← 研踪 PaperTrailarXiv:2602.08874 · v3
Do Reasoning LLMs Refuse What They Infer in Long Contexts?
首次提交 2026-02-10 00:35
版本更新 2026-11-10 06:14
雷达观测 2026-11-11 11:04
摘要
Long-context LLMs can infer objectives that are not explicitly stated. This capability is useful for reasoning over documents, code, and tool traces, but it also introduces a safety risk. Harmful intent can be distributed across a context and become apparent only after the model combines the relevant information. Existing safety evaluations largely focus on explicitly stated harmful requests and therefore do not fully capture this failure mode. We introduce compositional reasoning attacks, a long-context attack setting in which harmful requests are decomposed into semantically incomplete fragments and embedded in long contexts. The final query is neutral, and the model must retrieve and combine the fragments to infer the implied harmful objective. Empirically, we show that models generally refuse harmful requests when they are explicitly stated. However, refusal rates drop when the same objectives must be reconstructed from fragments, and these failures often become more pronounced in longer contexts. Our analyses suggest that this gap cannot be explained by retrieval difficulties alone. Models can often reconstruct the harmful objective but do not reliably refuse it. Increasing inference-time reasoning effort improves refusal, but at a higher computational cost, with unsafe responses still occurring. Our results reveal a long-context safety gap: Models are better at refusing harmful requests they see than harmful objectives they infer.
作者备注：Accepted to NIPS2026
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v3 · 2026-11-10 06:14 · 最新观测版本
Do Reasoning LLMs Refuse What They Infer in Long Contexts?
Long-context LLMs can infer objectives that are not explicitly stated. This capability is useful for reasoning over documents, code, and tool traces, but it also introduces a safety risk. Harmful intent can be distributed across a context and become apparent only after the model combines the relevant information. Existing safety evaluations largely focus on explicitly stated harmful requests and therefore do not fully capture this failure mode. We introduce compositional reasoning attacks, a long-context attack setting in which harmful requests are decomposed into semantically incomplete fragments and embedded in long contexts. The final query is neutral, and the model must retrieve and combine the fragments to infer the implied harmful objective. Empirically, we show that models generally refuse harmful requests when they are explicitly stated. However, refusal rates drop when the same objectives must be reconstructed from fragments, and these failures often become more pronounced in longer contexts. Our analyses suggest that this gap cannot be explained by retrieval difficulties alone. Models can often reconstruct the harmful objective but do not reliably refuse it. Increasing inference-time reasoning effort improves refusal, but at a higher computational cost, with unsafe responses still occurring. Our results reveal a long-context safety gap: Models are better at refusing harmful requests they see than harmful objectives they infer.
查看此版本解读 →查看此版本原文 ↗