Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Models

Test-Time Scaling (TTS) improves LLM reasoning by exploring multiple candidate responses and then operating over this set to find the best output. A tacit premise behind TTS is that sufficiently diverse candidate pools enhance reliability. In this work, we show that this assumption in TTS introduces a previously unrecognized failure mode. When candidate diversity is curtailed, even by a modest amount, TTS becomes much more likely to produce unsafe outputs. We present a reference-guided diversity reduction protocol (RefDiv) that serves as a diagnostic attack to stress test TTS pipelines. Through extensive experiments across open-source models (e.g. Qwen3, Mistral, Llama3.1, Gemma3) and two widely used TTS strategies (Monte Carlo Tree Search and Best-of-N), constraining diversity consistently signifies the rate at which TTS produces unsafe results. The effect is often stronger than that produced by prompts directly with high adversarial intent scores. This observed phenomenon also transfers across TTS strategies and to closed-source models (e.g. OpenAI o3-mini and Gemini-2.5-Pro), thus indicating that this is a general and extant property of TTS rather than a model-specific artifact. Additionally, we find that numerous widely used safety guardrail classifiers (e.g. Llama-Guard), are unable to flag the adversarial input prompts generated by RefDiv, demonstrating that existing defenses offer limited protection against this diversity-driven failure mode.

Large language models are increasingly designed to “think” before answering user queries, and are made to generate several possible responses after which the best one is selected using a "search" algorithm. This approach is called test-time scaling, and is assumed to improve safety because considering a wide range of answers should help models avoid responding harmfully. In this work, we show that this assumption can fail in some key ways. Interestingly, when the diversity of candidate responses is slightly reduced, these systems become much more likely to produce unsafe or harmful outputs. We develop a method that intentionally limits response diversity to stress test these systems and study their safety properties. Across many popular open-source and closed-source AI models, we find that lower diversity leads to substantially more unsafe behavior. We also find that several widely used AI safety guardrails fail to detect the generated harmful queries by our stress test as harmful. Our results reveal a broad safety risk in modern AI reasoning systems and suggest that maintaining diversity in generated responses may be important for keeping these systems safe.