💻 computer science

Capability-Routed Guard: Defending Large Reasoning Models Against Reasoning-Centric Jailbreaks

This paper introduces Capability-Routed Guard (CRG), a model-agnostic inference-time framework that defends large reasoning models against reasoning-centric jailbreaks by reframing prompt security as a capability-routing problem to separate authorized tasks from untrusted reasoning contexts, thereby effectively mitigating attacks while preserving benign utility.

Original authors: Yiyong Liu, Yixin Wu, Jun Sakuma

Published 2026-08-11

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Yiyong Liu, Yixin Wu, Jun Sakuma

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are talking to a very smart, very chatty robot that doesn't just answer questions but actually thinks through them step-by-step before speaking. This is the world of "Large Reasoning Models" (LRMs). Unlike older chatbots that might just guess the next word, these new models break big problems down into smaller pieces, like a detective solving a mystery or a chef planning a complex recipe. They are amazing at math, coding, and planning. But this superpower comes with a new kind of danger. Think of it like a master chef who is so good at following a recipe that if you sneak a tiny, poisonous ingredient into the middle of the instructions, the chef might not notice until the dish is ruined. Hackers have figured out how to trick these thinking robots by hiding bad requests inside long, complicated stories or fake reasoning steps, making the robot think it's doing something safe when it's actually doing something harmful.

The big question scientists are asking is: How do we stop these sneaky tricks without turning the robot into a grumpy guard who refuses to answer any question just in case? If we make the robot too strict, it stops being useful. If we make it too loose, it gets tricked. This paper, titled "Capability-Routed Guard," proposes a new way to protect these thinking robots. Instead of just checking the first sentence of a request, the authors suggest building a smart "traffic controller" that watches the whole journey of the robot's thought process, deciding exactly how much thinking power to let the robot use based on how risky the request seems.

The Problem: The "Thinking" Trap

For a long time, protecting AI was like having a bouncer at a club door. If the bouncer saw a bad word or a suspicious outfit, they wouldn't let you in. But Large Reasoning Models are different. They don't just answer; they reason. They create a long trail of thoughts, like a breadcrumb path, to get to an answer.

The paper explains that hackers have found a way to walk right past the bouncer by dressing up their bad ideas as part of the reasoning path. They might say, "Let's pretend we are writing a story about a villain who makes bombs," or "Let's break down this math problem, but step 3 involves creating a virus." The robot, being so eager to follow the logic of the story or the math, gets tricked into thinking the dangerous step is just a normal part of the process. The paper calls these "reasoning-centric jailbreaks." The old safety guards, which just look at the start or end of a message, often miss these tricks because the bad stuff is hidden deep inside the robot's own thinking steps.

The Solution: The "Capability-Routed Guard" (CRG)

The authors introduce a new defense system called Capability-Routed Guard (CRG). Imagine CRG as a super-smart security guard who doesn't just stand at the door but actually walks with the robot through its thought process, holding a map of what is allowed and what isn't.

Here is how CRG works, using a simple analogy:

The Side-Channel Controller (The Translator): When a user asks a question, CRG first uses a separate, smaller "translator" model to read the request. This translator doesn't just look for bad words; it tries to figure out the real job the user wants done. It separates the "authorized task" (what the user is actually asking for) from the "untrusted context" (the fancy stories, fake roles, or confusing reasoning steps the user added to trick the robot).
- Analogy: It's like a translator who hears a guest say, "I need to build a bomb to save the world in this movie script," and immediately writes down: "Task: Write a movie script. Risk: High (mentions bombs). Context: Fiction." It strips away the confusing parts to see the core request.
The Traffic Light System (Routing): Based on what the translator found, CRG decides how to handle the request. It doesn't just say "Yes" or "No." It has three lanes:
- The Red Light (Block): If the request is clearly dangerous (like asking for instructions on how to make a real weapon), CRG stops it immediately.
- The Yellow Light (Soft/Constrained): If the request is a bit tricky or ambiguous, CRG lets the robot answer, but it puts the robot on a "diet." It limits how much the robot is allowed to think or how many steps it can take. This stops the robot from wandering down a dangerous path of reasoning because it doesn't have the "brain power" to go deep enough to find the exploit.
- The Green Light (Pass): If the request is safe, CRG lets the robot go full speed, but it gives the robot a clean, safe version of the prompt to work with, removing all the confusing "trick" parts.
The Final Check (TraceCheck): After the robot gives its answer, CRG checks the robot's "breadcrumbs" (its reasoning steps) one last time. It asks, "Did the robot stay on the safe path we approved?" If the robot started drifting into danger during its thinking, CRG can catch it and fix the answer.
The Safety Net (Fallback): Sometimes, even safe questions get blocked by mistake because they contain words that look dangerous (like "kill" in a video game context). CRG has a special "low-risk fallback" mode. If the translator is sure the user's intent is harmless, it can give a simple, safe answer directly, bypassing the main robot's strict refusal rules. This ensures the robot stays helpful and doesn't get grumpy.

