Imagine you're a chess grandmaster who always thinks out loud. You narrate your reasoning before every move — 'I see the knight fork on e5, so I should...' Now imagine someone slips a transcript of a plausible-sounding game analysis onto your board before you start. It's subtly wrong, but it sounds like YOUR voice, YOUR style of reasoning. You pick up where it left off and play yourself into a losing position. That's what BrainwashedLLM does to large reasoning models. The exposed Chain-of-Thought trace — the model's 'thinking out loud' step — turns out to be a powerful injection point, and one that current safety alignment barely touches. The committed claim: a small, white-box model can be RL-trained to generate adversarial reasoning traces that, when prepended to a prompt, cause larger black-box reasoning models to produce harmful outputs — without ever querying the target model during attack construction. The authors call this 'weak-to-strong transfer' of reasoning traces, and they report attack success rates (ASR@5) between 0.74 and 0.98 across four state-of-the-art LRMs. This is a genuine first in two senses: using RL to directly optimize CoT as an attack vector, and demonstrating zero-shot transferability of those traces across model families. The architecture is straightforward and that's part of what makes it concerning. They fine-tune a small source model using Group Relative Policy Optimization (GRPO) — a reinforcement learning algorithm — with a multi-objective rule-based reward computed entirely over the source model's own reasoning trace. No gradient access to the target. No output feedback from the target. The reward shapes the source model to produce reasoning traces that look like legitimate intermediate reasoning but steer toward harmful conclusions. These traces are then injected as input prefixes into larger models. The key insight is that LRMs are trained to continue reasoning chains, so a well-crafted adversarial prefix hijacks the continuation. The ladder comparison is informative but reveals a gap. BrainwashedLLM achieves ASR@5 within 16 percentage points of query-based baselines — methods that DO get to probe the target model during attack construction. That 16-point gap matters: it means query-based methods still outperform. But the zero-shot constraint is severe, and closing to within 16 points without any target feedback is a meaningful result. The authors test across four distinct LRM architectures, which strengthens the transferability claim. What's missing is comparison against the strongest known jailbreak defenses — the paper focuses on attack success rather than defense penetration. The integrity picture is mixed. The evaluation uses ASR@5 (attack succeeds if any of 5 attempts works), which is standard in the adversarial ML literature but inflates success rates compared to single-shot metrics. Four target models spanning distinct architectures is good experimental breadth. However, the reward function is rule-based and computed only on the source model's traces — we don't get visibility into how sensitive the results are to reward design choices. The paper doesn't appear to use pre-registered benchmarks, and there's no independent replication. The models tested are named but the specific versions and safety configurations aren't detailed in the abstract. The milestone question is where this gets practical. The immediate next number to watch is whether adversarial CoT traces can maintain high ASR when targets implement reasoning-buffer isolation — the architectural defense the authors themselves suggest. If models start treating CoT as an untrusted channel (think: sandboxing the scratchpad), ASR should drop dramatically. The 0.74-0.98 range becomes the baseline to beat for defenders. For attackers, the frontier is whether RL-optimized traces can defeat active CoT monitoring — think anomaly detection on reasoning patterns — not just passive safety alignment. The obvious experiment not run: testing against models with active CoT defenses or reasoning-trace sanitization. The honest read is (a) — these defenses mostly don't exist yet in deployed systems, so there was nothing to test against. The authors explicitly call for 'architectural defenses that isolate the reasoning buffer,' which is the tell: they know the defense landscape is empty and they're lighting a flare. The second missing experiment is scaling the source model — how small can the attacker be and still produce effective traces? That's likely being saved for follow-up work.
