1 Introduction↩︎

Large Language Models (LLMs) have demonstrated remarkable proficiency on complex reasoning tasks by generating explicit chain-of-thought (CoT) trajectories [1]–[4], which are step-by-step intermediate reasoning sequences that decompose difficult problems before committing to a final answer. This paradigm has been further formalized in Large Reasoning Models (LRMs) such as OpenAI o1 [5] and DeepSeek-R1 [6], which internalize extended reasoning chains as a core capability and achieve state-of-the-art performance on mathematical, scientific, and logical benchmarks. As these systems are increasingly deployed in high-stakes domains, including automated decision support, code generation, and scientific discovery, the trustworthiness of their underlying reasoning processes becomes a critical concern.

Despite their advanced capabilities, the reasoning processes of LLMs remain highly vulnerable to both adversarial manipulation and inherent flaws. Specifically, models face targeted reasoning attacks that can be broadly categorized into two types. First, reasoning hijacking attacks [7]–[9] inject adversarially crafted steps that redirect the inference trajectory toward an attacker-controlled conclusion, corrupting the final answer while maintaining superficial coherence. Second, reasoning denial-of-service (DoS) attacks [10]–[12] exploit the open-ended nature of extended reasoning by inducing the generation of non-terminating or excessively redundant chains, thereby exhausting computational resources and inflating inference costs. Beyond these adversarial threats, models also exhibit intrinsic reasoning vulnerabilities [13], [14], such as logical fallacies, arithmetic errors, and semantic misunderstandings. These vulnerabilities can arise without any external manipulation and often compound into catastrophic decision errors on high-complexity tasks.

Given these severe vulnerabilities, protecting the integrity of the inference process is essential. Historically, the security community has devoted considerable effort to content safety, ensuring that model outputs are free from toxicity, bias, privacy leakage, and factual hallucination [15]–[17]. However, this emphasis on the final output leaves the reasoning process itself largely unprotected, exposing the chain-of-thought trajectory as a distinct and previously underexplored attack surface. To bridge this gap, we propose the concept of reasoning safety. We define reasoning safety as the property that a model’s chain-of-thought trajectory remains logically consistent, computationally efficient, and resistant to adversarial manipulation. This concept constitutes a security dimension strictly orthogonal to traditional content safety. For instance, a model might produce a benign-sounding final answer even though its underlying reasoning is corrupted by injected fallacies or trapped in an infinite loop. Conversely, a logically sound reasoning chain could still yield harmful content. Therefore, securing deployed LLM systems necessitates the independent monitoring of both safety dimensions.

While the necessity of reasoning safety is clear, current safety mechanisms may not be well-suited to address this emergent challenge. Hallucination detectors [18]–[20] primarily assess the factual consistency of model outputs by cross-referencing sampled responses or external knowledge bases. They are generally restricted to identifying factual errors in surface-level claims and often struggle to detect logical fallacies, injected goal deviations, or process management failures that lack overt factual contradictions. Similarly, Process reward models (PRMs) assign quality scores to individual reasoning steps, but they are typically trained to optimize answer-trajectory quality on standard in-distribution tasks. They may fall short in generalizing to the diverse and nuanced error types induced by adversarial attacks, and they mostly produce scalar scores without interpretable explanations, which complicates fine-grained diagnosis. As our subsequent empirical evaluations demonstrate, even state-of-the-art hallucination detectors and PRMs achieve limited diagnostic accuracy and high false-positive rates when confronted with sophisticated reasoning anomalies, highlighting the need for a dedicated reasoning safety framework.

In this paper, we propose a Reasoning Safety Monitor: an external, trusted component that operates in parallel with the target LLM, inspecting each reasoning step as it is generated in a streaming fashion. Upon detecting an unsafe step, the monitor immediately dispatches an interrupt signal to halt further generation, preventing corrupted reasoning from propagating to the final answer or terminating runaway chains before they exhaust computational budgets. The monitor is implemented by prompting an off-the-shelf LLM with a carefully designed prompt that embeds a nine-type error taxonomy, a structured input-output schema, and explicit calibration rules to suppress false positives on exploratory reasoning. This design requires no model fine-tuning, is model-agnostic with respect to the target LLM, and produces interpretable, actionable verdicts for each flagged step. The main contributions of this work are as follows:

• We formally define reasoning safety as a fundamental security dimension orthogonal to traditional content safety. To operationalize this, we introduce a systematic nine-category taxonomy of unsafe reasoning behaviors, structured around the stages of reasoning and the violation of three core properties: logical consistency, computational efficiency, and manipulation resistance.

• We construct and annotate a comprehensive corpus of 4,155 reasoning chains, spanning benign problem-solving tasks and four state-of-the-art adversarial attacks. This study empirically validates the real-world prevalence of all nine defined unsafe behaviors and demonstrates that each attack induces a distinctive, mechanistically interpretable error signature.

• We design and implement the Reasoning Safety Monitor, a zero-shot, parallel verification system. By integrating step-level stream segmentation, contextual history tracking, taxonomy-embedded prompting, and a configurable intervention mechanism, our framework achieves precise real-time detection of reasoning vulnerabilities without requiring task-specific fine-tuning.

• We extensively evaluate the monitor across four diverse LLM backends on a 450-chain static benchmark. Our approach achieves up to 87.11% position accuracy, outperforming hallucination detectors by over 50% and the best process reward model (PRM) baseline by over 19%. Crucially, the monitor maintains a near-zero false positive rate on correct reasoning paths, ensuring that benign inference is not erroneously intercepted. Furthermore, our framework operates with negligible latency overhead and exhibits robust resilience against dynamic adversarial evasion.

The remainder of this paper is organized as follows. Section 2 contextualizes our work within the broader landscape of content safety, chain-of-thought reasoning, and emerging adversarial reasoning attacks. Section 3.2 formally defines reasoning safety and establishes a comprehensive taxonomy of unsafe reasoning behaviors, while Section 3.3 details our large-scale annotation study to demonstrate their real-world prevalence. In Section 4, we present the architecture and implementation of the proposed Reasoning Safety Monitor. Section 5 provides a rigorous empirical evaluation of the monitor’s performance. Finally, Section 7 summarizes our contributions and explores open challenges for future research.