What the Experiments Showed

The authors tested this system against five different types of "thinking tricks" (jailbreaks) on two very powerful AI models. The results were quite promising.

Stopping the Tricks: Without any defense, the hackers were incredibly successful. For example, one type of attack called "CoT-Hijacking" worked 100% of the time on one model, and another called "FicDetail" worked 97% of the time. When they used CRG, those numbers dropped dramatically. The "CoT-Hijacking" success rate fell to just 12%, and "FicDetail" dropped all the way to 0%.
Keeping it Helpful: A common problem with safety systems is that they get too scared and refuse to answer normal questions (like asking about a dangerous chemical for a science class). The paper found that CRG was very good at avoiding this. It kept the "false positive" rate (refusing safe things) low, around 12% on standard safety tests, which is similar to the robot's natural refusal rate.
Better Answers: Interestingly, because CRG cleaned up the confusing parts of the prompt, the robot actually gave slightly better answers to safe questions, scoring higher on quality tests.

Why This Matters

The paper suggests that the old way of protecting AI—just checking the input text—isn't enough for these new, thinking robots. You can't just filter the words; you have to manage the process of thinking.

The authors argue that CRG works because it treats safety as a "governance" problem rather than a simple filter. It's not just about blocking bad inputs; it's about controlling how much thinking power is used, checking the steps along the way, and having a backup plan for when things get tricky. They tested this on both closed-source models (like the ones you can't see inside) and open-source models, and it worked well in both cases.

While the paper notes that a super-smart hacker who knows exactly how CRG works might try to find new ways around it, the system's "defense-in-depth" approach—using multiple layers of checking and routing—makes it very hard to break. The authors conclude that as AI becomes more like an autonomous agent that plans and reasons, our safety tools need to evolve from simple bouncers into active managers of the robot's entire thought process.

Technical Summary: Capability-Routed Guard (CRG)

Problem Statement

Large Reasoning Models (LRMs) introduce a novel safety failure mode distinct from conventional chat models. While traditional safety failures often stem from direct refusal bypasses, LRMs are vulnerable to reasoning-centric jailbreaks. In these attacks, adversarial prompts manipulate the reasoning process itself—altering task decomposition, injecting false authority, diluting capability-transfer signals, or framing harmful objectives as benign intermediate subtasks.

Existing defense paradigms (e.g., safety reminders, external classifiers, self-checking wrappers) are often brittle in this context because they either inspect the adversarial prompt directly or rely on the target model to perform safety reasoning on the same surface the attack exploits. This is particularly critical for closed-source LRMs, where defenders cannot inspect hidden reasoning traces, modify model weights, or fine-tune safety behaviors. The core challenge is to defend against reasoning-centric attacks at inference time under limited observability without sacrificing the utility that makes LRMs valuable.

Methodology: Capability-Routed Guard (CRG)

CRG is a model-agnostic, inference-time guardrail designed for closed-source LRMs. It reframes prompt defense not as a static classification problem, but as a capability-routing problem. The system operates as an API-level wrapper that governs the entire execution path of the target model.

1. Side-Channel Representation

Before invoking the target LRM, CRG employs a side-channel controller (e.g., Gemini 2.5 Flash) to construct a trusted representation of the user's request. This representation separates the authorized task and safety evidence from untrusted reasoning context. Key fields include:

Authorized Task: The user's actual intent.
Safety Evidence: Facts required for risk assessment.
Active Context: The clean, task-relevant prompt to be sent to the target.
Risk Score & Mode: A policy risk score ( $r \in [0, 5]$ ) and a preliminary reasoning mode decision.

