Capability-Routed Guard: Defending Large Reasoning Models Against Reasoning-Centric Jailbreaks

2026-08-07

AI Summary

This work addresses the vulnerability of large reasoning models to adversarial prompt attacks, wherein adversaries disguise malicious objectives as legitimate reasoning steps by manipulating reasoning context, task decomposition, or capability interpretation. The paper reframes prompt defense as a capability routing problem and introduces a model-agnostic, inference-time protection mechanism. This approach employs a side-channel controller to construct trustworthy task representations, decoupling executable intent from untrusted context, and dynamically routes requests based on risk levels—blocking high-risk queries, constraining ambiguous ones, and passing through low-risk inputs. Integrated with TraceCheck consistency verification and a constrained fallback strategy, the method effectively mitigates diverse reasoning-centric jailbreak attacks, preserves utility for benign tasks, avoids over-rejection, and significantly enhances overall defense performance.

Abstract

Large reasoning models (LRMs) expose a new safety failure mode: adversarial prompts can manipulate reasoning context, task decomposition, or capability interpretation so that harmful objectives are processed as legitimate reasoning steps. Existing safeguards, including safety reminders, external classifiers, and self-checking wrappers, are often brittle because they either inspect the adversarial prompt directly or ask the target model to perform additional safety reasoning on the same surface that attacks exploit. We introduce Capability-Routed Guard (CRG), a model-agnostic inference-time guardrail for closed-source LRMs, where defenders cannot inspect hidden reasoning traces or modify model weights. CRG reframes prompt defense as a capability-routing problem: a side-channel controller first constructs a trusted representation of the user's authorized task, active context, safety evidence, and capability-transfer risk, separating executable intent from untrusted reasoning context. This representation supports route-specific execution, allowing CRG to block high-risk requests, constrain ambiguous ones, and forward low-risk requests through trusted active context. Finally, CRG applies TraceCheck to verify consistency with the authorized task and invokes a restricted fallback to preserve utility for low-risk benign prompts. Extensive experiments demonstrate that CRG effectively mitigates diverse reasoning-centric jailbreaks while preserving benign utility and avoiding common over-refusal issues. Further analysis shows that its components contribute complementary benefits, highlighting the importance of coordinated defense mechanisms for securing large reasoning models.

Problem

• reasoning-centric jailbreaks
• large reasoning models
• adversarial prompts
• safety failure
• capability interpretation

Innovation

• Capability-Routed Guard
• reasoning-centric jailbreaks
• model-agnostic defense
• capability routing
• TraceCheck