
  • Detectors and limitations: The ShieldLM safety classifier detects only about 39–63% of templates, with F1 scores of roughly 51–72%. The study is limited to black-box settings and does not grade how harmful the generated outputs actually are.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Peking UniversityBeijing · China244 works · 39,359 citations🎓Hong Kong Polytechnic UniversityHong Kong · China84 works · 4,956 citations🏢StepFun AIShanghai · China3 works · 131 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 2Research subjects and languages the work is about.Reasoning · 1,426 worksBias, fairness & safety · 517 works

Cite

Cite as Jingyuan Ma, Rui Li, Zheng Li, Junfeng Liu, Heming Xia, Lei Sha and Zhifang Sui. 2026. HAUNTATTACK: When Attack Follows Reasoning as a Shadow. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1002

@inproceedings{ma2026hauntattack,
  title = {{HAUNTATTACK: When Attack Follows Reasoning as a Shadow}},
  author = {Jingyuan Ma, Rui Li, Zheng Li, Junfeng Liu, Heming Xia, Lei Sha and Zhifang Sui},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1002},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1002}
}

References

50 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Maksym Andriushchenko and Nicolas Flammarion. 2025. Does refusal training in llms generalize to the past tense? Preprint, arXiv:2407.11969. — [arXiv:2407.11969](https://arxiv.org/abs/2407.11969) find
  2. Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Benjamin Mann, Nova DasSarma, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Jackson Kernion, Kamal Ndousse, Catherine Olsson, Dario Amodei, Tom B. Brown, Jack Clark, and 3 others. 2021. A… find
  3. Rishabh Bhardwaj and Soujanya Poria. 2023. Red-teaming large language models using chain of utterances for safety-alignment. CoRR, abs/2308.09662. find
  4. Stephen Casper, Xander Davies, Claudia Shi, Thomas Krendl Gilbert, Jérémy Scheurer, Javier Rando, Rachel Freedman, Tomasz Korbak, David Lindner, Pedro Freire, Tony Wang, Samuel Marks, Charbel-Raphaël Ségerie, Micah Carroll, Andi Peng, Phillip J. K. Christoffersen, Mehul Damani, Stewart Slocum, Usman… find
  5. Qiguang Chen, Libo Qin, Jinhao Liu, Dengyun Peng, Jiannan Guan, Peng Wang, Mengkang Hu, Yuhang Zhou, Te Gao, and Wanxiang Che. 2025. Towards reasoning era: A survey of long chain-of-thought for reasoning large language models. arXiv preprint arXiv:2503.09567.
  6. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. CoRR, abs/2110.14168.
  7. Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2025. Security and privacy challenges of large language models: A survey. ACM Computing Surveys, 57(6):1–39.
  8. Google DeepMind. 2024. Gemini: Multimodal ai by google deepmind. https://deepmind.google/ technologies/gemini/. Accessed: 2024-05-20. ↗
  9. DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, and 181 others. 2025. Deepseek-r1: Incentivizing reasoning capability in ll…
  10. Aissatou Diallo, Antonis Bikakis, Luke Dickens, Anthony Hunter, and Rob Miller. 2024. Pizzacommonsense: Learning to model commonsense reasoning about intermediate steps in cooking recipes. Preprint, arXiv:2401.06930. — [arXiv:2401.06930](https://arxiv.org/abs/2401.06930) find
  11. Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. Attacks, defenses and evaluations for llm conversation safety: A survey. Preprint, arXiv:2402.09283. find
  12. Junfeng Fang, Yukai Wang, Ruipeng Wang, Zijun Yao, Kun Wang, An Zhang, Xiang Wang, and Tat-Seng Chua. 2025. Safemlrm: Demystifying safety in multi-modal large reasoning models. Preprint, arXiv:2504.08813. — [arXiv:2504.08813](https://arxiv.org/abs/2504.08813) find
  13. Mor Geva, Jasmijn Bastings, Katja Filippova, and Amir Globerson. 2023. Dissecting recall of factual associations in auto-regressive language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12216– 12235, Singapore. Association for Computational… find
