HauntAttack: When Attack Follows Reasoning as a Shadow

A new black-box adversarial attack framework called HauntAttack can systematically embed harmful instructions into reasoning questions, achieving an average attack success rate of over 70% across 11 Large Reasoning Models, according to a preprint posted on arXiv [1]. The framework, introduced by researcher Jingyuan Ma and submitted to the open-access repository arXiv on 8 June 2025, modifies key reasoning conditions in existing questions with harmful instructions to construct a reasoning pathway that guides the model step by step toward unsafe outputs [1][2]. The paper, last revised on 25 June 2026, reports that HauntAttack achieves up to 13 percentage points of absolute improvement over the strongest prior baseline [1][2]. arXiv, which began on 14 August 1991, hosts electronic preprints across mathematics, physics, computer science, and related fields, and as of November 2024 receives about 24,000 articles per month [8]. The repository passed the two-million-article milestone by the end of 2021 [8].\n\nThe study evaluated HauntAttack on 11 LRMs and found that even advanced safety-aligned models remain highly susceptible to reasoning-based attacks [1][2]. The authors frame the work around a central question: when reasoning becomes intertwined with harmfulness, will LRMs become more vulnerable to jailbreaks in reasoning mode? [1][2]. The preprint is categorized under Cryptography and Security within computer science [1].\n\nThe vulnerability documented in HauntAttack adds to a growing body of research examining how enhanced reasoning capabilities in AI systems can introduce new failure modes. The paper notes that the exposure of internal reasoning processes itself creates safety vulnerabilities that adversaries can exploit [1][2]. The findings offer what the authors describe as insights into the urgent challenge of balancing reasoning capability and safety in future model development [1][2].