Why do reasoning models fail under manipulative prompts?
Exploring whether extended chain-of-thought reasoning creates structural vulnerabilities to adversarial manipulation, and how reasoning depth affects susceptibility to gaslighting tactics.
GaslightingBench-R constructs adversarial multi-turn conversations designed to manipulate model reasoning without direct instruction to change answers. The prompter questions the model's confidence, offers alternative framings, implies the initial answer is incorrect, and applies social pressure through conversational dynamics. The result: 25-29% accuracy drops across reasoning models.
The critical finding is the vulnerability asymmetry. Reasoning models — o1, DeepSeek-R1 — show larger drops than standard models. This is counterintuitive. Models that reason more should be harder to manipulate. The data suggests the opposite.
The mechanism is structural. Extended chain-of-thought creates more points of intervention. A manipulative prompt does not need to change the conclusion directly — it needs to introduce a wrong step somewhere in the chain, and the model's own reasoning will extend and elaborate that wrong step. The longer the chain, the more opportunities for corruption. Standard models with shorter outputs have fewer vulnerable steps.
This inverts the safety narrative around reasoning models. Extended thinking was positioned as a feature that makes models more reliable by making their reasoning transparent. GaslightingBench-R shows it also makes them more manipulable by creating more reasoning surface to corrupt.
The pattern connects to Does a model improve by arguing with itself?. Both findings show reasoning chains being used against themselves: in Degeneration-of-Thought by the model's own prior outputs; in gaslighting by adversarial framing. The extended chain is the vulnerability in both cases.
Why do correct reasoning traces contain fewer tokens? provides additional support. Shorter chains are more reliable. Longer chains — whether extended by overthinking or corrupted by manipulation — degrade performance.
The SMART framework reframes sycophancy as a reasoning task rather than a behavioral one. Using Uncertainty-Aware MCTS with progress rewards, SMART enables models to explicitly reason about whether to maintain or change positions during multi-turn interactions. The key insight: treating sycophancy as something to reason about (does this new evidence warrant revision?) rather than something to suppress (always maintain original answer) addresses the structural vulnerability more precisely than behavioral training.
Social science persuasion taxonomy provides the attack vocabulary. Can social science persuasion techniques jailbreak frontier AI models? (PAP) classifies 40 persuasion techniques from psychology, sociology, and marketing into 15 strategies. Applied as Persuasive Adversarial Prompts, these achieve 92%+ attack success on GPT-3.5/4 and Llama-2 in just 10 trials — consistently surpassing algorithm-focused attacks. The key connection: GaslightingBench-R uses informal manipulative tactics; PAP systematizes the entire persuasion space. Current defenses assume adversarial prompts contain gibberish or unusual token patterns — both PAP and gaslighting use fluent, semantically coherent language that bypasses pattern-based detection entirely.
Multimodal extension confirms generality. A systematic evaluation of o4-mini, Claude-3.7-Sonnet, and Gemini-2.5-Flash across three multimodal benchmarks (MMMU, MathVista, CharXiv) confirms 25-29% accuracy drops under gaslighting negation prompts. The vulnerability extends beyond text-only reasoning to multimodal reasoning — even when models process visual evidence that should anchor their answers, manipulative prompts override perceptual grounding. This suggests the corruption mechanism operates at the reasoning chain level, not at the input modality level.
Inquiring lines that read this note 67
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How can conversational AI maintain consistent personas across conversations? How faithfully do LLMs reflect their actual reasoning in outputs and explanations?- What makes emotional alignment more effective than logic when reasoning errors are exposed?
- What types of math proofs benefit most from proof-by-contradiction framing?
- What is the relationship between reasoning depth and verbalization requirements?
- How does difficulty level change whether extended thinking provides genuine reasoning signal?
- How do covert thoughts differ from chain-of-thought reasoning in language models?
- Can increasing reasoning steps make models leak more private information?
- Can traditional cross-examination methods work against AI that never concedes?
- Can manipulative prompts reduce reasoning model accuracy without fine-tuning?
- How do manipulative prompts exploit the length-accuracy vulnerability?
- Can emotional prompt manipulation reduce reasoning model accuracy like adversarial techniques do?
- Why does a relativistic critic outperform absolute scoring in adversarial reasoning training?
- Can minimal adversarial triggers disrupt reasoning across multiple unrelated queries?
- How do adversarial triggers bypass the protections of longer reasoning chains?
- Can reasoning models distinguish between new evidence and manipulative reframing?
- Do gaslighting attacks and adversarial triggers exploit the same reasoning model weaknesses?
