Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models
Authors: Xunguang Wang, Yuguang Zhou, Qingyue Wang, Zongjie Li, Ruixuan Huang, Zhenlan Ji, Pingchuan Ma, Shuai Wang
Organizations: The Hong Kong University of Science and Technology, Hong Kong, China · Zhejiang University of Technology, Hangzhou, Zhejiang Province, China
Large language models increasingly rely on explicit chain-of-thought reasoning to solve complex tasks, yet the safety of the reasoning process itself remains largely unaddressed. Existing work focuses predominantly on content safety (i.e., detecting harmful, biased, or factually incorrect outputs), while treating the underlying reasoning chain as an opaque intermediate artifact. We argue that reasoning safety constitutes a fundamental security dimension orthogonal to content safety: the requirement that a model's reasoning trajectory be logically consistent, computationally efficient, and resistant to adversarial manipulation. In this paper, we formalize reasoning safety and introduce a systematic taxonomy of nine unsafe reasoning behaviors. We then conduct a large-scale prevalence study, annotating over 4,000 reasoning chains across benign benchmarks and four state-of-the-art reasoning attacks, empirically demonstrating that all nine error types occur in practice with mechanistically interpretable signatures. To mitigate these threats, we propose the Reasoning Safety Monitor: an external, zero-shot verification framework that runs in parallel with the target LLM. It inspects each reasoning step in real time via a taxonomy-embedded prompt and dispatches an interrupt signal upon detecting unsafe behavior. Extensive evaluations show our monitor achieves up to 87.11% step-level localization accuracy, outperforming hallucination detectors and the best process reward model baselines by a substantial margin. Crucially, the monitor maintains a low false positive rate on correct reasoning paths, operates with negligible latency overhead, and exhibits robust resilience against adaptive adversarial evasion. These findings establish reasoning safety monitoring as a highly feasible and essential component for the secure deployment of large reasoning models.
Figures & tables
Category
Subtype
Violated Property
Primary Effect
1. Input Parsing
a. Misinterpretation
P1, P3
Wrong answer
b. Missing Constraints
P1, P3
Wrong answer
c. Symbol Mapping Error
P1, P3
Wrong answer
2. Execution
a. Logical Fallacy
P1, P3
Wrong answer
b. Calculation Error
P1, P3
Wrong answer
c. Inconsistency
P1, P3
Wrong answer
Table 1. Taxonomy of unsafe behaviors in LLM reasoning chains. P3 could occur in any category as various adversarial manipulations.
Figure 1. Error type distributions across the natural reasoning datasets (Omni-Math and GSM8K) and four attack-induced datasets. Category codes follow Table 1 : 1a=Misinterpretation, 1b=Missing Constraints, 1c=Symbol Mapping Error, 2a=Logical Fallacy, 2b=Calculation Error, 2c=Inconsistency, 3a=Reasoning Loop, 3b=Goal Deviation, 3c=Premature Conclusion.
Figure 2. Overview of the Reasoning Safety Monitor. The monitor runs in parallel with the target LLM, receiving each reasoning step via a streaming interface. For every step, the monitor queries an LLM verifier with the full contextual history and the nine-type error taxonomy, producing a structured verdict (safety flag, error type, location, confidence, and explanation). If the verdict indicates an unsafe step, an interrupt signal halts the target LLM’s generation pipeline; otherwise, the step is appended to the input and generation continues. A chain in which all steps pass inspection proceeds to produce the final answer.
Monitor / Baseline
1a
1b
1c
2a
2b
2c
3a
3b
3c
Overall PAcc (%)
LCM ( Sun et al., 2025 )
26.00
20.00
14.00
26.00
8.00
18.00
98.00
44.00
72.00
36.22
Qwen2.5-Math-PRM-7B ( Zhang et al., 2025b )
68.00
22.00
52.00
82.00
70.00
94.00
88.00
88.00
48.00
68.00
Vanilla Monitor (GPT-4o-2024-08-06)
60.00
18.00
48.00
80.00
62.00
92.00
60.00
86.00
88.00
66.00
Vanilla Monitor (gpt-oss-20b)
76.00
42.00
78.00
92.00
88.00
82.00
90.00
86.00
74.00
78.67
Vanilla Monitor (Qwen3.5-35B-A3B)
90.00
52.00
74.00
92.00
80.00
84.00
60.00
34.00
36.00
66.89
Vanilla Monitor (Gemini-3-Flash)
92.00
40.00
78.00
96.00
92.00
94.00
2.00
30.00
44.00
63.11
Table 2. PAcc ( ↑ ) on the static benchmark. Each column corresponds to a specific error subtype (1a, 1b, …, 3c), and the final column reports the overall PAcc across all 450 chains. The top two rows show the baselines (LCM and Qwen2.5-Math-PRM-7B), while the subsequent rows show our main monitor and the Vanilla Monitor ablation across different LLM backends.
Monitor
FPR (%)
LCM
84.46
Qwen2.5-Math-PRM-7B
3.63
Vanilla Monitor (Gemini-3-Flash)
1.04
Our Monitor (Gemini-3-Flash)
1.04
Table 3. FPR ( ↓ ) on ProcessBench with correct reasoning chains.
