{"id":"https://openalex.org/W7225259635","doi":"https://doi.org/10.48550/arxiv.2611.04717","title":"BrainwashedLLM: Jailbreaking via Automated Adversarial Chain of Thoughts Discovery","display_name":"BrainwashedLLM: Jailbreaking via Automated Adversarial Chain of Thoughts Discovery","publication_year":2026,"publication_date":"2026-11-03","ids":{"openalex":"https://openalex.org/W7225259635","doi":"https://doi.org/10.48550/arxiv.2611.04717"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2611.04717","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.04717","pdf_url":"https://arxiv.org/pdf/2611.04717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2611.04717","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114475333","display_name":"Masoud Poorghaffar Aghdam","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I168864056","display_name":"Bilkent University","ror":"https://ror.org/02vh8a032","country_code":"TR","type":"education","lineage":["https://openalex.org/I168864056"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Aghdam, Masoud Poorghaffar","raw_affiliation_strings":["Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye","institution_ids":["https://openalex.org/I168864056"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5145579941","display_name":"G\u00f6ktu\u011f Serdar Y\u0131ld\u0131r\u0131m","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I168864056","display_name":"Bilkent University","ror":"https://ror.org/02vh8a032","country_code":"TR","type":"education","lineage":["https://openalex.org/I168864056"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Y\u0131ld\u0131r\u0131m, G\u00f6ktu\u011f Serdar","raw_affiliation_strings":["Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye","institution_ids":["https://openalex.org/I168864056"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025665736","display_name":"Sinem Sav","orcid":"https://orcid.org/0000-0001-9096-8768","observed_orcids":["https://orcid.org/0000-0001-9096-8768"]},"institutions":[{"id":"https://openalex.org/I168864056","display_name":"Bilkent University","ror":"https://ror.org/02vh8a032","country_code":"TR","type":"education","lineage":["https://openalex.org/I168864056"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Sav, Sinem","raw_affiliation_strings":["Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering , Bilkent University , Ankara 06800 , T\u00fcrkiye","institution_ids":["https://openalex.org/I168864056"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I168864056"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/jailbreaking","display_name":"jailbreaking","score":0.6840000152587891},{"id":"https://openalex.org/keywords/large-reasoning-models","display_name":"large reasoning models","score":0.777999997138977},{"id":"https://openalex.org/keywords/chain-of-thought-reasoning","display_name":"chain-of-thought reasoning","score":0.9490000009536743},{"id":"https://openalex.org/keywords/adversarial-attacks","display_name":"adversarial attacks","score":0.7149999737739563},{"id":"https://openalex.org/keywords/group-relative-policy-optimization","display_name":"Group Relative Policy Optimization","score":0.8429999947547913},{"id":"https://openalex.org/keywords/zero-shot-transfer","display_name":"zero-shot transfer","score":0.6470000147819519},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":0.7210000157356262},{"id":"https://openalex.org/keywords/llm-safety","display_name":"LLM safety","score":0.6309999823570251}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.8118000030517578},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7412999868392944},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.670799970626831},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5335999727249146},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.45879998803138733},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.41830000281333923},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.39899998903274536},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.3246000111103058},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.30320000648498535},{"id":"https://openalex.org/C89288958","wikidata":"https://www.wikidata.org/wiki/Q7301504","display_name":"Reasoning system","level":2,"score":0.29649999737739563},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29120001196861267},{"id":"https://openalex.org/C150899416","wikidata":"https://www.wikidata.org/wiki/Q1820378","display_name":"Transfer of learning","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C2776175482","wikidata":"https://www.wikidata.org/wiki/Q1195816","display_name":"Transfer (computing)","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.26339998841285706},{"id":"https://openalex.org/C86827895","wikidata":"https://www.wikidata.org/wiki/Q7098582","display_name":"Opportunistic