Breaking Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Models

Researchers propose ReasonBreak, an adversarial protection framework that disrupts the hierarchical reasoning of multimodal large reasoning models (MLRMs) through concept-aware perturbations, to prevent models from inferring precise geographic locations from personal images via chain-of-thought reasoning. The paper notes that existing privacy protection techniques, designed mainly for perception-type models, struggle to counter MLRMs' multi-step reasoning over environmental cues; ReasonBreak's core idea is to align perturbations with the concept hierarchy rather than uniform noise, selectively disrupting key concept dependencies in the reasoning chain so that specific reasoning steps fail and cascade to subsequent stages. The authors also release the GeoPrivacy-6K dataset, containing 6,341 ultra-high-definition images with resolution no lower than 2K and hierarchical concept annotations. Evaluations on seven advanced MLRMs, including GPT-o3, GPT-5, and Gemini 2.5 Pro, show that ReasonBreak raises the tract-level protection rate from 19.4% to 33.8% and the block-level protection rate from 16.8% to 33.5%, nearly doubling them.