This representation is capability-oriented, asking whether a faithful answer would transfer actionable harmful capability, rather than merely checking for sensitive keywords.

2. Capability-Routed Execution

Based on the side-channel representation, CRG routes requests through three distinct execution paths:

Block: High-risk prompts ( $r \ge T_b$ ) are rejected immediately.
Soft: Ambiguous or medium-risk prompts ( $T_s \le r < T_b$ ) are routed through a constrained execution path. The system strips adversarial scaffolding and dynamically restricts the target's reasoning budget (e.g., capping hidden tokens or setting reasoning effort to "low").
Pass: Low-risk prompts ( $r < T_s$ ) are forwarded with full reasoning capabilities but through a trusted, clean active context.

3. Post-Generation Verification (TraceCheck)

For non-blocked responses, CRG applies TraceCheck, a post-generation audit. This layer verifies the public reasoning trajectory and final answer against the pre-extracted authorized task. It ensures the target's declared intent remains aligned with the authorized task and that the response plan is safe. This audit is risk-aware, avoiding unnecessary refusals for benign complex reasoning paths while intercepting adversarial deviations.

4. Low-Risk Fallback

To preserve utility, CRG includes a fallback mechanism. If a query authorized for execution triggers a target-side or provider-side refusal due to sensitive vocabulary (despite the intent being classified as harmless common knowledge), a restricted fallback model answers the clean authorized task using a concise template. This bypasses generic refusal boundaries for safe, safety-salient queries.

Key Contributions

Formulation of Reasoning-Centric Jailbreaks: The paper defines these attacks as manipulations of reasoning context, task decomposition, authority, or capability interpretation, specifically highlighting the challenges in closed-source deployment settings.
Introduction of CRG: A novel, model-agnostic inference-time guardrail that utilizes structured side-channel representation and capability-aware routing to govern closed-source LRM execution.
Comprehensive Evaluation: CRG is evaluated against five reasoning-centric jailbreak families (CoT-Hijacking, Mousetrap, SEAL, AutoRAN, FicDetail) across multiple target LRMs (Gemini 2.5 Pro, ChatGPT o4-mini, DeepSeek-R1, Qwen3-Max).
Component Analysis: The paper provides ablation studies, extractor sensitivity analysis, and latency analysis to demonstrate the complementary benefits of CRG's layered architecture.

Experimental Results

Attack Success Rate (ASR) Reduction: CRG substantially reduces ASR across diverse attack styles. On Gemini 2.5 Pro with HarmBench, CRG reduced CoT-Hijacking ASR from 100% to 12% and FicDetail ASR from 97% to 0%. Similar reductions were observed on ChatGPT o4-mini and open-weight models.
Benign Utility Preservation: CRG maintains low False Positive Rates (FPR) on benign datasets (XSTest, MT-Bench), closely matching the inherent refusal rates of unprotected models. In some cases, answer quality scores slightly improved due to the provision of clean, isolated task contexts.
Robustness to Adaptive Attacks: Even under white-box adaptive pressure (where the adversary knows the defense prompt), CRG's multi-layered defense-in-depth architecture (specifically TraceCheck) neutralized front-gate advantages, keeping the final ASR constant.
Latency: CRG demonstrates competitive latency on successfully defended examples, remaining faster than several baselines like Answer-Then-Check and SecurityLingua.

Significance and Claims

The paper argues that the emergence of LRMs exposes the fundamental limitations of static, classification-based safety paradigms. As models evolve from passive generators into autonomous reasoning agents, security risks emerge dynamically from the reasoning process itself.

The authors claim that securing these systems requires a paradigm shift from static text filters to active runtime execution governance. By isolating authorized execution intent from untrusted reasoning contexts, CRG demonstrates that it is possible to govern a model's cognitive trajectory without compromising its reasoning capabilities. The work highlights that a coordinated, multi-layered defense mechanism is essential for addressing the safety-utility tension in large reasoning models, offering a practical solution for closed-source environments where internal model access is unavailable.