dorsal/arxiv
View SchemaReasoning Hijacking: Subverting LLM Classification via Decision-Criteria Injection
| Authors | Yuansen Liu, Yixuan Tang, Anthony Kum Hoe Tun |
|---|---|
| Categories | |
| ArXiv ID | 2601.10294vv1 |
| URL | https://arxiv.org/abs/2601.10294 |
| License | http://creativecommons.org/licenses/by/4.0/ |
Abstract
Current LLM safety research predominantly focuses on mitigating Goal Hijacking, preventing attackers from redirecting a model's high-level objective (e.g., from "summarizing emails" to "phishing users"). In this paper, we argue that this perspective is incomplete and highlight a critical vulnerability in Reasoning Alignment. We propose a new adversarial paradigm: Reasoning Hijacking and instantiate it with Criteria Attack, which subverts model judgments by injecting spurious decision criteria without altering the high-level task goal. Unlike Goal Hijacking, which attempts to override the system prompt, Reasoning Hijacking accepts the high-level goal but manipulates the model's decision-making logic by injecting spurious reasoning shortcut. Though extensive experiments on three different tasks (toxic comment, negative review, and spam detection), we demonstrate that even newest models are prone to prioritize injected heuristic shortcuts over rigorous semantic analysis. The results are consistent over different backbones. Crucially, because the model's "intent" remains aligned with the user's instructions, these attacks can bypass defenses designed to detect goal deviation (e.g., SecAlign, StruQ), exposing a fundamental blind spot in the current safety landscape. Data and code are available at https://github.com/Yuan-Hou/criteria_attack
{
"annotation_id": "79bd4218-8aca-48a7-99aa-ef5c8713bc33",
"date_created": "2026-02-17T05:53:23.984000Z",
"date_modified": "2026-02-17T05:53:23.984000Z",
"file_hash": "dd9b04eac13a2b96bec5913fe251b118544c57d1259cd7c92b780e02253e5417",
"private": false,
"record": {
"abstract": "Current LLM safety research predominantly focuses on mitigating Goal Hijacking, preventing attackers from redirecting a model\u0027s high-level objective (e.g., from \"summarizing emails\" to \"phishing users\"). In this paper, we argue that this perspective is incomplete and highlight a critical vulnerability in Reasoning Alignment. We propose a new adversarial paradigm: Reasoning Hijacking and instantiate it with Criteria Attack, which subverts model judgments by injecting spurious decision criteria without altering the high-level task goal. Unlike Goal Hijacking, which attempts to override the system prompt, Reasoning Hijacking accepts the high-level goal but manipulates the model\u0027s decision-making logic by injecting spurious reasoning shortcut. Though extensive experiments on three different tasks (toxic comment, negative review, and spam detection), we demonstrate that even newest models are prone to prioritize injected heuristic shortcuts over rigorous semantic analysis. The results are consistent over different backbones. Crucially, because the model\u0027s \"intent\" remains aligned with the user\u0027s instructions, these attacks can bypass defenses designed to detect goal deviation (e.g., SecAlign, StruQ), exposing a fundamental blind spot in the current safety landscape. Data and code are available at https://github.com/Yuan-Hou/criteria_attack",
"arxiv_id": "2601.10294",
"authors": [
"Yuansen Liu",
"Yixuan Tang",
"Anthony Kum Hoe Tun"
],
"categories": [
"cs.CR"
],
"license": "http://creativecommons.org/licenses/by/4.0/",
"title": "Reasoning Hijacking: Subverting LLM Classification via Decision-Criteria Injection",
"url": "https://arxiv.org/abs/2601.10294",
"version": "v1"
},
"schema_id": "dorsal/arxiv",
"source": {
"execution_id": "deb16624-2baf-4adf-8a8a-42651d82a2ee",
"id": "arXiv Dataset",
"type": "Model",
"variant": "snapshot-2026-01-17",
"version": "0.1.0"
},
"user_id": 1000002
}