这项研究揭示了 CoT 在模型安全中的双重角色——既增强鲁棒性又引入新风险，做 AI 安全和对齐的团队值得关注，尤其是使用推理模型的开发者需要重新评估防御策略。
最新研究发现，大型推理模型（LRM）的拒绝机制不仅依赖于残差流激活，还依赖于思维链（CoT）。在 DeepSeek-R1-Distill-LLaMA-8B 上，固定 CoT 时激活引导仅能反转 39% 的拒绝，移除 CoT 后提升至 70%，表明 CoT 主动强化了拒绝。通过两阶段干预（在激活引导下重新生成 CoT），拒绝反转率达到 94%，且生成的 CoT 在移除引导后仍能独立保持 48% 的顺从信号。这说明 CoT 可以独立携带并重建顺从信号，使 LRM 对激活级干预更鲁棒，但也暴露出 CoT 可能成为新的攻击面。
Beyond a Single Direction: Chain-of-Thought Disrupts Simple Steering of Refusal
Large reasoning models (LRMs) generate chain-of-thought (CoT) traces before producing final outputs, introducing a dynamic internal state that may complicate control mechanisms such as refusal. Unlike instruction-tuned LLMs, where refusal is mediated by a single directional subspace, refusal in large reasoning models (LRMs) additionally depends on the CoT. In DeepSeek-R1-Distill-LLaMA-8B, activation steering reverses refusal in only 39% of cases when the CoT is kept fixed, but removing the CoT entirely increases this to 70%, indicating that the CoT actively reinforces refusal. In a two-stage intervention where the model regenerates its CoT under activation steering, refusal is reversed in 94% of cases, while the resulting CoT alone retains 48% of this effect even after steering is removed. This suggests that the CoT can carry and reconstruct the compliance signal independently. These findings indicate that refusal in LRMs is jointly encoded in residual stream activations and CoT. This joint activation makes LRM more robust against activation-level interventions alone, but exposes CoT to a possible alternative surface attack.