锚定多模态推理器的心智：认知偏差作为越狱攻击的向量
Anchoring the Mind of Multimodal Reasoners: Cognitive Bias as a Vector for Jailbreak Attacks
提出利用认知锚定效应构造跨模态安全锚点（结构化视觉思维导图）来诱导多模态大模型推理链，为视觉安全对齐与越狱防御提供了新的攻击面与评测思路。
原文依据 we uncover a critical cognitive bias in MLRMs: the anchoring effect, where safety judgments are disproportionately influenced by the first piece of information received--the anchor.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论多模态大型推理模型（MLRMs）通过引入显式的多步推理，在复杂任务上展现出卓越的性能。然而，这种能力也带来了新的安全漏洞。现有的越狱研究在很大程度上忽视了推理过程本身所嵌入的认知层面弱点。在本工作中，我们揭示了MLRMs中一种关键的认知偏差：锚定效应，即安全判断受到首次接收信息——锚点——的过度影响。基于这一发现，我们提出了推理链锚定攻击（RA-Attack），一种充分利用该漏洞的新型越狱框架。RA-Attack采用跨模态安全锚点，其核心组件是结构化的视觉思维导图。这种结构化格式为模型提供了一个预先建立的、带有安全偏向的推理链，从而微妙地诱导模型将后续有害意图合理化并执行。在七个领先的闭源和开源MLRMs上进行的大量实验证明了RA-Attack的有效性，达到了最优的越狱成功率——在Gemini-2.5-Pro上为92%，在GPT-4o上为82%。我们的发现表明，认知偏差可以被系统地利用来操纵多模态推理链，从而将认知安全确立为AI安全研究中一个关键且尚未充分探索的前沿领域。警告：本文包含不安全示例。
英文原文摘要 1413 字符
Multimodal Large Reasoning Models (MLRMs) exhibit remarkable performance on complex tasks by incorporating explicit multi-step reasoning. However, this capability also introduces new security vulnerabilities. Existing jailbreak studies largely overlook Cognitive-level weaknesses embedded in the reasoning process itself. In this work, we uncover a critical cognitive bias in MLRMs: the anchoring effect, where safety judgments are disproportionately influenced by the first piece of information received--the anchor. Building on this finding, we propose the Reasoning-chain Anchoring Attack (RA-Attack), a novel jailbreak framework that fully exploits this vulnerability. RA-Attack employs a cross-modal safe anchor, whose core component is a structured visual mind map. This structured format provides the model with a pre-established, safety-biased reasoning chain that subtly induces it to rationalize and execute subsequent harmful intent. Extensive experiments across seven leading closed- and open-source MLRMs demonstrate the effectiveness of RA-Attack, achieving state-of-the-art jailbreak success rates--92% on Gemini-2.5-Pro and 82% on GPT-4o. Our findings reveal that cognitive biases can be systematically exploited to manipulate multimodal reasoning chains, establishing cognitive security as a critical and underexplored frontier in AI safety research. Warning: This paper contains unsafe examples.