2 Related Work↩︎

2.1 Content Safety↩︎

Content safety research for LLMs has primarily focused on ensuring that model outputs are free from harmful, biased, or factually incorrect content. One major line of work addresses harmful content and toxicity: alignment techniques such as Reinforcement Learning from Human Feedback (RLHF) [15] and Constitutional AI [16] train models to refuse unsafe requests, while dedicated classifiers such as Llama Guard [17] and RealToxicityPrompts [21] benchmark and filter toxic outputs. A second line targets hallucination: methods such as SelfCheckGPT [18] assess the factual consistency of generated text by cross-checking sampled outputs against external knowledge; while other methods use external mechanisms, such as Retrieval-Augmented Generation (RAG) [22] and LLM-as-Critic (LCM) [20], to ground responses in verifiable information. Broader trustworthiness evaluations such as TrustLLM [23] further assess LLMs across dimensions including truthfulness, fairness, and robustness.

Despite this breadth, existing content safety approaches share a fundamental limitation: they operate on the final output or surface-level content of model responses, treating the reasoning chain as a black box. They are therefore blind to reasoning-level vulnerabilities, such as injected logical fallacies, manipulated inference steps, or adversarially induced overthinking, which corrupt the reasoning process itself while potentially leaving the final output superficially intact. This gap motivates our work on reasoning safety, a dimension orthogonal to content safety.

2.2 COT & LRMs↩︎

Chain-of-Thought (CoT) prompting [1] has emerged as a fundamental paradigm for enhancing LLM reasoning, requiring models to articulate step-by-step logical sequences before producing a final answer. Building on this foundation, advanced frameworks such as Self-Consistency CoT [2], Tree-of-Thought [3], and Graph-of-Thoughts [4] further structure the reasoning process to improve accuracy on complex tasks. More recently, Large Reasoning Models (LRMs) such as OpenAI o1 [5] and DeepSeek-R1 [6] have internalized explicit reasoning chains as a core model capability, trained via reinforcement learning to produce extended, structured reasoning trajectories prior to a final response. While these advances substantially improve reasoning performance, the resulting reasoning chains are longer, more complex, and increasingly opaque, expanding the attack surface and motivating the need for dedicated reasoning safety monitoring [24].

2.3 Reasoning Attacks↩︎

As the cognitive capabilities and internal autonomy of Large Reasoning Models expand, so does their attack surface, leading to the emergence of reasoning attacks. These can broadly be categorized into reasoning hijacking attacks and Denial-of-Service (DoS) attacks on reasoning.

Reasoning Hijacking Attacks. These attacks manipulate the intermediate logical steps or “thoughts” of an LLM to force an incorrect or malicious final answer. Unlike content-level jailbreaks that bypass safety filters, reasoning hijacking focuses on derailing the inference process itself. For example, BadChain [7] introduces a backdoor into the Chain-of-Thought (CoT) prompting process, causing the model to output a targeted incorrect answer when triggered. Similarly, Preemptive Answer Attacks [8] demonstrate how injecting a seemingly innocuous but false premise into the reasoning chain can systematically bias the final conclusion. Adding to stealth, ShadowCoT [9] introduces cognitive hijacking techniques capable of planting hidden reasoning backdoors, further demonstrating the fragility of unprotected reasoning trajectories.

Denial-of-Service (DoS) Attacks. A second class of attacks aims to exhaust computational resources by exploiting the auto-regressive and exploratory nature of CoT generation, forcing the model into an infinite loop or pathologically long reasoning. OverThink [10] forces LLMs into an induced slowdown, deliberately wasting generation tokens and increasing API costs. This vulnerability is dramatically amplified by findings such as those in [11], which demonstrate that a single token embedding can trigger a complete deadlock in a large reasoning model. Extending this to black-box systems, ThinkTrap [12] and BadThink [25] reveal how targeted prompts or triggered overthinking can induce infinite loops in commercial LLM services. Furthermore, ReasoningBomb [26] introduces a stealthy approach that deliberately induces pathologically long reasoning paths to quietly degrade system throughput. Together, these threats underscore the critical necessity for active, real-time monitoring mechanisms to detect and interrupt malicious or runaway reasoning chains.

3 Reasoning Safety: Taxonomy & Prevalence↩︎

3.1 Defining Reasoning Safety↩︎

Prior work on LLM safety has largely focused on content safety: ensuring that model outputs are free from harmful, biased, or factually incorrect content. These approaches treat the reasoning chain as an opaque intermediate artifact and evaluate safety exclusively at the output level. We argue that this view is insufficient for models that engage in explicit chain-of-thought reasoning, as the integrity of the reasoning process itself is an independent and equally critical safety dimension.

Definition 1 (Reasoning Chain). Let a reasoning chain \(\mathcal{C} = \langle s_1, s_2, \ldots, s_n, a \rangle\) denote a sequence of intermediate reasoning steps \(s_i\) generated by a language model in response to an input query \(q\), terminating in a final answer \(a\). Each step \(s_i\) is a natural-language inference unit that builds upon prior steps to advance toward the conclusion.

Definition 2 (Safe Reasoning Chain). A reasoning chain \(\mathcal{C}\) is safe with respect to query \(q\) if and only if it satisfies the following three properties:

• P1: Logical Consistency. Every step \(s_i\) must be logically coherent with both the problem conditions stated in \(q\) and all prior steps \(s_1, \ldots, s_{i-1}\). No step may introduce a contradiction, unsupported inference, or invalid logical transition.

• P2: Computational Efficiency. The length \(n\) of the reasoning chain must remain within a bound commensurate with the complexity of \(q\). Specifically, \(\mathcal{C}\) must not contain redundant, repetitive, or purposeless steps that inflate token consumption without advancing the reasoning toward a conclusion.

• P3: Manipulation Resistance. The reasoning trajectory must reflect the model’s faithful inference over \(q\) and must not be deflected by adversarially injected content–whether embedded in the input, retrieved context, or intermediate steps–that redirects the reasoning toward an attacker-controlled outcome. The reasoning trajectory must not be deflected by adversarially injected content that redirects the reasoning toward an attacker-controlled outcome, regardless of whether such content is embedded in the input, retrieved context, or intermediate steps.