reasoning","level":4,"score":0.2574000060558319}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2611.04717","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.04717","pdf_url":"https://arxiv.org/pdf/2611.04717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2611.04717","doi":"https://doi.org/10.48550/arxiv.2611.04717","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2611.04717","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2611.04717","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.04717","pdf_url":"https://arxiv.org/pdf/2611.04717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225259635.pdf","grobid_xml":"https://content.openalex.org/works/W7225259635.grobid-xml"},"referenced_works_count":35,"referenced_works":["https://openalex.org/W2736601468","https://openalex.org/W4322718191","https://openalex.org/W4327810158","https://openalex.org/W4385374425","https://openalex.org/W4386044080","https://openalex.org/W4386185625","https://openalex.org/W4387225871","https://openalex.org/W4389518968","https://openalex.org/W4391631327","https://openalex.org/W4391632220","https://openalex.org/W4391835942","https://openalex.org/W4396239636","https://openalex.org/W4396822213","https://openalex.org/W4402426674","https://openalex.org/W4404408162","https://openalex.org/W4405903187","https://openalex.org/W4406959316","https://openalex.org/W4407012610","https://openalex.org/W4407186872","https://openalex.org/W4407231747","https://openalex.org/W4407690296","https://openalex.org/W4407759840","https://openalex.org/W4412888479","https://openalex.org/W4414281281","https://openalex.org/W4415308126","https://openalex.org/W4415337943","https://openalex.org/W4416160875","https://openalex.org/W4417080162","https://openalex.org/W4417126505","https://openalex.org/W4417252869","https://openalex.org/W4417513142","https://openalex.org/W4417522340","https://openalex.org/W7090908468","https://openalex.org/W7117136620","https://openalex.org/W7165642492"],"related_works":["https://openalex.org/W7164742483","https://openalex.org/W7202176699","https://openalex.org/W7162406635","https://openalex.org/W4417126505","https://openalex.org/W4402426674","https://openalex.org/W4415336402","https://openalex.org/W7165001453","https://openalex.org/W4407759840","https://openalex.org/W7208721579","https://openalex.org/W7161846081"],"abstract_inverted_index":{"Large":[0],"Reasoning":[1],"Models":[2],"(LRMs)":[3],"achieve":[4],"strong":[5],"performance":[6],"on":[7],"complex":[8],"tasks":[9],"by":[10],"generating":[11],"explicit":[12],"Chain-of-Thought":[13],"(CoT)":[14],"reasoning,":[15],"but":[16],"the":[17,30,53,69,105,111,141,161,189,199,208,221,248],"safety":[18],"implications":[19],"of":[20,71,157,184,210,228],"this":[21,197],"intermediate":[22],"reasoning":[23,31,50,102,114,143,229,249],"surface":[24,215],"remain":[25],"underexplored.":[26],"We":[27,60],"demonstrate":[28,224],"that":[29,67,119,168,234,246],"trace":[32],"itself":[33],"is":[34,44,107,198,237],"a":[35,63,82,88,94,124,238],"powerful":[36],"attack":[37,192,214],"vector.":[38],"Safety":[39],"alignment":[40],"in":[41,52,123,240],"large":[42],"models":[43],"substantially":[45],"less":[46],"robust":[47],"to":[48,56,92,99,139,202,205,223],"malicious":[49],"embedded":[51],"context":[54],"than":[55],"direct":[57],"imperative":[58],"prompts.":[59],"introduce":[61],"BrainwashedLLM,":[62],"weak-to-strong":[64,226],"adversarial":[65,101,142],"framework":[66,201],"automates":[68],"discovery":[70],"reasoning-based":[72],"jailbreaks.":[73],"First,":[74],"we":[75,117],"use":[76,203],"Group":[77],"Relative":[78],"Policy":[79],"Optimization":[80],"(GRPO),":[81],"Reinforcement":[83],"Learning":[84],"(RL)":[85],"algorithm,":[86],"with":[87],"multi-objective":[89],"rule-based":[90],"reward":[91,106],"fine-tune":[93],"small,":[95],"white-box":[96],"source":[97],"model":[98],"generate":[100],"traces.":[103,230],"Crucially,":[104],"computed":[108],"entirely":[109],"over":[110],"source's":[112],"own":[113],"trace.":[115],"Second,":[116],"show":[118],"these":[120],"traces":[121,128],"transfer":[122,227],"zero-shot":[125,225],"manner.":[126],"When":[127],"are":[129],"injected":[130],"as":[131,212],"input":[132],"prefixes,":[133],"they":[134],"steer":[135],"larger":[136],"black-box":[137],"LRMs":[138,167,211,241],"continue":[140],"and":[144,177,220,242,257],"produce":[145],"harmful":[146,258],"outputs,":[147],"without":[148,187,216],"requiring":[149],"prompt":[150],"optimization,":[151],"gradient":[152],"access,":[153],"or":[154],"any":[155,217],"form":[156],"output":[158],"feedback":[159],"from":[160],"target":[162,190,218],"model.":[163],"Across":[164],"four":[165],"state-of-the-art":[166],"span":[169],"distinct":[170],"architectures,":[171],"BrainwashedLLM":[172],"achieves":[173],"ASR@5":[174],"between":[175],"0.74":[176],"0.98":[178],"across":[179],"targets,":[180],"within":[181],"16":[182],"points":[183],"query-based":[185],"baselines,":[186],"querying":[188],"during":[191],"construction.":[193],"To":[194],"our":[195],"knowledge,":[196],"first":[200,222],"RL":[204],"directly":[206],"optimize":[207],"CoT":[209,236],"an":[213],"feedback,":[219],"Our":[231],"results":[232],"suggest":[233],"exposed":[235],"vulnerability":[239],"motivate":[243],"architectural":[244],"defenses":[245],"isolate":[247],"buffer.":[250],"Warning:":[251],"This":[252],"paper":[253],"contains":[254],"potentially":[255],"offensive":[256],"text.":[259]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-05T00:00:00"}