Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs

Large Reasoning Models (LRMs) have demonstrated remarkable capabilities in reasoning and generation tasks and are increasingly deployed in real-world applications. However, their explicit chain-of-thought (CoT) mechanism introduces new security risks, making them particularly vulnerable to jailbreak attacks. Existing approaches often rely on static CoT templates to elicit harmful outputs, but such fixed designs suffer from limited diversity, adaptability, and effectiveness. To overcome these limitations, we propose an adaptive evolutionary CoT jailbreak framework, called AE-CoT. Specifically, the method first rewrites harmful goals into mild prompts with teacher role-play and decomposes them into semantically coherent reasoning fragments to construct a pool of CoT jailbreak candidates. Then, within a structured representation space, we perform multi-generation evolutionary search, where candidate diversity is expanded through fragment-level crossover and a mutation strategy with an adaptive mutation-rate control mechanism. An independent scoring model provides graded harmfulness evaluations, and high-scoring candidates are further enhanced with a harmful CoT template to induce more destructive generations. Extensive experiments across multiple models and datasets demonstrate the effectiveness of the proposed AE-CoT, consistently outperforming state-of-the-art jailbreak methods.

Modern AI chatbots are increasingly able to solve problems by writing out step-by-step reasoning. This makes them more useful, but it may also create new safety risks: if the reasoning process is guided in the wrong way, the model may be more likely to produce harmful answers. In this paper, we study this risk by developing AE-CoT, a method for automatically testing whether reasoning-based AI models can be tricked into unsafe behavior. Instead of using one fixed prompt, AE-CoT rewrites a harmful request into a milder teaching-style request, breaks the reasoning into smaller pieces, and then searches for combinations that are more likely to expose safety weaknesses. The search process is inspired by evolution: it keeps stronger candidates, mixes parts of them, and makes small changes over time. We test AE-CoT on several advanced AI models and safety benchmarks. The results show that reasoning-based models can still be vulnerable, and that our method is often more effective and efficient than previous testing methods. Our findings suggest that future AI safety work should not only check final answers, but also pay attention to how models reason before answering.