Consistency of Large Reasoning Models Under Multi-Turn Attacks

2026-02-13 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning · Depth: Expert, quick

Summary

A study evaluated nine frontier large reasoning models for robustness against multi-turn adversarial attacks, a previously underexplored area. The research found that while reasoning capabilities provide meaningful robustness, enabling these models to significantly outperform instruction-tuned baselines, this robustness is incomplete. All tested models displayed unique vulnerability profiles, with misleading suggestions proving universally effective and social pressure attacks showing model-specific success. Trajectory analysis identified five primary failure modes: Self-Doubt, Social Conformity, Suggestion Hijacking, Emotional Susceptibility, and Reasoning Fatigue, with Self-Doubt and Social Conformity accounting for 50% of observed failures. The study also revealed that Confidence-Aware Response Generation (CARG), a defense effective for standard LLMs, fails for reasoning models due to overconfidence from extended reasoning traces, and that random confidence embedding surprisingly outperformed targeted extraction.

Key takeaway

For research scientists developing or deploying large reasoning models, understanding their specific vulnerabilities under multi-turn adversarial pressure is critical. Your current confidence-aware defense mechanisms, like CARG, may be ineffective due to overconfidence from extended reasoning. Focus on developing new defense strategies that specifically address identified failure modes such as Self-Doubt and Social Conformity, and explore non-traditional confidence embedding approaches.

Key insights

Reasoning models show incomplete robustness to multi-turn attacks, exhibiting specific failure modes and requiring new defense strategies.

Principles

• Reasoning confers meaningful but incomplete robustness.
• Misleading suggestions are universally effective attacks.
• Extended reasoning traces induce overconfidence.

Method

The study evaluated nine frontier reasoning models under multi-turn adversarial attacks, performing trajectory analysis to identify five distinct failure modes and testing Confidence-Aware Response Generation (CARG) as a defense.

In practice

• Prioritize defenses against Self-Doubt and Social Conformity.
• Redesign confidence-based defenses for reasoning models.
• Consider random confidence embedding over targeted extraction.

Topics

• Large Reasoning Models
• Adversarial Robustness
• Multi-Turn Attacks
• Failure Modes
• Confidence-Aware Response Generation

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Researcher, AI Scientist, Machine Learning Engineer

Related on AIssential

• Thinking Past the Answer: Evaluating Harmful Overthinking in Large Reasoning Models — Large Reasoning Models often degrade performance by continuing to reason past an already-correct answer.
• Between a Rock and a Hard Place: The Tension Between Ethical Reasoning and Safety Alignment in LLMs — Advanced LLM reasoning can be exploited by framing harmful actions within ethical dilemmas, bypassing safety alignments.
• Quantifying Faithful Confidence Expression in Large Reasoning Models — Faithful confidence expression is a distinct, significant challenge for Large Reasoning Models, requiring new quantification methods.
• Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack — LLMs' rigorous safety alignment inadvertently cultivates a latent capacity that can be weaponized by posterior attacks.
• Less Approximates More: Harmonizing Performance and Confidence Faithfulness via Hybrid Post-Training for High-Stakes Tasks — HyTuning improves LLM accuracy and confidence faithfulness in high-stakes tasks by adaptively reweighting RLIF and RD.
• Walls, Shields, and Illusions: Defenses and Their Limits — Adversarial defenses raise robustness but models remain overconfident and "silent" about their limits, perpetuating an arms race.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.