Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models

Xunguang Wang; Yuguang Zhou; Qingyue Wang; Zongjie Li; Ruixuan Huang; Zhenlan Ji; Pingchuan Ma; Shuai Wang

cs.AIMar 26, 2026

Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models

Authors: Xunguang Wang, Yuguang Zhou, Qingyue Wang, Zongjie Li, Ruixuan Huang, Zhenlan Ji, Pingchuan Ma, Shuai Wang

Organizations: The Hong Kong University of Science and Technology, Hong Kong, China · Zhejiang University of Technology, Hangzhou, Zhejiang Province, China

Abstract

Large language models increasingly rely on explicit chain-of-thought reasoning to solve complex tasks, yet the safety of the reasoning process itself remains largely unaddressed. Existing work focuses predominantly on content safety (i.e., detecting harmful, biased, or factually incorrect outputs), while treating the underlying reasoning chain as an opaque intermediate artifact. We argue that reasoning safety constitutes a fundamental security dimension orthogonal to content safety: the requirement that a model's reasoning trajectory be logically consistent, computationally efficient, and resistant to adversarial manipulation. In this paper, we formalize reasoning safety and introduce a systematic taxonomy of nine unsafe reasoning behaviors. We then conduct a large-scale prevalence study, annotating over 4,000 reasoning chains across benign benchmarks and four state-of-the-art reasoning attacks, empirically demonstrating that all nine error types occur in practice with mechanistically interpretable signatures. To mitigate these threats, we propose the Reasoning Safety Monitor: an external, zero-shot verification framework that runs in parallel with the target LLM. It inspects each reasoning step in real time via a taxonomy-embedded prompt and dispatches an interrupt signal upon detecting unsafe behavior. Extensive evaluations show our monitor achieves up to 87.11% step-level localization accuracy, outperforming hallucination detectors and the best process reward model baselines by a substantial margin. Crucially, the monitor maintains a low false positive rate on correct reasoning paths, operates with negligible latency overhead, and exhibits robust resilience against adaptive adversarial evasion. These findings establish reasoning safety monitoring as a highly feasible and essential component for the secure deployment of large reasoning models.

Figures & tables

Category	Subtype	Violated Property	Primary Effect
1. Input Parsing	a. Misinterpretation	P1, P3	Wrong answer
	b. Missing Constraints	P1, P3	Wrong answer
	c. Symbol Mapping Error	P1, P3	Wrong answer
2. Execution	a. Logical Fallacy	P1, P3	Wrong answer
	b. Calculation Error	P1, P3	Wrong answer
	c. Inconsistency	P1, P3	Wrong answer

Table 1. Taxonomy of unsafe behaviors in LLM reasoning chains. P3 could occur in any category as various adversarial manipulations.

Panel of Figure 1 — Figure 1. Error type distributions across the natural reasoning datasets (Omni-Math and GSM8K) and four attack-induced datasets. Category codes follow Table 1 : 1a=Misinterpretation, 1b=Missing Constraints, 1c=Symbol Mapping Error, 2a=Logical Fallacy, 2b=Calculation Error, 2c=Inconsistency, 3a=Reasoning Loop, 3b=Goal Deviation, 3c=Premature Conclusion.

Figure 2. Overview of the Reasoning Safety Monitor. The monitor runs in parallel with the target LLM, receiving each reasoning step via a streaming interface. For every step, the monitor queries an LLM verifier with the full contextual history and the nine-type error taxonomy, producing a structured verdict (safety flag, error type, location, confidence, and explanation). If the verdict indicates an unsafe step, an interrupt signal halts the target LLM’s generation pipeline; otherwise, the step is appended to the input and generation continues. A chain in which all steps pass inspection proceeds to produce the final answer.

Monitor / Baseline	1a	1b	1c	2a	2b	2c	3a	3b	3c	Overall PAcc (%)
LCM ( Sun et al., 2025 )	26.00	20.00	14.00	26.00	8.00	18.00	98.00	44.00	72.00	36.22
Qwen2.5-Math-PRM-7B ( Zhang et al., 2025b )	68.00	22.00	52.00	82.00	70.00	94.00	88.00	88.00	48.00	68.00
Vanilla Monitor (GPT-4o-2024-08-06)	60.00	18.00	48.00	80.00	62.00	92.00	60.00	86.00	88.00	66.00
Vanilla Monitor (gpt-oss-20b)	76.00	42.00	78.00	92.00	88.00	82.00	90.00	86.00	74.00	78.67
Vanilla Monitor (Qwen3.5-35B-A3B)	90.00	52.00	74.00	92.00	80.00	84.00	60.00	34.00	36.00	66.89
Vanilla Monitor (Gemini-3-Flash)	92.00	40.00	78.00	96.00	92.00	94.00	2.00	30.00	44.00	63.11

