arXiv cs.CL· Yu Fu, Haz Sameen Shahgir, Huanli Gong, Zhipeng Wei, N. Benjamin Erichson, Yue Dong·· 10 小时前AI 评分58
推理 LLM 在长上下文中会拒绝自己推断出的有害目标吗？
Do Reasoning LLMs Refuse What They Infer in Long Contexts?
AI 导读
论文提出组合式推理攻击：把有害请求拆成语义不完整的片段嵌入长上下文，最终查询本身保持中性，模型需检索并组合片段才能推断出隐含的有害目标。实验显示，模型对明确陈述的有害请求通常会拒绝，但当同一目标需从片段重建时拒绝率下降，且上下文越长越明显；分析表明这一差距不能仅用检索困难解释，模型往往能重建有害目标却未可靠拒绝。
正文 · 原文
Abstract:Long-context LLMs can infer objectives that are not explicitly stated. This capability is useful for reasoning over documents, code, and tool traces, but it also introduces a safety risk. Harmful intent can be distributed across a context and become apparent only after the model combines the relevant information. Existing safety evaluations largely focus on explicitly stated harmful requests and therefore do not fully capture this failure mode. We introduce compositional reasoning attacks, a long-context attack setting in which harmful requests are decomposed into semantically incomplete fragments and embedded in long contexts. The final query is neutral, and the model must retrieve and combine the fragments to infer the implied harmful objective. Empirically, we show that models generally refuse harmful requests when they are explicitly stated. However, refusal rates drop when the same objectives must be reconstructed from fragments, and these failures often become more pronounced in longer contexts. Our analyses suggest that this gap cannot be explained by retrieval difficulties alone. Models can often reconstruct the harmful objective but do not reliably refuse it. Increasing inference-time reasoning effort improves refusal, but at a higher computational cost, with unsafe responses still occurring. Our results reveal a long-context safety gap: Models are better at refusing harmful requests they see than harmful objectives they infer.
| Comments: | Accepted to NIPS2026 |
| Subjects: | Computation and Language (cs.CL); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2602.08874 [cs.CL] |
| (or arXiv:2602.08874v3 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2602.08874 arXiv-issued DOI via DataCite |
Submission history
From: Yu Fu [view email]
[v1]
Mon, 9 Feb 2026 16:35:14 UTC (469 KB)
[v2]
Thu, 14 May 2026 02:54:57 UTC (444 KB)
[v3]
Mon, 9 Nov 2026 22:14:39 UTC (436 KB)
来源：arXiv cs.CL · arxiv.org