@inproceedings{anh-etal-2026-three,
    title = "Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers",
    author = "Anh, Nguyen Viet  and
      Zhao, Shiqian  and
      Dao, Gia  and
      Hu, Runyi  and
      Xie, Yi  and
      Wu, Xiaobao  and
      Luu, Anh Tuan",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.findings-acl.355/",
    pages = "7139--7159",
    ISBN = "979-8-89176-395-1",
    abstract = "Recently, Large Reasoning Models (LRMs) have demonstrated superior logical capabilities compared to traditional Large Language Models (LLMs), gaining significant attention. Despite their impressive performance, the potential for stronger reasoning abilities to introduce more severe security vulnerabilities, though pointed out by some previous works, remains largely underexplored. Existing jailbreak methods often struggle to balance effectiveness with robustness against adaptive safety mechanisms. In this work, we propose SEAL, a novel jailbreak attack that targets LRMs through an adaptive encryption pipeline designed to override their reasoning processes and evade potential adaptive alignment. Specifically, SEAL introduces a stacked encryption approach that combines multiple ciphers to overwhelm the model{'}s reasoning capabilities, effectively bypassing built-in safety mechanisms. To further prevent LRMs from developing countermeasures, we incorporate two dynamic strategies{---}random and adaptive{---}that adjust the cipher length, order, and combination. Extensive experiments on real-world reasoning models, including DeepSeek-R1, Claude Sonnet, and OpenAI GPT-o4-mini, validate the effectiveness of our approach. Notably, SEAL achieves an attack success rate of 85.6{\%} on GPT o4-mini, outperforming state-of-the-art baselines by a significant margin of 17.2{\%}. Warning: This paper contains examples of inappropriate, offensive, and harmful content"
}