When the Chain of Thought Knows Better: Failure Modes in Multi-Turn Reasoning Models

• URL: http://arxiv.org/abs/2606.10740v2
• Date: Sun, 14 Jun 2026 01:30:20 GMT
• Title: When the Chain of Thought Knows Better: Failure Modes in Multi-Turn Reasoning Models
• Abstract summary: Failures in multi-turn reasoning models are largely invisible to terminal-score evaluation.<n>A model can lock onto an unsafe stance early in a long dialogue, yet its final-turn refusal rate may appear indistinguishable from a robustly aligned baseline.<n>We propose a trace-level diagnostic - the CoT-Output 2x2 safety matrix.
• Score: 7.185483586381928
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Failures in multi-turn reasoning models are largely invisible to terminal-score evaluation. A model can lock onto an unsafe stance early in a long dialogue, yet its final-turn refusal rate may appear indistinguishable from a robustly aligned baseline. To expose these hidden temporal dynamics, we propose a trace-level diagnostic - the CoT-Output 2x2 safety matrix. This framework labels every turn along two independent axes (internal reasoning and visible output), yielding four operationally defined failure cells: robust alignment, alignment faking, overt jailbreak, and a distinct failure mode we term context-injection failure (where the CoT maintains safe reasoning, but the visible output produces harm, highlighting a multi-turn manifestation of reasoning unfaithfulness). We evaluate three distilled reasoning targets against a fixed attacker across five oversight conditions, collecting 6750 turn-level observations on the Information-Hazard scenario. Our analysis reveals two reproducible vulnerabilities: an oversight paradox where explicit monitoring cues paradoxically increase alignment-faking rates rather than suppress them, and a context-injection failure where models lock onto unsafe external outputs despite safe internal states. We release the full dataset of multi-turn dialogues and CoT traces to support follow-up trace-diagnostic research.

Related papers

• Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models [27.2709460237741]
  Policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions.<n>We test this premise head-on across three models that span the reasoning spectrum.<n>We find that the latent-iterative model is by far the least robust.
  arXiv  Detail & Related papers  (2026-07-20T10:20:32Z)
• Detecting Is Not Resolving: The Monitoring Control Gap in Retrieval Augmented LLMs [20.59321114618083]
  We show that single-turn diagnostics systematically overestimate RAG safety, that contradiction is uncorrelated with safe resolution, and that no universal prompt fix exists.<n>The gap between what models recognize and what they do must be measured and closed before retrieval-augmented systems can be trusted in high-stakes settings.
  arXiv  Detail & Related papers  (2026-05-26T15:18:43Z)
• Seirênes: Adversarial Self-Play with Evolving Distractions for LLM Reasoning [56.48520300004217]
  We present Seirnes, a self-play RL framework that transforms contextual interference into an internal training signal.<n>A single model is trained to both construct plausible yet distracting contexts that expose its own reasoning blind spots.<n>By pitting these competing objectives against each other, Seirnes compels the model to move beyond superficial pattern matching.
  arXiv  Detail & Related papers  (2026-05-12T06:58:35Z)
• Don't Blink: Evidence Collapse during Multimodal Reasoning [0.0]
  Reasoning VLMs can become more accurate while progressively losing visual grounding as they think.<n>This creates task-conditional danger zones where low-entropy predictions are confident but ungrounded.<n>Using this structure, a targeted vision veto reduces selective risk by up to 1.9 percentage points at 90% coverage.
  arXiv  Detail & Related papers  (2026-04-05T18:01:00Z)
• State-Dependent Safety Failures in Multi-Turn Language Model Interaction [70.52906620450847]
  We study safety failures from a state-space perspective and show that many multi-turn failures arise from structured contextual state evolution.<n>We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator.<n>We find that systems that appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction.
  arXiv  Detail & Related papers  (2026-03-15T12:13:01Z)
• TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models [19.148124494194317]
  We propose TraceGuard, a process-guided security framework that transforms small-scale models into robust reasoning firewalls.<n>Our approach treats the reasoning trace as an untrusted payload and establishes a defense-in-depth strategy.<n>We demonstrate robustness against adaptive adversaries in a grey-box setting, establishing TraceGuard as a viable, low-latency security primitive.
  arXiv  Detail & Related papers  (2026-03-02T22:19:13Z)
• LogicGaze: Benchmarking Causal Consistency in Visual Narratives via Counterfactual Verification [41.99844472131922]
  We introduce LogicGaze, a novel benchmark framework designed to rigorously interrogate whether Vision-Language Models can validate sequential causal chains against visual inputs.<n>Our tripartite evaluation protocol exposes significant vulnerabilities in state-of-the-art VLMs such as Qwen2.5-VL-72B.<n> LogicGaze advocates for robust, trustworthy multimodal reasoning, with all resources publicly available in an anonymized repository.
  arXiv  Detail & Related papers  (2026-01-30T20:28:01Z)
• Agentic Uncertainty Quantification [76.94013626702183]
  We propose a unified Dual-Process Agentic UQ (AUQ) framework that transforms verbalized uncertainty into active, bi-directional control signals.<n>Our architecture comprises two complementary mechanisms: System 1 (Uncertainty-Aware Memory, UAM), which implicitly propagates verbalized confidence and semantic explanations to prevent blind decision-making; and System 2 (Uncertainty-Aware Reflection, UAR), which utilizes these explanations as rational cues to trigger targeted inference-time resolution only when necessary.
  arXiv  Detail & Related papers  (2026-01-22T07:16:26Z)
• Hallucination Detection via Internal States and Structured Reasoning Consistency in Large Language Models [7.18947815679122]
  Internal State Probing and Chain-of-Thought Verification are used to detect hallucinations in large language models.<n>We develop a unified framework that bridges the gap between the two methods.<n>Our framework consistently and significantly outperforms strong baselines.
  arXiv  Detail & Related papers  (2025-10-13T15:31:21Z)
• Refusal Falls off a Cliff: How Safety Alignment Fails in Reasoning? [68.82210578851442]
  We investigate why safety alignment fails in reasoning models through a mechanistic interpretability lens.<n>Using a linear probing approach to trace refusal intentions across token positions, we discover a phenomenon termed as textbfrefusal cliff<n>We propose textbfCliff-as-a-Judge, a novel data selection method that identifies training examples exhibiting the largest refusal cliff to efficiently repair reasoning models' safety alignment.
  arXiv  Detail & Related papers  (2025-10-07T15:32:59Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• Turning Logic Against Itself : Probing Model Defenses Through Contrastive Questions [50.40122190627256]
  We introduce POATE, a novel jailbreak technique that harnesses contrastive reasoning to provoke unethical responses.<n>PoATE crafts semantically opposing intents and integrates them with adversarial templates, steering models toward harmful outputs with remarkable subtlety.<n>To counter this, we propose Intent-Aware CoT and Reverse Thinking CoT, which decompose queries to detect malicious intent and reason in reverse to evaluate and reject harmful responses.
  arXiv  Detail & Related papers  (2025-01-03T15:40:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.