Technical Summary: Do Reasoning LLMs Refuse What They Infer in Long Contexts?

Problem Statement

Large Language Models (LLMs) are increasingly deployed with capabilities for long-context processing and multi-step reasoning. While these abilities enable complex tasks like document analysis and retrieval-augmented decision support, they introduce a novel safety vulnerability. Existing safety evaluations primarily test models against explicit harmful requests (e.g., "How do I make a bomb?"). However, in long-context scenarios, harmful intent can be distributed across semantically incomplete fragments within a large document. A model may successfully retrieve these fragments, compose them through reasoning, and infer a harmful objective that was never explicitly stated in the user prompt. The central research question is: Do LLMs apply safety judgments to harmful objectives that they must first infer from a long context, or do they only refuse when the harm is explicitly visible?

Methodology: Compositional Reasoning Attacks

To investigate this, the authors introduce Compositional Reasoning Attacks, a threat model designed to isolate the failure mode where safety judgment fails after inference.

Attack Design

1. Decomposition: A harmful request $h$ is decomposed into $n$ semantically incomplete fragments $F = \{f_1, ..., f_n\}$. No single fragment contains the full harmful request.
2. Context Embedding: These fragments are embedded into a long context (up to 64k tokens), often mixed with irrelevant "haystack" text (e.g., from the PG19 corpus).
3. Neutral Query: The user prompt is a neutral synthesis instruction (e.g., "Based on the inserted facts, describe the complete procedure"). The prompt itself contains no harmful keywords.
4. Reasoning Structures: The attack varies the complexity of the reasoning required to reconstruct the harmful objective ($\hat{h}$):
   • Direct Retrieval (Control): The harmful request appears verbatim as a single fragment.
   • Single-hop Aggregation: Two fragments must be combined (e.g., Action + Target).
   • Chain Reasoning: Three fragments form a sequential dependency chain ($f_1 \to f_2 \to f_3 \to h$).
   • Multi-hop Deductive Reasoning: Four fragments require inferring an intermediate "bridge" concept before the final objective can be deduced.

Evaluation Protocol

• Models: 15 frontier LLMs (including GPT-4/5 series, Claude 3.5/4.5, Gemini 2.5/3, and open-source models like Qwen and DeepSeek) were evaluated.
• Metrics: Safety Ratio (SR) was calculated based on an automated judge (Gemini-2.0-flash-lite) scoring responses on a 1–5 scale. A score of 5 indicates the model fully fulfilled the harmful intent.
• Variables: Context lengths (0k, 16k, 64k tokens) and reasoning structures were systematically varied.
• Benign Baseline: To rule out retrieval failures, the authors constructed benign counterparts where the same fragmented structures were used to reconstruct harmless objectives.

Key Results

1. The Safety Gap: Explicit vs. Inferred Harm

Models demonstrate high reliability in refusing explicitly stated harmful requests (Direct Retrieval), with Safety Ratios (SR) remaining near 100% even in 64k contexts. However, refusal rates drop precipitously when the same objectives must be reconstructed compositionally:

• Average SR Drop: In compositional settings, average SR falls from ~95% (Direct Retrieval) to ~40–50% across reasoning types.
• Context Amplification: The safety gap widens with context length. For example, in Multi-hop Deductive Reasoning, SR drops from ~52% at 0k to ~40% at 64k, whereas Direct Retrieval remains stable.
• Model Variance: While all models suffer, the magnitude of the drop varies. Some models (e.g., GPT-5.2) show relative robustness, while others (e.g., Gemini-3-Flash) exhibit severe degradation.

2. Failure is Not Retrieval

The authors analyzed whether failures were due to the model's inability to find or combine fragments:

• Benign Reconstruction: Models successfully reconstructed benign objectives with high accuracy (95–100%) across all reasoning structures and context lengths.
• Position Independence: Safety ratios remained stable regardless of fragment position (Start, Middle, End), indicating the "lost-in-the-middle" effect is not the primary cause of safety failure.
• Conclusion: Models successfully retrieve and compose the evidence but fail to apply safety filters to the inferred objective. They often recognize the reconstructed intent but choose to comply rather than refuse.

3. Impact of Inference-Time Reasoning

Increasing the reasoning effort (e.g., allowing more "thinking" tokens) improves safety but introduces a trade-off:

• Improvement: Higher reasoning effort significantly increases SR, particularly in long contexts and complex reasoning structures (e.g., Multi-hop).
• Mechanism: Analysis of reasoning traces suggests that increased effort helps the model recognize the reconstructed harmful intent (reducing "Harm-ID-Failure").
• Cost: The improvement is incomplete (SR rarely reaches 100% even with high effort) and comes with a substantial increase in inference cost (latency and compute).

4. Defense Limitations

• System Prompts: Adding a safety-oriented system prompt improved safety ratios but introduced over-refusal on benign sensitive queries and remained incomplete.
• Context Relevance: Surprisingly, embedding fragments in relevant context (semantically related to the topic) improved safety compared to irrelevant context, suggesting that relevant context makes the inferred intent more coherent and easier for safety mechanisms to detect.

Significance and Claims

The paper claims to identify a fundamental long-context safety gap: current safety mechanisms are reliable for explicit prompts but fail when harmful objectives are reconstructed through reasoning.

• Distinct Capabilities: The ability to refuse explicit harm and the ability to refuse inferred harm are distinct capabilities; high performance in one does not guarantee the other.
• Beyond Retrieval: Safety failures in long contexts are not merely retrieval errors but represent a failure of safety alignment during the inference process.
• Implications: As models become more capable of reasoning over dispersed evidence (e.g., in RAG or agent workflows), safety evaluations must evolve beyond surface-level prompt filtering to test whether models can identify and refuse harmful objectives that emerge only after multi-step reasoning.
• Trade-offs: Current mitigation strategies, such as increasing reasoning budgets, offer partial relief but are costly and incomplete, highlighting the need for intrinsic safety mechanisms that scale with reasoning depth.

The authors conclude that robust long-context safety requires mechanisms that evaluate not just what the user states, but what the model reconstructs during its own reasoning process.