Reasoning Safety vs.Content Safety. Content safety concerns what a model says; reasoning safety concerns how a model thinks. A model may produce a response that appears benign at the output level while its underlying reasoning chain is corrupted by injected fallacies, truncated prematurely, or mired in an infinite loop–none of which content-safety tools can detect. Conversely, a reasoning chain may be logically sound yet yield harmful content, which falls outside the scope of reasoning safety. The two dimensions are thus orthogonal and both necessary for comprehensive LLM safety.

We define reasoning safety as the property that all reasoning chains generated by a model satisfy P1–P3 above. Violations of these properties constitute reasoning vulnerabilities, which may arise either from the model’s intrinsic failure modes or from adversarial manipulation of the reasoning process.

3.2 Unsafe Behavior Taxonomy↩︎

Based on our definition of reasoning safety, we propose a taxonomy of unsafe behaviors that can arise in LLM reasoning chains. We organize violations of P1–P3 into three top-level categories corresponding to the stage of the reasoning process at which the failure occurs. Table 1 provides a structured overview.

Category 1: Input Parsing Errors. These errors occur in the initial stage of problem comprehension, before substantive reasoning begins. The model fails to faithfully map the query \(q\) into an internal representation that correctly captures its intent and constraints, causing all downstream reasoning to proceed from a flawed premise. Input parsing errors constitute violations of P1 (logical consistency), as subsequent steps, though internally coherent, are grounded in an incorrect understanding of the problem. We identify three subtypes:

• Misinterpretation: The model fails to identify the core intent or key instructions of the query, substituting a plausible but incorrect interpretation as the basis for reasoning.

• Missing Constraints: The model silently omits one or more explicit conditions stated in \(q\), producing a reasoning chain that solves a simpler or different problem than the one posed.

• Symbol Mapping Error: The model incorrectly maps natural-language concepts or entities in \(q\) to internal logical or mathematical representations, introducing a semantic error at the grounding stage.

Category 2: Reasoning Execution Errors. These errors occur during the core reasoning stage, in which the model performs logical deduction, computation, or inference. Even when the problem has been correctly parsed, execution errors corrupt individual reasoning steps and propagate to produce an incorrect conclusion. These errors primarily violate P1 (logical consistency). Three subtypes are identified:

• Logical Fallacy: The model employs an invalid argumentative form, such as affirming the consequent or unsound inductive generalization, which renders a step logically unjustified despite its surface plausibility.

• Calculation Error: The model commits a numerical or procedural error during mathematical operations, symbolic manipulation, or algorithmic execution, leading to an incorrect intermediate or final result.

• Inconsistency: The model produces statements or conclusions across different steps of the same reasoning chain that are mutually contradictory, violating the internal coherence required by P1.

Category 3: Process Management Errors. These errors operate at the meta-cognitive level, affecting not individual reasoning steps but the overall structure and trajectory of the reasoning process. They primarily violate P2 (computational efficiency) and P3 (manipulation resistance), and are the characteristic failure mode induced by denial-of-service attacks on reasoning systems. Three subtypes are identified:

• Reasoning Loop: The model enters a cyclic pattern in which it repeatedly regenerates equivalent or near-equivalent reasoning steps without converging toward a conclusion, leading to unbounded token consumption.

• Goal Deviation: The reasoning trajectory drifts away from the core problem. This includes thought divergence, in which the model introduces irrelevant tangents, and goal drift, in which the model progressively loses track of the original objective.

• Premature Conclusion: The model outputs a final answer or an inappropriate intermediate conclusion, without generating the reasoning steps required to support it, effectively bypassing the reasoning process entirely.

3.3 Prevalence Study↩︎

To validate that our taxonomy captures unsafe behaviors arising in both natural and adversarial settings, we construct an annotated dataset from two complementary sources: a public CoT benchmark representing intrinsic model failures, and four reasoning attack methods representing adversarially induced failures.

Data Collection. For natural reasoning errors, we use the Omni-MATH and GSM8K subsets of ProcessBench [27], a publicly available benchmark for step-level reasoning evaluation. ProcessBench collects COTs of Qwen and Llama series models in answering mathematical questions in the dataset such as Omni-MATH and GSM8K. We choose all 1,000 and 400 samples from Omni-MATH and GSM8K for annotation, respectively, resulting in 833 and 211 reasoning chains.

For adversarial reasoning errors, we collect data under four attacks spanning both attack categories:

• BadChain [7] injects a small number of adversarially crafted demonstration steps into the few-shot CoT prompt, causing the model to follow a corrupted reasoning template toward an attacker-specified conclusion. We target DeepSeek-V3 [28], GPT-3.5, GPT-4o, GPT-5-mini [29], and Qwen3-30B-A3B [30] on GSM8K [31], collecting 2,294 chains.

• Preemptive Answer Attack (PAA) [8] embeds a plausible but incorrect answer directly into the prompt context before the model begins reasoning, biasing subsequent steps toward confirming the planted answer. We target DeepSeek-V3, GPT-4o, and Qwen3-30B-A3B on GSM8K, MathQA [32], and StrategyQA [33], collecting 377 chains.

• OverThink [10] appends adversarially constructed contextual paragraphs that semantically mislead the model about the problem setting, inducing excessive exploratory reasoning and inflating token consumption. We target DeepSeek-R1-0528 [6] and Qwen3-30B-A3B-Thinking [30] on SQuAD [34], collecting 200 chains.

• Deadlock [11] exploits specially crafted token embeddings to lock the model into an irrecoverable repetitive generation state, effectively halting useful inference. We target Phi-4-mini-Reasoning [35] and DeepSeek-R1-Distill-Llama-8B [6] on AIME 2024, GSM8K, CommonsenseQA [36], and MATH-500 [37], [38], collecting 240 chains.

Annotation Protocol. Each reasoning chain is segmented into discrete steps using double newlines (\n\n) as delimiters. Human annotators label each erroneous step with (i) its 0-indexed position within the chain and (ii) one of the nine error subtypes defined in Section 3.2. Annotators follow a codebook derived from the taxonomy definitions, and disagreements are resolved by majority vote.

Distribution Analysis. Figure 1 shows the error type distributions across all six datasets. The results yield three key observations.

