Unreal Thinking: Hijacking large language model chains of thought via a two-stage backdoor

The researchers propose a two-stage backdoor attack named TSBH that can hijack the chain of thought of large language models under trigger conditions. In the open-weight ecosystem, such manipulation can be embedded in lightweight adapters that are easy to distribute and can be attached to base models. To address the scarcity of malicious chain-of-thought data, the authors propose the MRTS reverse synthesis method, which constructs chains of thought aligned with outputs from prompt-output pairs rather than directly eliciting malicious chains of thought from aligned models; TSBH first induces a mismatch between the intermediate chain of thought and the malicious output under trigger conditions, then fine-tunes the model with MRTS-synthesized chains of thought that have lower embedding distance to the malicious output, to enhance semantic similarity. Experiments on multiple open-weight models show that the method can achieve trigger-activated chain-of-thought hijacking and maintain a quantifiable distinction between the hijacked state and the baseline state under the evaluation framework proposed by the authors. The authors also explore reasoning-based mitigation methods, release a safety reasoning dataset, and open-source the code at https://github.com/ChangWenhan/TSBH_official。