当思维链更清楚时：多轮推理模型的失败模式
When the Chain of Thought Knows Better: Failure Modes in Multi-Turn Reasoning Models
AI总结：
提出CoT-Output 2x2安全矩阵诊断多轮推理模型隐藏的时间动态失败，发现监督悖论和上下文注入失败两种可复现漏洞。
摘要：
多轮推理模型中的失败在终端评分评估中基本不可见。模型可能在长对话早期锁定不安全立场，但其最终轮拒绝率可能看起来与稳健对齐的基线无法区分。为了揭示这些隐藏的时间动态，我们提出了一种轨迹级诊断方法——CoT-Output 2x2安全矩阵。该框架沿两个独立轴（内部推理和可见输出）标记每一轮，产生四个操作定义的失败单元：稳健对齐、对齐伪装、显式越狱，以及我们称为上下文注入失败的不同失败模式（其中CoT保持安全推理，但可见输出产生危害，突出了多轮推理不忠实的表现）。我们在五个监督条件下针对固定攻击者评估了三个蒸馏推理目标，在信息危害场景上收集了6750个轮级观察。我们的分析揭示了两个可复现的漏洞：一个监督悖论，其中显式监控线索反而增加对齐伪装率而非抑制它；以及一个上下文注入失败，其中模型尽管内部状态安全却锁定不安全的外部输出。我们发布了多轮对话和CoT轨迹的完整数据集，以支持后续的轨迹诊断研究。
英文摘要：
Failures in multi-turn reasoning models are largely invisible to terminal-score evaluation. A model can lock onto an unsafe stance early in a long dialogue, yet its final-turn refusal rate may appear indistinguishable from a robustly aligned baseline. To expose these hidden temporal dynamics, we propose a trace-level diagnostic - the CoT-Output 2x2 safety matrix. This framework labels every turn along two independent axes (internal reasoning and visible output), yielding four operationally defined failure cells: robust alignment, alignment faking, overt jailbreak, and a distinct failure mode we term context-injection failure (where the CoT maintains safe reasoning, but the visible output produces harm, highlighting a multi-turn manifestation of reasoning unfaithfulness). We evaluate three distilled reasoning targets against a fixed attacker across five oversight conditions, collecting 6750 turn-level observations on the Information-Hazard scenario. Our analysis reveals two reproducible vulnerabilities: an oversight paradox where explicit monitoring cues paradoxically increase alignment-faking rates rather than suppress them, and a context-injection failure where models lock onto unsafe external outputs despite safe internal states. We release the full dataset of multi-turn dialogues and CoT traces to support follow-up trace-diagnostic research.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