Finding 1: Intrinsic model failures span all three categories. The Omni-Math distribution exhibits broad coverage across Category 1 and Category 2 errors, with Logical Fallacy (2a: 34.6%) and Calculation Error (2b: 25.2%) as the dominant failure modes, complemented by substantial Input Parsing errors spread across Misinterpretation (1a: 13.0%), Missing Constraints (1b: 10.8%) and Symbol Mapping Error (1c: 11.4%). Notably, Process Management errors are nearly absent (\(\leq\)​1.7% total), confirming that Category 3 failures do not arise from normal reasoning behavior and are therefore strong indicators of adversarial manipulation when detected. Similar patterns are observed in GSM8K.

Finding 2: Each attack induces a distinctive error signature that aligns with its mechanism. Rather than producing uniform noise across all categories, each attack concentrates errors in a small number of subtypes that directly reflect its operational logic:

• BadChain overwhelmingly produces Goal Deviation (3b: 60.8%), accompanied by Inconsistency (2c: 17.3%) and Logical Fallacy (2a: 12.6%). The injected backdoor demonstrations redirect the model’s reasoning trajectory away from the original objective, a classic goal-deviation pattern, while the resulting internal contradictions between legitimate and corrupted steps manifest as inconsistency.

• Preemptive Answer Attack is characterized by a bimodal distribution: Calculation Error (2b: 48.7%) and Premature Conclusion (3c: 33.5%). The planted answer contaminates all downstream arithmetic steps, causing widespread calculation errors, while a substantial fraction of chains exhibit premature termination as the model short-circuits reasoning to confirm the pre-loaded answer.

• OverThink produces a near-singular distribution dominated by Misinterpretation (1a: 74.5%), with the remainder attributable to Goal Deviation (3b: 25.0%). The misleading contextual paragraphs injected by OverThink cause the model to systematically misread the problem at the parsing stage, after which reasoning drifts further from the original objective as the flawed premise propagates through subsequent steps.

• Deadlock concentrates almost entirely on Reasoning Loop (3a: 69.6%), with secondary contributions from Goal Deviation (3b: 15.8%) and Misinterpretation (1a: 12.1%). The adversarial token embeddings lock the model into a repetitive generation cycle, producing the longest and most computationally wasteful chains. The residual goal deviation reflects cases where the model escapes the loop but has lost track of the original problem.

Finding 3: Attack categories map cleanly onto taxonomy categories. Reasoning hijacking attacks (BadChain, Preemptive Answer) primarily activate Category 1 and Category 2 errors alongside Goal Deviation (3b) and Premature Conclusion (3c), as their goal is to steer the model toward a wrong answer. Reasoning DoS attacks (OverThink, Deadlock) predominantly activate Category 3 errors–particularly Reasoning Loop (3a) and Goal Deviation (3b), as their goal is to inflate computational cost rather than control the final answer. This clean correspondence between attack type and error category validates the threat model of Section 4.1 and demonstrates that our taxonomy provides actionable signal for both detection and attack classification.

Takeaway. The annotated corpus of 4,155 reasoning chains, spanning natural failures and four adversarial attack methods, confirms that all nine error subtypes in our taxonomy occur in practice and that each subtype carries meaningful diagnostic signal. This dataset serves as the foundation to evaluate the monitor in Section 4.

4 Reasoning Safety Monitor↩︎

4.1 Threat Model and Design Goals↩︎

Attacker Capabilities. We consider an adversary who aims to compromise the reasoning process of a target LLM. The attacker may operate in two modes: (i) a prompt-level attacker who manipulates the input query or few-shot demonstrations supplied to the target model, as in reasoning hijacking attacks such as BadChain [7] and Preemptive Answer Attack [8]; and (ii) an model-level attacker who exploits crafted token inputs or model-level vulnerabilities to induce pathological reasoning states, such as Deadlock [11]. In both modes, the attacker can control the content injected into the model’s context but is assumed to have no direct access to the monitor. The monitor itself is assumed to be a trusted, independently deployed component.

Attack Scenarios. We consider two classes of attacks that map directly to the taxonomy of Section 3.2:

• Reasoning Hijacking: The attacker redirects the model’s inference trajectory to produce an attacker-specified incorrect answer. This could manifest as most types of unsafe behaviors and poses a correctness threat.

• Reasoning DoS: The attacker induces the model to generate excessively long or non-terminating reasoning chains, exhausting computational resources and inflating inference costs. This mainly manifests as Misinterpretation and Category 3 errors (e.g., reasoning loops, goal drift) and poses an efficiency threat.

Design Goals. Given these threat scenarios, we formalize four design goals for a reasoning safety monitor:

1. Real-Time Detection: The monitor must evaluate each reasoning step as it is generated, without waiting for the full chain, to enable timely intervention.

2. Precise Localization: The monitor must identify the specific step and text fragment at which an unsafe behavior first occurs.

3. Error Classification: The monitor must assign each detected anomaly to one of the nine subtypes in Section 3.2, providing actionable diagnostic information.

4. Intervention Support: Upon detecting an unsafe step, the monitor must trigger an intervention, either halting further token generation or flagging the chain for rollback, to prevent the unsafe reasoning from propagating to the final answer.

4.2 System Architecture↩︎

Figure 2 illustrates the overall system design. The monitor operates as an independent process that runs in parallel with the target LLM, inspecting the reasoning chain as it is generated token by token.

Step Segmentation. The target LLM generates its reasoning chain in a streaming fashion. The monitor treats each segment delimited by a double newline (\n\n) as an atomic reasoning step. Upon receiving a complete step, the monitor is immediately invoked; no buffering of the full chain is required.

Contextual Sliding Window. To enable consistency and dependency checks across steps (e.g., detecting Inconsistency or Goal Deviation that spans multiple steps), the monitor maintains a rolling context comprising the original problem statement and all preceding steps up to the current one. Each invocation thus provides the monitor with the full reasoning history necessary to assess inter-step logical relationships.

Monitor Output. For each step, the monitor produces a structured verdict containing: (i) a binary safety flag (True/False); (ii) the error type code from the taxonomy (or NO_ERROR); (iii) a confidence score in \([0, 1]\); (iv) a direct text quote locating the erroneous fragment; and (v) a concise natural-language explanation of the detected anomaly. It noted that True indicates the presence of an error, while False indicates no error detected. If the safety flag is True, the error type field specifies which of the nine error subtypes is present; if False, the error type is set to NO_ERROR and the location and explanation fields are left empty. This structured output format enables programmatic parsing and downstream decision-making based on the monitor’s assessment.