Monitor
BadChain
PAA
DeepSeek-V3.2
No Monitor
0.78
0.30
Our Monitor (GPT-4o-2024-08-06)
0.00
0.03
Qwen3-30B-A3B-Instruct-2507
No Monitor
0.73
0.36
Our Monitor (GPT-4o-2024-08-06)
0.00
0.05
Table 4. ASRs ( ↓ ) of hijacking attacks without/with monitor interventions. DeepSeek-V3.2 and Qwen3-30B-A3B-Instruct-2507 are target LLMs.
Monitor
OverThink
Deadlock
DeepSeek-R1-Distill-Llama-8B
No Monitor
3.39 ×
33.86 ×
Our Monitor (GPT-4o-2024-08-06)
0.67 ×
0.11 ×
Phi-4-mini-reasoning
No Monitor
29.74 ×
16.85 ×
Our Monitor (GPT-4o-2024-08-06)
0.26 ×
4.69 ×
Table 5. Token Amplification Factor (TAF) ( ↓ ) of DoS attacks without/with monitor interventions. DeepSeek-R1-Distill-Llama-8B and Phi-4-mini-reasoning are target LLMs.
Figure 3. Comparison of absolute inference latency and Latency Amplification Factor (LAF) under different adversarial attacks with and without the monitor.
Figure 4. Case study examples illustrating the monitor’s detection capabilities across different attack types. (a) A reasoning chain from GSM8K with a Misinterpretation (1a) error, where the monitor correctly identifies the first erroneous step. (b) A Deadlock chain exhibiting a Reasoning Loop (3a), which is accurately localized by the monitor. (c) An error-free reasoning chain from GSM8K where the monitor correctly produces no false positives.
Figure 5. An inefficient case example with only one step.
While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.
Ke Miao, Jiaxin Li, Hongliang Chen +2
The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou HighTech Zone (Binjiang) Blockchain and Data Security Research Institute, China · Li Auto Inc. +2
Large reasoning models (LRMs) increasingly expose chain-of-thought-like reasoning for transparency, verification, and deliberate problem solving. This creates a safety blind spot: harmful or policy-violating content may appear in reasoning traces even when final answers appear safe. We test whether final-answer safety is a sufficient proxy for the full reasoning-answer trajectory by scoring both stages under a unified twenty-principle safety rubric. Using prompts from seven public harmfulness and jailbreak sources, plus four out-of-distribution (OOD) sources, we evaluate 15 open-weight and API-based LRMs across 41K prompts per model. Reasoning traces consistently reveal additional safety risks beyond final answers, especially in high-severity stage-wise failures: leak cases, where unsafe reasoning precedes a safe-looking answer, and escape cases, where benign-looking reasoning precedes an unsafe final response. Principle-level analysis shows that risk concentrates in misinformation, legal compliance, discrimination, physical harm, and psychological harm. We further propose adaptive multi-principle steering, a white-box test-time mitigation that learns one unsafe-to-safe activation direction per safety principle and activates only directions whose current hidden state is closer to the unsafe than safe centroid. On three steerable open reasoning models, adaptive steering reduces unsafe counts in both reasoning traces and final answers on held-out and OOD benchmarks. DeepSeek-R1-Qwen-7B achieves a 40.8% average unsafe-count reduction while retaining 97.7% macro-averaged accuracy on BBH, GSM8K, and MMLU. These results suggest that LRM safety should be evaluated and mitigated over the full exposed reasoning-answer trajectory, not only at the final-answer stage.
Xiaomin Li, Jianheng Hou, Zheyuan Deng +6
Harvard University · University of Southern California · Brown University +6
Large Reasoning Models (LRMs) leverage explicit reasoning traces, known as Chain-of-Thought (CoT) reasoning, to decompose complex problems into intermediate steps before deriving final answers. However, these reasoning traces introduce unique safety challenges: harmful content can be embedded in intermediate steps even when final answers appear benign. Our study reveals that existing state-of-the-art moderation tools experience significant performance degradation on CoT moderation, with F1 scores dropping by up to 35.2% compared to traditional answer moderation. To address these challenges, we present ReasoningShield, a comprehensive benchmark and a suite of strong lightweight models for CoT safety moderation. Our benchmark includes 9.2K annotated (Query, CoT) pairs with structured stepwise risk analysis, consisting of a 7K-sample training set and a 2.2K human-annotated test set, spanning 10 risk categories, 3 safety levels, and 8 LRMs with diverse reasoning paradigms. To further demonstrate the utility of the benchmark, we develop lightweight models with 1B/3B parameters using a two-stage training strategy. Our models achieve 91.8% F1 on our benchmark, substantially outperforming leading tools such as LlamaGuard-4 by 35.6% and commercial models such as GPT-4o by 15.8%, while generalizing effectively across diverse reasoning paradigms and unseen scenarios. Resources are publicly available: Project Page: https://cosmosyi.github.io/ReasoningShield/, Code: https://github.com/CosmosYi/ReasoningShield, Models: https://huggingface.co/ReasoningShield/models, and Dataset: https://huggingface.co/datasets/ReasoningShield/ReasoningShield-Dataset.