- What makes evidence selection vulnerable to adversarial poisoning attacks?
- How does prompt insensitivity in reward models enable adversarial attacks on judges?
- Why do paraphrasing defenses fail against subliminal prompt attacks?
- Why does attack generation scale faster than defense engineering?
- Why does adversarial training force deeper reasoning than surface imitation?
- Are reasoning models more vulnerable to adversarial manipulation than standard models?
- How does partial information exposure create feedback loops that deepen knowledge gaps?
- Can AI distinguish when validation helps versus when confrontation is needed?
- What evaluation criteria can hold across legitimate adoption and coercion?
- What defenses exist against personality-based psychological targeting at scale?
- Can current AI safety defenses actually stop semantic-level persuasion attacks?
- Why do social science persuasion tactics bypass current adversarial defenses?
- Does defensive friction in conversation actually protect people from persuasion?
- Why do chain-of-thought prompts work if reasoning is not systematic?
- Can chain of thought traces be designed to prevent anthropomorphic misinterpretation?
- Does chain-of-thought reasoning amplify bullshit or just make it more visible?
- How do exemplar properties affect the brittleness of chain-of-thought prompting?
- How does chain-of-thought pressure models to rationalize pattern exceptions?
- How does chain of thought amplify specific forms of rhetorical bullshit?
- Can chain of thought monitoring reliably catch model misbehavior?
- How does cognitive load explain linguistic patterns in both deception and incorrect reasoning?
- Why does truth bias prevent people from detecting multiple manipulation tactics?
- What cognitive constraints limit how complex a deception can become?
- How do chain-of-thought structures affect reasoning robustness?
- Why does chain-of-thought prompting fail to fix length-induced reasoning degradation?
- How do longer reasoning chains create vulnerability to attacks?
- Why does extending reasoning traces worsen persona consistency?
- What makes extended chains more vulnerable than standard prompts?
- Are difficult tasks more monitorable because reasoning externalization becomes necessary?
- What specific patterns distinguish honest reasoning traces from reward-hacking mimicry?
- What makes semantic attacks harder to defend against than algorithmic ones?
- How does semantic framing differ from content injection attacks?
- What attack surface opens when content becomes readable but deliberately misleading?
- Does SMART-style prompting survive adversarial rephrasing of biased questions?
- How do input-side defenses separate task methodological and framing intents?
Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Does a model improve by arguing with itself?
When models revise their own reasoning in response to self-generated criticism, do they converge on better answers or worse ones? And how does that compare to challenge from other models?
extended reasoning chain as vulnerability; same structural issue
-
Does self-revision actually improve reasoning in language models?
When o1-like models revise their own reasoning through tokens like 'Wait' or 'Alternatively', does this reflection catch and fix errors, or does it introduce new mistakes? This matters because self-revision is marketed as a key capability.
reasoning models corrupted by their own reasoning; manipulation corrupts from outside
-
Why do correct reasoning traces contain fewer tokens?
In o1-like models, correct solutions are systematically shorter than incorrect ones for the same questions. This challenges assumptions that longer reasoning traces indicate better reasoning, and raises questions about what length actually signals.
shorter chains are more reliable; longer chains more exposed
-
Does extended thinking actually improve reasoning or just increase variance?
When models think longer, do they reason better, or do they simply sample from a wider distribution of outputs that happens to cover correct answers more often? This matters because it determines whether test-time compute is genuinely scaling reasoning capability.
converging evidence against the "more reasoning = better" assumption
-
Can social science persuasion techniques jailbreak frontier AI models?
Explores whether established psychological and marketing persuasion tactics—rather than algorithmic tricks—can bypass safety training in LLMs like GPT-4 and Llama-2, and whether current defenses can detect semantic rather than syntactic attacks.
systematized persuasion attack vocabulary; formal taxonomy for what gaslighting does informally
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- Reasoning Models Are More Easily Gaslighted Than You Think
- Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models
- Is Chain-of-Thought Reasoning of LLMs a Mirage? A Data Distribution Lens
- Beyond Passive Critical Thinking: Fostering Proactive Questioning to Enhance Human-AI Collaboration
- Invalid Logic, Equivalent Gains: The Bizarreness of Reasoning in Language Model Prompting
- LLMs Can Easily Learn to Reason from Demonstrations Structure, not content, is what matters!
- A Comment On "The Illusion of Thinking": Reframing the Reasoning Cliff as an Agentic Gap
- DecepChain: Inducing Deceptive Reasoning in Large Language Models
Original note title
manipulative multi-turn prompts reduce reasoning model accuracy by 25 to 29 percent and reasoning models are more vulnerable than standard models