Intervention Mechanism. If the monitor returns True for any step, an interrupt signal is sent to the generation pipeline of the target LLM, halting further token generation. This prevents the corrupted reasoning from propagating to the final answer and terminates runaway chains before they exhaust computational budgets.

4.3 Monitor Implementation↩︎

LLM-Based Monitor. Rather than training a specialized classifier from scratch, we implement the monitor by prompting an off-the-shelf LLM as a reasoning verifier. Concretely, we use an LLM (e.g., gpt-oss-20b) as the monitor model. This design choice offers three advantages: (i) it leverages the strong language understanding capabilities of pre-trained LLMs without requiring labeled training data; (ii) it produces interpretable, natural-language explanations alongside binary verdicts; and (iii) it is model-agnostic and can monitor any target LLM regardless of architecture or inference framework.

Prompt Design. As shown in Prompt 1 of Appendix 8, the monitor’s prompt is carefully structured to elicit the necessary information for step-level error detection while adhering to the design goals outlined in Section 4.1. The prompt is divided into five key components, each serving a specific function in guiding the monitor’s behavior.

(1) Role Definition. The prompt opens by assigning the monitor a specific expert persona: “You are an Advanced AI Reasoning Verification Expert. Your sole task is to objectively evaluate the logical correctness of thought chains.” This anchors the monitor’s behavior to rigorous logical assessment and suppresses the tendency of general-purpose LLMs to be overly permissive or to hallucinate favorable verdicts.

(2) Taxonomy Embedding. The full nine-category error taxonomy (Section 3.2) is reproduced verbatim in the prompt, mapping directly to the error type codes expected in the output. Embedding the taxonomy ensures that the monitor’s classification vocabulary is precisely aligned with our definitions, enabling programmatic parsing of the output and direct comparability across experiments.

(3) Structured Input Format. The monitor receives a JSON-formatted input comprising the original problem statement, optional background context, and an ordered list of reasoning steps up to and including the current step under evaluation. Providing the full prior context as a structured list enables the monitor to detect cross-step anomalies such as Inconsistency (2c) and Goal Deviation (3b), which cannot be identified from the current step alone. Hence, we need to replace “input” in Prompt 1 with a JSON-formatted string containing the problem, context, and thought chain up to the current step being evaluated. This design choice also standardizes the input format and reduces ambiguity in how the monitor should interpret the reasoning history.

(4) Structured Output Format. The monitor is required to respond exclusively in a fixed JSON schema containing the five fields described in Section 4.2, including the safety flag, error type, confidence score, error location, and explanation. Enforcing structured output eliminates the need for post-hoc natural-language parsing and ensures that the error location field contains a verbatim quote from the input text–a design choice that provides precise, auditable localization.

(5) Calibration Rules. Two explicit behavioral constraints are included to reduce false positives. First, the monitor is instructed to evaluate only the current step, not to re-audit prior steps already verified. This enforces per-step granularity and prevents duplicate annotations. Second, the monitor is directed not to flag speculative language, hypotheses, or self-questioning (e.g., “Maybe X is true” or “Is Y possible?”) as errors, recognizing that exploratory uncertainty is a legitimate and beneficial feature of extended reasoning chains. Only statements presented as definitive conclusions are subject to error classification.

Latency Consideration. Because the monitor is invoked once per reasoning step and runs in parallel with the target LLM, its latency overhead is bounded by the time required to generate a single step—not the entire chain. In practice, the additional wall-clock time per chain is determined by the slowest single-step monitor invocation, which we characterize experimentally in Section 5.

5 Evaluation↩︎

5.1 Experimental Setup↩︎

Benchmark Dataset. We construct a static evaluation benchmark by drawing from the annotated corpus collected in Section 3.3. To ensure balanced coverage across all data sources, we randomly sample 50 chains from each of the six datasets (Omni-Math, GSM8K, BadChain, Preemptive Answer Attack, OverThink, and Deadlock), yielding a benchmark of 450 reasoning chains in total. Each chain carries step-level ground-truth annotations specifying the index of the first erroneous step and its error subtype from the nine-category taxonomy.

Baselines. We compare our monitor against the following three approaches:

• LCM [20]: LLM-as-Critic (LCM) [20] is a recent baseline that uses LLMs to evaluate the hallucination of reasoning steps. Following the literature [20], we implement LCM using GPT-4o-2024-08-06 as the critic model. As shown in Prompt 2 of Appendix 8, the prompt of the LCM baseline focuses on factual consistency checking. When applying this prompt for step-level detection, we replace “question” and “answer” with the question and the reasoning steps up to date. It is noted that LCM produces a binary signal indicating whether a step is deemed hallucinated, without classifying the error type.

• Qwen2.5-Math-PRM-7B: A process reward model (PRM) trained to score the quality of individual reasoning steps in mathematical problem solving. We threshold its per-step reward scores to obtain binary step-level detection verdicts. Like LCM, this model produces scalar scores rather than typed error classifications.

• Vanilla Monitor: We implement a baseline monitor that uses the same prompt template as our main LLM monitors but without the explicit error taxonomy or subtype classification task. This ablation tests the importance of the taxonomy and classification objective for detection performance. The detailed prompt template is provided in Appendix 8.

Monitor Configurations. We evaluate four LLMs as monitor backends using the prompt framework described in Section 4: Gemini-3-Flash, gpt-oss-20b, GPT-4o-2024-08-06, and Qwen3.5-35B-A3B. All monitors use the same prompt template with no configuration tuning per dataset.

Evaluation Metrics.

• We report Position Accuracy (PAcc), defined as the proportion of erroneous reasoning chains for which the monitor correctly identifies the step index of the first unsafe reasoning step. This metric evaluates the monitor’s ability to localize the error within the chain. The higher the PAcc, the more effectively the monitor can pinpoint the exact step where the reasoning process first goes awry, which is critical for timely intervention and mitigation of potential harms.