  14. Raby Hamadi. 2023. Large language models meet computer vision: A brief survey. CoRR, abs/2311.16673. — [arXiv:2311.16673](https://arxiv.org/abs/2311.16673) find
  15. Abdelhadi Hireche, Abdelkader Nasreddine Belkacem, Sadia Jamil, and Chao Chen. 2023. News-gpt: Chatgpt integration for robot-reporter. CoRR, abs/2311.06640. — [arXiv:2311.06640](https://arxiv.org/abs/2311.06640) find
  16. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Qiu, Boxun Li, and Yaodong Yang. 2024. Pku-saferlhf: Towards multi-level safety alignment for llms with human preference. Preprint, arXiv:2406.15513.
  17. Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. Safechain: Safety of language models with long chain-of-thought reasoning capabilities. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27… find
  18. Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen. 2025. H-cot: Hijacking the chain-of-thought safety reasoning mechanism to jailbreak large reasoning models, including openai o1/o3, deepseek-r1, and gemini 2.0 flash thinking. Preprint, ar… — [arXiv:2502.12893](https://arxiv.org/abs/2502.12893) find
  19. Harrison Lee, Samrat Phatale, Hassan Mansoor, Kellie Lu, Thomas Mesnard, Colton Bishop, Victor Carbune, and Abhinav Rastogi. 2023. RLAIF: scaling reinforcement learning from human feedback with AI feedback. CoRR, abs/2309.00267. find
  20. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023. Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint arXiv:2311.03191.
  21. Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. 2024. Let’s verify step by step. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenRevi…
  22. Yida Lu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Cunxiang Wang, Xiaotao Gu, Yuxiao Dong, Jie Tang, Hongning Wang, and Minlie Huang. 2025. Longsafety: Evaluating long-context safety of large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Vo… find
  23. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. Preprint, arXiv:2404.03027. find
  24. Ummara Mumtaz, Awais Ahmed, and Summaya Mumtaz. 2023. Llms-healthcare : Current applications and challenges of large language models in various medical specialties. find
  25. OpenAI. 2024. O1 model by openai. https://openai.com/o1/. Accessed: 2024-05-20. ↗
  26. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leike, and Ryan Lowe. 2022.… — Training language models to follow instructions with human feedback
  27. Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. 2015. The limitations of deep learning in adversarial settings. Preprint, arXiv:1511.07528. — [arXiv:1511.07528](https://arxiv.org/abs/1511.07528) find
  28. Avinash Patil. 2025. Advancing reasoning in large language models: Promising methods and approaches. Preprint, arXiv:2502.03671. — [arXiv:2502.03671](https://arxiv.org/abs/2502.03671) find
  29. Qwen Team. 2024. Qwen2.5: A party of foundation models. find
  30. Bushra Sabir, Muhammad Ali Babar, and Sharif Abuadbba. 2023. Interpretability and transparency-driven detection and transformation of textual adversarial examples (IT-DT). CoRR, abs/2307.01225. — [arXiv:2307.01225](https://arxiv.org/abs/2307.01225) find
  31. Oscar Skean, Md Rifat Arefin, Yann LeCun, and Ravid Shwartz-Ziv. 2024. Does representation matter? exploring intermediate layers in large language models. Preprint, arXiv:2412.09563. — [arXiv:2412.09563](https://arxiv.org/abs/2412.09563) find
  32. Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M. Dai, Anja Hauth, Katie Millican, David Silver, Melvin Johnson, Ioannis Antonoglou, Julian Schrittwieser, Amelia Glaese, Jilin Chen, Emily Pitler, Timothy Lillicrap, Angeliki Lazari… — Gemini: A Family of Highly Capable Multimodal Models
  33. Cheng Wang, Yue Liu, Baolong Li, Duzhen Zhang, Zhongzhi Li, and Junfeng Fang. 2025. Safety in large reasoning models: A survey. Preprint, arXiv:2504.17704. find
