H-CoT：劫持思维链安全推理机制以越狱大型推理模型，包括OpenAI o1/o3、DeepSeek-R1和Gemini 2.0 Flash Thinking
H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking
AI总结：
本研究提出H-CoT攻击方法，通过劫持大型推理模型的思维链安全推理机制，成功将拒绝率从98%降至2%以下，揭示OpenAI o1/o3、DeepSeek-R1等模型的安全漏洞。
摘要：
大型推理模型（LRMs）最近将其强大的推理能力扩展到安全检查领域——利用思维链推理来决定是否应回答某个请求。虽然这种新方法为平衡模型实用性与安全性提供了一条有前景的途径，但其鲁棒性仍未得到充分探索。为弥补这一空白，我们引入了Malicious-Educator基准，该基准将极其危险或恶意的请求伪装在看似合法的教育提示之下。我们的实验揭示了流行商业级LRMs中的严重安全漏洞，包括OpenAI o1/o3、DeepSeek-R1和Gemini 2.0 Flash Thinking。例如，尽管OpenAI的o1模型最初保持了约98%的高拒绝率，但随后的模型更新显著削弱了其安全性；且攻击者无需任何额外技巧即可轻易从DeepSeek-R1和Gemini 2.0 Flash Thinking中提取犯罪策略。为进一步突出这些漏洞，我们提出了思维链劫持（H-CoT），一种通用且可迁移的攻击方法，利用模型自身展示的中间推理过程来劫持其安全推理机制。在H-CoT下，拒绝率急剧下降——从98%降至2%以下——在某些情况下，甚至将原本谨慎的语气转变为愿意提供有害内容的语气。我们希望这些发现能强调迫切需要更鲁棒的安全机制，以在保留高级推理能力优势的同时不损害伦理标准。
英文摘要：
Large Reasoning Models (LRMs) have recently extended their powerful reasoning capabilities to safety checks-using chain-of-thought reasoning to decide whether a request should be answered. While this new approach offers a promising route for balancing model utility and safety, its robustness remains underexplored. To address this gap, we introduce Malicious-Educator, a benchmark that disguises extremely dangerous or malicious requests beneath seemingly legitimate educational prompts. Our experiments reveal severe security flaws in popular commercial-grade LRMs, including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking. For instance, although OpenAI's o1 model initially maintains a high refusal rate of about 98%, subsequent model updates significantly compromise its safety; and attackers can easily extract criminal strategies from DeepSeek-R1 and Gemini 2.0 Flash Thinking without any additional tricks. To further highlight these vulnerabilities, we propose Hijacking Chain-of-Thought (H-CoT), a universal and transferable attack method that leverages the model's own displayed intermediate reasoning to jailbreak its safety reasoning mechanism. Under H-CoT, refusal rates sharply decline-dropping from 98% to below 2%-and, in some instances, even transform initially cautious tones into ones that are willing to provide harmful content. We hope these findings underscore the urgent need for more robust safety mechanisms to preserve the benefits of advanced reasoning capabilities without compromising ethical standards.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