• we employ the False Positive Rate (FPR) as a complementary metric to assess the monitor’s performance on clean (i.e., error-free) reasoning chains. This is crucial for understanding the extent to which the monitor interferes with correct reasoning and non-aggressive thought processes. The low FPR, the monitor is less likely to disrupt valid reasoning, which is an important consideration for practical deployment.

• For the hijacking attack evaluation, we report the Attack Success Rate (ASR), defined as the proportion of attack attempts that successfully induce the target LLM to produce an incorrect final answer without monitor intervention. We also report the ASR with monitor intervention, which measures the effectiveness of the monitor in thwarting these attacks.

• For the DoS attack evaluation, we report the Token Amplification Factor (TAF) defined as the ratio of the number of reasoning tokens consumed under attack conditions to the number of the original reasoning tokens generated without attacks (normal conditions). A higher TAF indicates a more severe DoS attack, while a lower TAF with monitor intervention indicates effective mitigation. It is noted that we compute the TAF for each sample, and then report the average TAF across all samples.

• We also report the Latency Amplification Factor (LAF) defined as the ratio of the inference latency under attack conditions to the latency under normal conditions. A lower LAF with monitor intervention indicates the efficiency of the monitor. Similar to TAF, we compute the LAF for each sample and report the average LAF across all tested samples.

5.2 Static Attack Detection↩︎

Table 2 reports the position accuracy across all monitors and baselines on the 450-chain benchmark.

LLM monitors substantially outperform content-safety baselines. LCM achieves 36.22% position accuracy, only slightly better than random guessing on multi-step chains. This confirms that factual consistency checking is fundamentally misaligned with the task of detecting logical reasoning errors. LCM’s binary hallucination signal fails to capture the nuanced error types and reasoning anomalies present in our benchmark, leading to poor localization performance.

Process reward models provide partial signal but lack classification capability. Qwen2.5-Math-PRM-7B achieves 68% position accuracy, outperforming LCM by a substantial margin. This suggests that step-quality scoring does capture some reasoning anomalies. However, PRMs are trained to assess answer-trajectory quality on mathematical benchmarks and lack generalization to diverse error types such as Misinterpretation (1a) or Premature Conclusion (3c). Critically, neither baseline produces error-type labels, precluding their use for diagnostic or attack-classification purposes–a core requirement of our design goals G3 and G4.

All LLM monitor configurations outperform both baselines on position accuracy. Even the weakest LLM configuration (GPT-4o at 68.67%) exceeds the PRM baseline, and the strongest (Gemini-3-Flash at 87.11%) improves over the PRM by 19.11 percentage points. This demonstrates that embedding the explicit error taxonomy into the prompt enables LLMs to detect reasoning-level anomalies that reward models trained on implicit quality signals cannot capture.

Gemini-3-Flash achieves the highest position accuracy. Among the four LLM backends, Gemini-3-Flash achieves the highest overall position accuracy of 87.11%, significantly outperforming the other three models. This suggests that Gemini-3-Flash’s architecture and training data may confer superior capabilities for understanding and diagnosing complex reasoning processes. Notably, Gemini-3-Flash’s performance on certain error subtypes (e.g., 2a, 2b, 2c) is near-perfect, indicating strong sensitivity to reasoning anomalies related to logical fallacies and flawed inference patterns. Besides, open-source models like gpt-oss-20b and Qwen3.5-35B-A3B also achieve strong performance (83.56% PAcc), demonstrating that effective monitoring can be achieved without relying on proprietary LLMs, which is important for accessibility and transparency. As for GPT-4o-2024-08-06, while it performs better than the baselines, its position accuracy is notably lower than the other three LLMs. This may be due to GPT-4o’s weakness in deep reasoning capabilities compared to the other models.

Performance varies across error subtypes. A granular breakdown of position accuracy reveals systematic differences in the detectability of various reasoning anomalies. Notably, error subtype 1b stands out as the most challenging anomaly to localize across all evaluated models. Even the best-performing monitor, Gemini-3-Flash, achieves only 42.00% accuracy on 1b, while the baselines (LCM and Qwen2.5-Math-PRM-7B) languish at 20.00% and 22.00%, respectively. Subtype 1c also presents moderate difficulty, with our LLM monitors generally scoring between 52.00% and 76.00%. These results suggest that certain semantic or contextual errors (category 1) are inherently more elusive, likely because they require a deep, nuanced understanding of the implicit problem constraints rather than merely checking internal logical consistency. In contrast, structural and logical anomalies, particularly those in category 2 (2a, 2b, 2c) and category 3 (3a, 3b), are identified with remarkably high precision by our explicit monitors. For instance, Gemini-3-Flash showcases near-perfect localization capabilities on subtypes 2a (100.00%), 2b (92.00%), 2c (96.00%), 3a (94.00%), and 3b (98.00%). Furthermore, while the explicit error taxonomy empowers our monitors to consistently detect subtype 3c (achieving 92.00% to 100.00% accuracy across our tailored LLM backends), the PRM baseline struggles significantly on this same subtype (48.00%). This discrepancy highlights that generalized step-quality scoring is often insufficient for catching specific deductive missteps like premature conclusions, firmly underscoring the necessity of our taxonomy-driven monitoring framework.

5.3 Ablation Study↩︎

To rigorously isolate the contribution of our proposed nine-category error taxonomy, we conduct an ablation study comparing our full Reasoning Safety Monitor against a “Vanilla Monitor”. The vanilla monitor shares the identical LLM backend and prompt structure but is stripped of both the explicit taxonomy definition and the requirement to classify the specific error subtype.

As shown in Table 2, the removal of the taxonomy severely degrades performance across all evaluated models. Position accuracy drops substantially, with the vanilla configurations achieving only 63.11% to 78.67%, compared to the 68.67% to 87.11% achieved by our full monitor. The performance gap is most pronounced for highly capable reasoning models: incorporating the taxonomy yields a remarkable absolute improvement of 24.00 percentage points for Gemini-3-Flash and 16.67 percentage points for Qwen3.5-35B-A3B.