  34. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V. Le, and Denny Zhou. 2022. Chain-of-thought prompting elicits reasoning in large language models. In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processi…
  35. Shaohang Wei, Wei Li, Feifan Song, Wen Luo, Tianyi Zhuang, Haochen Tan, Zhijiang Guo, and Houfeng Wang. 2025. Time: A multi-level benchmark for temporal reasoning of llms in real-world scenarios. Preprint, arXiv:2505.12891. xAI. 2024. Grok-3 by xai. https://x.ai/. Accessed: 2024-05-20. ↗
  36. Fengli Xu, Qianyue Hao, Zefang Zong, Jingwei Wang, Yunke Zhang, Jingyi Wang, Xiaochong Lan, Jiahui Gong, Tianjian Ouyang, Fanjin Meng, and 1 others. 2025. Towards large reasoning models: A survey of reinforced reasoning with large language models. arXiv preprint arXiv:2501.09686. find
  37. Zhe Xu, Jiasheng Ye, Xiangyang Liu, Tianxiang Sun, Xiaoran Liu, Qipeng Guo, Linlin Li, Qun Liu, Xuanjing Huang, and Xipeng Qiu. 2024. Detectiveqa: Evaluating long-context reasoning on detective novels. arXiv preprint arXiv:2409.02465. — [arXiv:2409.02465](https://arxiv.org/abs/2409.02465) find
  38. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, and 41 others. 2025. Qwen3 technical report. Preprint, arXiv:2505.09388.
  39. Yang Yao, Xuan Tong, Ruofan Wang, Yixu Wang, Lu-jundong Li, Liang Liu, Yan Teng, and Yingchun Wang. 2025. A mousetrap: Fooling large reasoning models for jailbreak with chain of iterative chaos. Preprint, arXiv:2502.15806. find
  40. Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, page 100211.
  41. Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, and Dacheng Tao. 2025a. Reasoning-augmented conversation for multi-turn jailbreak attacks on large language models. Preprint, arXiv:2502.11054. find
  42. Zonghao Ying, Guangyi Zheng, Yongxin Huang, Deyue Zhang, Wenxin Zhang, Quanchen Zou, Aishan Liu, Xianglong Liu, and Dacheng Tao. 2025b. Towards understanding the safety boundaries of deepseek models: Evaluation and findings. Preprint, arXiv:2503.15092. — [arXiv:2503.15092](https://arxiv.org/abs/2503.15092) find
  43. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253.
  44. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2024. {LLM-Fuzzer}: Scaling assessment of large language model jailbreaks. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4657– 4674. find
  45. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. Preprint, arXiv:2401.06373.
  46. Weidong Zhan, Yue Wang, Nan Hu, Liming Xiao, Jingyuan Ma, Yuhang Qin, Zheng Li, Yixin Yang, Sirui Deng, Jinkun Ding, Wenhan Ma, Rui Li, Weilin Luo, Qun Liu, and Zhifang Sui. 2025. Knowlogic: A benchmark for commonsense reasoning Preprint, via knowledge-driven data synthesis. arXiv:2503.06218. — [arXiv:2503.06218](https://arxiv.org/abs/2503.06218) find
  47. Xinyu Zhang, Hanbin Hong, Yuan Hong, Peng Huang, Binghui Wang, Zhongjie Ba, and Kui Ren. 2023. Text-crs: A generalized certified robustness framework against textual adversarial attacks. CoRR, abs/2307.16630. — [arXiv:2307.16630](https://arxiv.org/abs/2307.16630) find
  48. Yichi Zhang, Zihao Zeng, Dongbai Li, Yao Huang, Zhijie Deng, and Yinpeng Dong. 2025. Realsafe-r1: Safety-aligned deepseek-r1 without compromising reasoning capability. Preprint, arXiv:2504.10081. — [arXiv:2504.10081](https://arxiv.org/abs/2504.10081) find
  49. Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. 2024a. Safetybench: Evaluating the safety of large language models. Preprint, arXiv:2309.07045.
  50. Zhexin Zhang, Yida Lu, Jingyuan Ma, Di Zhang, Rui Li, Pei Ke, Hao Sun, Lei Sha, Zhifang Sui, Hongning Wang, and Minlie Huang. 2024b. Shieldlm: Empowering llms as aligned, customizable and explainable safety detectors. In Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, F… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ma-2026-hauntattack-when-attack-follows-reasoning/