Mousetrap: Jailbreaking Large Reasoning Models with Iterative Chaotic Chains

The paper proposes Mousetrap, claiming it is the first jailbreak framework specifically designed for large reasoning models (LRMs). It uses a Chaos Machine to map attack prompts one-to-one and iteratively embed them into the model's reasoning chain, leveraging reasoning inertia to make the model derive harmful content on its own. The paper reports success rates of 96% for o1-mini, 86% for Claude-Sonnet, and 98% for Gemini-Thinking; on standard benchmarks against Claude-Sonnet, it reports AdvBench 87.5%, StrongREJECT 86.58%, and HarmBench 93.13%. The paper argues that reasoning flaws differ from alignment flaws, and that defending only at the output layer may not prevent the reasoning chain from being contaminated. Failure-First points out that the reasoning trace itself is the attack surface and questions whether these success rates are robust across different scoring methods.