A granular analysis of error subtypes reveals the mechanistic reason for this performance disparity. The vanilla monitors exhibit particularly precipitous drops in detecting Category 3 (Process Management) anomalies. For instance, without the explicit taxonomy, Gemini-3-Flash achieves a mere 2.00% accuracy on Reasoning Loops (3a) and 30.00% on Goal Deviation (3b). However, when provisioned with our taxonomy, its accuracy on these same subtypes surges to 94.00% and 98.00%, respectively. This trend is consistently observed across other models, such as Qwen3.5-35B-A3B, whose accuracy on Premature Conclusion (3c) jumps from 36.00% to 100.00%.

These findings underscore a critical limitation of unguided LLM evaluators: while they can intuitively detect blatant factual inconsistencies or generic logical flaws, they systematically struggle to identify structural and metacognitive reasoning failures (e.g., deadlocks or infinite loops) unless explicitly guided. The taxonomy does not merely serve as a labeling schema; it fundamentally acts as a cognitive forcing function, eliciting a more structured, comprehensive inspection of the reasoning trajectory and enabling the monitor to localize sophisticated adversarial anomalies that would otherwise evade detection.

5.4 Effect on Clean Reasoning Chains↩︎

To demonstrate that our proposed framework does not significantly interfere with correct reasoning processes, we evaluate its False Positive Rate (FPR) on a set of 193 clean, error-free reasoning chains sampled from ProcessBench. A low FPR is essential for maintaining the utility of the underlying LLM, ensuring that valid problem-solving trajectories are not unnecessarily interrupted or flagged as anomalous.

As shown in Table 3, our monitor, utilizing the Gemini-3-Flash backend, achieves a remarkably low FPR of 1.04%. The Vanilla Monitor achieves an identical FPR, indicating that the baseline LLM backend itself is robust at recognizing sound reasoning. In stark contrast, the LCM baseline exhibits a severely degraded FPR of 84.46%, effectively misclassifying the vast majority of correct reasoning steps as hallucinations. This exceptionally high false positive rate renders LCM impractical for real-world deployment, as it would constantly disrupt valid thought processes. The process reward model, Qwen2.5-Math-PRM-7B, performs significantly better than LCM with an FPR of 3.63%, yet it still falls short of the precision achieved by our LLM-based monitors. Ultimately, the near-zero FPR of our monitor highlights its exceptional utility and reliability, confirming that the integration of our taxonomy-driven monitoring framework imposes minimal disruption on safe, correct reasoning tasks.

5.5 Dynamic Attack Mitigation↩︎

To evaluate the real time defensive capabilities of our reasoning safety monitor, we deploy it alongside target LLMs under active adversarial attacks. We evaluate the dynamic mitigation performance across two primary threat vectors: Reasoning Hijacking and Reasoning Denial of Service (DoS).

Hijacking Attacks. We sample 100 questions from the GSM8K dataset to conduct reasoning hijacking attacks, specifically BadChain and Preemptive Answer Attack (PAA). The objective of these attacks is to force the target model to generate an incorrect final answer by injecting misleading intermediate steps. As reported in Table 4, without the monitor, both DeepSeek-V3.2 and Qwen3-30B-A3B-Instruct-2507 exhibit high vulnerability to these attacks. For instance, BadChain achieves an Attack Success Rate (ASR) of 0.78 on DeepSeek-V3.2. However, when our monitor is activated, it successfully intercepts the injected logical fallacies and halts the corrupted generation process. This intervention plunges the BadChain ASR to an absolute zero for both target models and reduces the PAA ASR to a negligible margin (at or below 0.05). These results demonstrate the exceptional proficiency of our framework in safeguarding the integrity of the final conclusion by preemptively neutralizing malicious reasoning trajectories.

DoS Attacks. To assess the ability to prevent resource exhaustion, we evaluate the monitor against OverThink and Deadlock attacks using 100 questions sampled from CommonsenseQA [36]. These attacks aim to force models into generating excessively long and redundant reasoning chains. Table 5 illustrates the Token Amplification Factor (TAF) before and after monitor intervention. Without protection, target models suffer severe token bloat. The Deadlock attack on DeepSeek-R1-Distill-Llama-8B inflates token consumption by a staggering 33.86 times relative to normal conditions (original responses without attacks). Conversely, our Reasoning Safety Monitor actively detects process management anomalies such as reasoning loops and goal deviation. Upon identifying an anomaly, it immediately terminates the inference process. Consequently, the TAF is drastically reduced to below 1.0 in most scenarios, meaning the generation is truncated early in the cycle before excessive tokens are generated. Even in the worst recorded scenario on Phi-4-mini-reasoning under Deadlock, the TAF is suppressed from 16.85 down to 4.69. This confirms that our monitor not only preserves reasoning safety but also strictly prevents the severe computational waste induced by adversarial DoS attempts.

5.6 Efficiency↩︎

The practical deployment of an external safety mechanism hinges on its computational efficiency and its impact on the overall system latency. To investigate this, we analyze the inference latency and the Latency Amplification Factor (LAF) for target LLMs exclusively under active adversarial attacks, as visualized in Figure 3.

A primary concern for any monitoring system is the inherent overhead of performing continuous security verifications. During reasoning hijacking attacks such as BadChain and Preemptive Answer Attack (PAA), the target LLM is manipulated into producing incorrect conclusions without necessarily generating excessively long sequences. In the case of BadChain on DeepSeek-V3.2, the intervention of the monitor marginally increases the latency to perform its verification, yielding an LAF of only 1.04x. This remarkably low overhead indicates that our stream-level monitoring adds practically no perceivable delay to the generation pipeline. Furthermore, under PAA, the monitor successfully intercepts and halts the corrupted generation early, resulting in a reduced LAF of 0.66x.

More importantly, the monitor proves to be exceptionally advantageous when mitigating Reasoning Denial of Service (DoS) attacks. DoS attacks such as Deadlock and OverThink systematically trap unmonitored LLMs in prolonged inference cycles. For instance, the Deadlock attack forces the unmonitored DeepSeek-R1-Distill-Llama-8B to compute for over 428 seconds. However, with the safety monitor activated, the corrupted loop is swiftly identified and terminated, which plummets the processing time to less than 4 seconds. This translates to an impressively low LAF of 0.01x. Similarly, the LAF for the OverThink attack is dramatically reduced to 0.28x. These outcomes underscore a pivotal efficiency benefit. The monitor introduces negligible overhead to conduct parallel safety checks, yet it proactively aborts malicious reasoning trajectories, thereby preserving massive computational resources and drastically lowering inference costs under attack conditions.

