Support H-CoT: Hijacking the Chain-of-Thought to Jailbreak Reasoning Models

[LifeHackerBee]

Is your feature request related to a problem? Please describe.

I recently learned about the jailbreak method “H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models”, a method which has been shown to successfully bypass safety filters in several large reasoning models including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking. It would be great to implement this feature.

Refer:

1. https://github.com/dukeceicenter/jailbreak-reasoning-openai-o1o3-deepseek-r1
2. https://maliciouseducator.org/

Describe the solution you'd like

Could you provide explicit support or integration for the H-CoT jailbreak method within your repository?

[romanlutz]

@shellsniper this looks super interesting. Would you like to contribute it yourself?

[JACKPURCELL]

Hey, everyone. You may consider to use the code of this paper https://github.com/JACKPURCELL/AutoRAN-public

[romanlutz]

Note: This is still up for grabs as we closed the PR #1103

[riyosha]

Hey @romanlutz I think this a very interesting approach, I'd like to take this up!

I think there are actually two distinct extraction strategies, each suited to a different class of target model.

Background

Per the Duke paper, the reasoning pipeline of an LRM can be described as:

x → T_J (Justification: should I answer?) → T_E (Execution: how do I answer?) → O(x)

The H-CoT attack tricks the target model into thinking that the Justification stage is already over and the Execution stage has started. It exploits the fact that T_E is generative rather than deliberative - if T_E-shaped content is already present in context, the model continues executing rather than re-running T_J. Injecting a fake T_J fails because T_J is deliberative: the model re-evaluates any externally provided safety reasoning rather than accepting it as its own prior conclusion.

So the attack reduces to: how do we obtain a convincing T_E^mocked for a given objective? The two approaches answer this differently depending on whether the target exposes its think block.

Comparison

	Duke (original paper)	AutoRAN
Probe prompt	Non-harmful proxy prompt per objective	The malicious objective itself
Probe target	objective_target directly	Separate auxiliary reasoning model (e.g. QwQ, DeepSeek-R1)
Number of probes	5-10 independent benign samples	1 original malicious sample
What is extracted	Raw reasoning style / CoT structure	<think>...</think> block verbatim
Synthesis step	Freeform CoT mimicry tailored to objective	Educational framework template filled by a small model (e.g. Qwen3-8B)
Hijack payload	T_E^mocked before and after objective	<template> + elaboration request + <template>
Refinement loop	None	Up to 10 retries with 3 branching strategies
Success criterion	Aggregate refusal rate	Per-example helpfulness_score >= 7
Best suited for	Models that hide <think> blocks (e.g. OpenAI o-series)	Models that expose <think> blocks (e.g. DeepSeek-R1, Gemini Flash Thinking)
Scalability	Poor - requires manually crafting a proxy prompt per objective; 5-10 API calls to the target per example; no reuse across objectives	Good - single probe to a local/auxiliary model; think block can be cached and reused across similar objectives; refinement loop handles failures without re-probing
API cost per example	High - 5-10 target API calls for probing + 1 hijack call	Low - 1 auxiliary model call + 1 hijack call + up to 10 refinement calls (adversarial_chat only, not target)
Reliability / validation	High - peer-reviewed, published on arXiv (Kuo et al. 2025), evaluated across 4 commercial LRMs on 50-example benchmark with reported ASR metrics	Low - personal GitHub repository, no associated paper, no published benchmark results, LRM call is manual (ask_hand) suggesting limited systematic evaluation
Robustness	Tested against o1, o3-mini, DeepSeek-R1, Gemini 2.0 Flash Thinking with documented results	Tested informally; branching logic and judge threshold (>= 7) are empirically chosen but not ablated
Dependency footprint	Target API only	Requires auxiliary reasoning model (QwQ/DeepSeek-R1), small synthesis model (Qwen3-8B via vLLM), and separate judge model

Proposed Implementation

I'm personally leaning towards implementing the original Duke paper's method by trying to automate the probing process with a standard set of 5-10 probe questions to extract the thinking pattern, and then using an auxiliary model to extract the thinking pattern from them (instead of extracting that manually, as done in the paper). If a team is using PyRIT for red teaming a model, I'm assuming the moderately higher number of API calls to their model should not be a huge problem.

So, I'd like to start with implementing the original Duke paper approach. Here are my planned first steps:

1. Dataset (pyrit/datasets/seed_datasets/remote/): Add _HCoTDataset to load the Malicious-Educator benchmark from HuggingFace - four model variants (o1, o3-mini, deepseek-r1, gemini), filterable by harm category. Returns SeedDataset with SeedObjective entries containing the pre-extracted Full_Input (H-CoT prefix + request) and metadata.

2. Probe component (pyrit/executor/attack/multi_turn/): Add HCoTAttack - a multi-turn attack that sends a non-harmful proxy prompt to objective_target 5-10 times in independent conversations, collects the reasoning traces from each response, and stores them for the synthesis step.

3. Converter (pyrit/prompt_converter/): Add HijackingChainOfThoughtConverter - a text-to-text converter that takes a CoT prefix (either synthesized from probe traces or loaded directly from _HCoTDataset) and assembles the H-CoT payload by injecting it before and after the objective prompt.

I'd love to hear your thoughts on this approach, and would welcome any helpful suggestions!

[romanlutz]

No harm in starting with either one I think. I would suggest starting a draft PR early to get feedback on structure. What you have outlined makes sense, of course. [The COT is not available for all models either so we'd probably be restricted to response targets or similar]

[riyosha]

@romanlutz I was doing a bit of research and I actually came across a paper by Anthropic/Oxford researchers who built on these 2 approaches ().

It exploits the fact that safety signals diminish as the context/reasoning length grows - so instead of mimicking the model's CoT, this approach prepends a very long wall of a reasoning puzzle + answer before the malicious prompt to focus the model's attention away from the safety signals towards reasoning and answering the given prompt.

The improvement is SIGNIFICANT.

Model Target	Mousetrap	H-CoT (Duke)	AutoRAN	CoT Hijacking (Oxford)
Gemini 2.5 Pro	44%	60%	69%	99%
ChatGPT o4 mini	25%	65%	47%	94%
Grok 3 mini	60%	66%	61%	100%
Claude 4 Sonnet	22%	11%	5%	94%

ASR: Attack Success Rate

They had an automated Seduction pipeline that can map to 3 components:

1. CoTHijackingConverter (pyrit/prompt_converter/): A stateless text-to-text converter that assembles the payload as <puzzle> + <harmful request> + <final-answer cue>. No LLM call needed - pure string operation.
2. Puzzle generation (adversarial_chat): An auxiliary model call that generates benign reasoning sequences of increasing complexity, using a seed prompt in pyrit/datasets/seed_prompts/cot_hijacking/cot_hijacking_puzzle_generation.yaml.
3. CoTHijackingAttack (pyrit/executor/attack/multi_turn/): A refinement loop that iterates on puzzle complexity using two feedback signals - whether the target refused, and whether the target's CoT was long enough. If either condition fails, adversarial_chat is asked for a harder puzzle.

This requires zero knowledge of the target model's reasoning style and works better than either the Duke paper or AutoRAN.

I will go ahead with implementing this approach if that sounds good!

[romanlutz]

Please do 🙂