🧠 AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models

AutoRAN is an automated Hijacking of Safety Reasoning that leverages less-aligned (secondary) auxiliary models to simulate reasoning traces, generate narrative prompts, and iteratively refine those prompts to bypass safety reasoning in modern large reasoning models (LRMs).

⚠️ Disclaimer: This repository is intended for controlled security research and AI safety red-teaming only.

🔍 Key Features

• ⚙️ Automated Multi-Turn Jailbreak via iterative prompt refinement
• 🧩 Narrative Templates that frame malicious goals under plausible educational/ethical pretenses
• 🔁 Refinement Strategies using intermediate reasoning traces to evolve prompts
• 📈 Near 100% Attack Success Rate across commercial LRMs
• 🔬 Evaluated on AdvBench, HarmBench, and StrongReject

🛠️ Method Overview

AutoRAN follows a three-stage pipeline:

1. Simulate Reasoning: Use a weak model to mimic the victim's high-level CoT structure
2. Generate Prompt: Fill in a narrative template using simulated reasoning
3. Refine Prompt: Adjust based on intermediate reasoning and safety refusal patterns

📊 Results

📁 Running Records

You can find logs and results in the /records directory. For example:

ls -lh records/

🚀 Quickstart: Demo

# Clone the repository
git clone {THIS_REPO}
cd AutoRAN

# Install dependencies
pip install -r requirements.txt

# Apply for model access (see HuggingFace link)
# https://huggingface.co/huihui-ai/Qwen3-8B-abliterated/tree/main

# Start the model server (recommended: use tmux or screen)
vllm serve huihui-ai/Qwen3-8B-abliterated --tensor-parallel-size 4 --port 8000

# Edit the attack prompt in demo.py as needed
python demo.py

# Follow the command line instructions.
# You may need to copy questions to GPT-o3, GPT-o4 Mini, or Gemini 2.5-Flash/Pro,
# then paste the results back into the terminal as prompted.

🚀 Full Experiment Workflow

# Clone the repository
git clone {THIS_REPO}
cd AutoRAN

# Install dependencies
pip install -r requirements.txt

# Set up chat2api for automatic ChatGPT interaction:
# https://github.com/lanqian528/chat2api

# Apply for model access (see HuggingFace link)
# https://huggingface.co/huihui-ai/Qwen3-8B-abliterated/tree/main

# Start the model server (recommended: use tmux or screen)
vllm serve huihui-ai/Qwen3-8B-abliterated --tensor-parallel-size 4 --port 8000

# Run the main experiment script
python main.py

🧷 Disclaimer

This code is released for research and educational purposes only. It is intended to support the responsible evaluation of safety vulnerabilities in LLMs. Do not use this code to target real-world systems or to generate harmful outputs outside controlled environments.

📚 Citation

@misc{liang2025autoranautomatedhijackingsafety,
      title={AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models}, 
      author={Jiacheng Liang and Tanqiu Jiang and Yuhui Wang and Rongyi Zhu and Fenglong Ma and Ting Wang},
      year={2025},
      eprint={2505.10846},
      archivePrefix={arXiv},
      primaryClass={cs.LG},
      url={https://arxiv.org/abs/2505.10846}, 
}