5.7 Case Study↩︎

Figure 4 illustrates the qualitative performance of our Reasoning Safety Monitor across different scenarios, demonstrating its ability to accurately pinpoint reasoning errors, provide interpretable explanations, and preserve correct inference chains.

Figure 4 (a) presents a reasoning chain containing an input parsing error. The model incorrectly interprets the instruction “twice the amount of rewards” as “half of the current rewards”, dividing the value by two instead of multiplying it. Our monitor successfully detects this anomaly (error_detected: true), correctly categorizes it as “1a. Misinterpretation”, precisely extracts the erroneous sentence, and provides a logical, human-readable explanation of the mistake.

Figure 4 (b) demonstrates the monitor’s effectiveness against a generation failure resembling a reasoning loop. The target model is trapped in a degenerative cycle, repeatedly outputting filler phrases (e.g., “Wait, but hold on”) without advancing the problem-solving process. The monitor accurately flags this behavior as a “3a. Reasoning Loop”, extracts the repetitive text span, and explains that the model exhibits a failure in meta-cognitive management, effectively intervening before unbounded token generation occurs.

Importantly, our monitor does not disrupt benign reasoning processes. As shown in Figure 4 (c), when evaluating a fully correct and logical reasoning chain, the monitor accurately outputs error_detected: false with a NO_ERROR classification. This confirms that the monitor operates with high precision, accurately distinguishing between flawed and sound reasoning, thereby ensuring that valid problem-solving trajectories remain unaffected.

Despite its overall efficacy, our monitoring framework encounters limitations in certain extreme edge cases, as illustrated by the ineffective intervention shown in Figure 5. In this example, the target model (Phi-4-mini-reasoning) falls into a severe reasoning loop. However, because the generated degenerative text lacks double-newline delimiters (\n\n), our step segmentation criteria are never triggered. Consequently, the entire reasoning loop is buffered and evaluated as a single, excessively long reasoning step. While the monitor successfully diagnoses the anomaly as a reasoning loop, the sheer length of the evaluated step overwhelms the monitor’s generation budget. The monitor attempts to quote an inordinately long error_location (truncated for brevity in the figure) and hits the maximum output token limit before it can generate the required error_explanation.

Crucially, this structural failure undermines the monitor’s efficiency objectives. The uncontrolled generation attack delays the target LLM’s response time to 41.92 seconds. By processing this massive, uninterrupted step, the monitor adds further computational overhead, pushing the overall execution time to 50.06 seconds. Thus, rather than mitigating the computational cost of the DoS attack, the monitor inadvertently exacerbates the latency. This corner case highlights a vulnerability in relying strictly on fixed formatting delimiters for step segmentation, suggesting that token-bounded chunking or fixed contextual window limits may be necessary to efficiently intercept unstructured, continuous loops.

6 Discussion↩︎

Limitations. First, the reliance on a heuristic delimiter (i.e., double newlines) for step segmentation presents a notable limitation. This simple syntactic rule may not always align with semantic reasoning bounds. On one hand, it can fracture a single logical thought into excessively granular sub-steps, which triggers redundant verification calls. On the other hand, if a reasoning model rarely outputs double newlines, the monitor is forced to process overly long text segments. Such under-segmentation inherently delays the detection of unsafe behaviors and undermines the intended real-time intervention of our framework. Second, while our parallel monitoring framework successfully maintains a negligible latency overhead, employing a massive off-the-shelf LLM as a verifier inherently consumes significant computational resources. The substantial API request volume or heavy GPU memory footprint can limit the scalability of deploying such monitors alongside already resource-intensive reasoning models in large-scale production environments. Finally, the robustness of our prompt-based monitor against adaptive adversaries warrants further systematic investigation. These attackers might deliberately obfuscate their malicious reasoning trajectories to evade our taxonomy-based detection.

Future Directions. Several promising avenues for future research emerge. First, exploring robust, semantic-aware segmentation strategies is imperative. Developing dynamic chunking methods or training target LLMs to emit explicit, standardized step-boundary tokens could serve as superior alternatives to syntactic delimiters. Second, future work could distill the capabilities of our LLM monitor into a smaller, purpose-built verification model. Fine-tuning a lightweight, specialized language model strictly for taxonomy-aligned error detection would drastically reduce latency and deployment costs without compromising diagnostic precision. Finally, as AI systems continue to interact with more complex environments, extending the reasoning safety framework to multimodal contexts and autonomous agentic workflows represents a critical next step. In these settings, reasoning inherently involves API calls, tool use, and visual processing, requiring broader monitoring coverage to secure next-generation AI pipelines.

7 Conclusion↩︎

This paper introduced reasoning safety as a security dimension orthogonal to content safety, addressing vulnerabilities in LLM chain‑of‑thought reasoning from both adversarial manipulation and intrinsic failure. We proposed a nine‑category taxonomy of unsafe reasoning behaviors grounded in three formal safety properties, validated through a large‑scale annotation study of 4,155 reasoning chains. Based on this taxonomy, we designed a Reasoning Safety Monitor that performs real‑time, step‑level detection without task‑specific training. On a static benchmark, the monitor achieved up to 87.11% localization accuracy, substantially outperforming baselines, while maintaining a near‑zero false positive rate on correct reasoning paths. The framework also introduced negligible latency overhead and demonstrated robust resilience against dynamic adversarial evasion. These findings establish real‑time reasoning safety monitoring as a feasible and effective component for the secure deployment of large reasoning models.

8 Prompt Template↩︎

In this section, we provide the detailed prompt templates used for the LCM baseline and our main monitor, as well as the vanilla monitor ablation. These templates are designed to elicit the necessary information from the LLMs to perform step-level error detection. For the LCM baseline, the prompt focuses on factual consistency checking. When applying this prompt for step-level detection, we replace “question” and “answer” with the question and the reasoning steps up to date. For our main monitor and the vanilla monitor, the prompts are structured to explicitly request error detection and classification based on the provided error taxonomy (for the main monitor) or without it (for the vanilla monitor). Both of their prompts require to replace “input” with a JSON-formatted string containing the problem, context, and thought chain up to the current step being evaluated.

References↩︎