Table 2. PAcc (

\uparrow

) on the static benchmark. Each column corresponds to a specific error subtype (1a, 1b, …, 3c), and the final column reports the overall PAcc across all 450 chains. The top two rows show the baselines (LCM and Qwen2.5-Math-PRM-7B), while the subsequent rows show our main monitor and the Vanilla Monitor ablation across different LLM backends.

Monitor	FPR (%)
LCM	84.46
Qwen2.5-Math-PRM-7B	3.63
Vanilla Monitor (Gemini-3-Flash)	1.04
Our Monitor (Gemini-3-Flash)	1.04

Table 3. FPR (

\downarrow

) on ProcessBench with correct reasoning chains.

Monitor	BadChain	PAA
DeepSeek-V3.2
No Monitor	0.78	0.30
Our Monitor (GPT-4o-2024-08-06)	0.00	0.03
Qwen3-30B-A3B-Instruct-2507
No Monitor	0.73	0.36
Our Monitor (GPT-4o-2024-08-06)	0.00	0.05

Table 4. ASRs (

\downarrow

) of hijacking attacks without/with monitor interventions. DeepSeek-V3.2 and Qwen3-30B-A3B-Instruct-2507 are target LLMs.

DeepSeek-R1-Distill-Llama-8B
Monitor	OverThink	Deadlock
No Monitor	3.39 $\times$	33.86 $\times$
Our Monitor (GPT-4o-2024-08-06)	0.67 $\times$	0.11 $\times$
Phi-4-mini-reasoning
No Monitor	29.74 $\times$	16.85 $\times$
Our Monitor (GPT-4o-2024-08-06)	0.26 $\times$	4.69 $\times$

Table 5. Token Amplification Factor (TAF) (

\downarrow

) of DoS attacks without/with monitor interventions. DeepSeek-R1-Distill-Llama-8B and Phi-4-mini-reasoning are target LLMs.

Figure 3. Comparison of absolute inference latency and Latency Amplification Factor (LAF) under different adversarial attacks with and without the monitor.

Panel of Figure 4 — Figure 4. Case study examples illustrating the monitor’s detection capabilities across different attack types. (a) A reasoning chain from GSM8K with a Misinterpretation (1a) error, where the monitor correctly identifies the first erroneous step. (b) A Deadlock chain exhibiting a Reasoning Loop (3a), which is accurately localized by the monitor. (c) An error-free reasoning chain from GSM8K where the monitor correctly produces no false positives.

Figure 5. An inefficient case example with only one step.

LLM Safety Monitoring

See all 38 papers

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models
Jun 15, 2026Ke Miao, Jiaxin Li, Hongliang Chen +2LLM Safety Alignment LLM Safety
The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou HighTech Zone (Binjiang) Blockchain and Data Security Research Institute, China · Li Auto Inc. +2
Chain of Risk: Safety Failures in Large Reasoning Models and Mitigation via Adaptive Multi-Principle Steering
May 7, 2026Xiaomin Li, Jianheng Hou, Zheyuan Deng +6LLM Safety LLM Safety Evaluation
Harvard University · University of Southern California · Brown University +6
ReasoningShield: Safety Detection over Reasoning Traces of Large Reasoning Models
May 22, 2025Changyi Li, Jiayi Wang, Xudong Pan +2Language Model Safety Evaluation LLM Safety Benchmarks
Fudan University · Shanghai Innovation Institute

Jun 15, 2026J/K move · Enter open · S save

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models

Ke Miao, Jiaxin Li, Hongliang Chen, Yuke Hu+1

The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou HighTech Zone (Binjiang) Blockchain and Data Security Research Institute, China · Li Auto Inc.+2

LLM Safety Alignment LLM Safety Jailbreak Defense Large Reasoning Models

Open paper AskPDF arXiv

While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.

Abstract

LLM Safety Monitoring

Explore similar work

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models

Chain of Risk: Safety Failures in Large Reasoning Models and Mitigation via Adaptive Multi-Principle Steering

ReasoningShield: Safety Detection over Reasoning Traces of Large Reasoning Models