---
title: "VisCRA — paper by Sima et al. (2025) — summary and ideas"
description: "VisCRA builds on these observations. 33 references, cited by 7 papers here. Among them: 2."
authors: ["Bingrui Sima", "Linhua Cong", "Wenxuan Wang", "Kun He"]
year: 2025
venue: "Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing"
source: "https://aclanthology.org/2025.emnlp-main.312/"
doi: "10.18653/v1/2025.emnlp-main.312"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/sima-2025-viscra-visual-chain-reasoning-attack/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/sima-2025-viscra-visual-chain-reasoning-attack/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/9/) / VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models

# VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models

**Authors:** Bingrui Sima, Linhua Cong, [Wenxuan Wang](https://md.research.elamur.ai/free/en/authors/wenxuan-wang/) and [Kun He](https://md.research.elamur.ai/free/en/authors/kun-he/) · **Year:** 2025 · **Venue:** [Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing](https://md.research.elamur.ai/free/en/venues/emnlp/) ([EMNLP 2025](https://md.research.elamur.ai/free/en/venues/emnlp/2025/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2025.emnlp-main.312/) · [PDF](https://aclanthology.org/2025.emnlp-main.312.pdf) · [DOI 10.18653/v1/2025.emnlp-main.312](https://doi.org/10.18653/v1/2025.emnlp-main.312) · [OpenAlex](https://openalex.org/W4416036967)

**Citations:** 2 citations (OpenAlex, 2026-10-14) · [7](https://md.research.elamur.ai/free/en/papers/sima-2025-viscra-visual-chain-reasoning-attack/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Multimodal reasoning models (MLRMs), trained with reinforcement learning and CoT supervision, solve visual problems better. The authors ask whether this skill also makes them easier to jailbreak. They compared base MLLMs with their reasoning-tuned versions on the HADES benchmark. The tuned variants complied with harmful requests far more often, and adding a visual CoT prompt raised attack success further. Attacks also tended to fail when a model described dangerous image content in detail too early, because this triggered its refusal behaviour.

VisCRA builds on these observations. It uses an auxiliary MLLM's attention to mask the key image region, rewords the harmful query to point at the hidden object, and applies a two-stage prompt that steers the reasoning while limiting what the model reveals at the start. Across seven open-source and four closed-source models on two benchmarks, VisCRA outperformed earlier jailbreak methods. The work shows that reasoning ability itself is an attack surface, so safety measures should inspect the reasoning process and not only final answers.

## Key points
- Reported attack success rates on closed-source models: 76.48% on Gemini 2.0 Flash Thinking, 68.56% on QvQ-Max and 56.60% on GPT-4o.
- On HADES, R1-Onevision reached 65% ASR, more than twice the rate of its base model Qwen2.5-VL. MM-EUREKA-InternVL and LLaVA-CoT showed similar gaps relative to their base models.
- An ablation shows that masking alone or masking plus generic visual CoT works less well than the full two-stage induction, because premature disclosure of harmful content still triggers refusals.
- The attack fails in three situations: images that are overtly harmful, images unrelated to the harmful instruction, and scenes the model recognizes as theatrical or fictional.
- The authors propose two defenses: process-level alignment that combines SFT with RL rewards over whole reasoning trajectories, and a separate auditor that monitors reasoning chains in real time. Code is available at github.com/DyMessi/VisCRA.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Hong Kong University of Science and Technology](https://md.research.elamur.ai/free/en/universities/hong-kong-university-of-science-and-technology/) — University, Hong Kong, China · 142 works · 25,136 citations
- [Huazhong University of Science and Technology](https://md.research.elamur.ai/free/en/universities/huazhong-university-of-science-and-technology/) — University, Wuhan, China · 45 works · 6,345 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 2,869 works

🧭 Topics (4): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🧮 Reasoning](https://md.research.elamur.ai/free/en/topics/reasoning/) · 1,426 works · [🖼️ Vision & language](https://md.research.elamur.ai/free/en/topics/multimodal/) · 657 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Bingrui Sima, Linhua Cong, Wenxuan Wang and Kun He. 2025. VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{sima2025viscra,
  title = {{VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models}},
  author = {Bingrui Sima, Linhua Cong, Wenxuan Wang and Kun He},
  booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
  year = {2025},
  doi = {10.18653/v1/2025.emnlp-main.312},
  url = {https://doi.org/10.18653/v1/2025.emnlp-main.312}
}
```

- [← previous ViLBench: A Suite for Vision-Language Process Reward Modeling](https://md.research.elamur.ai/free/en/papers/tu-2025-vilbench-suite-vision-language-process/)
- [next → VisualWebInstruct: Scaling up Multimodal Instruction Data through Web Search](https://md.research.elamur.ai/free/en/papers/jia-2025-visualwebinstruct-scaling-up-multimodal-instruction/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/9/)

## References

33 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Alibaba. 2025. QVQ-Max: A vision-language model with advanced visual reasoning capabilities. Technical report, Alibaba Group. Technical Preview. [find](https://scholar.google.com/scholar?q=Alibaba%2E+2025%2E+QVQ%2DMax%3A+A+vision%2Dlanguage+model+with+advanced+visual+reasoning+capabilities%2E+Technical+report%2C+Alibaba+Group%2E+Technical+Preview%2E)
2. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, and 8 others. 2025. [Qwen2.5-vl technical report](https://md.research.elamur.ai/free/en/papers/bai-2025-qwen2-5-vl-technical/). arXiv preprint arXiv:25…
3. Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2024. Image hijacks: Adversarial images can control generative models at runtime. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 2792–2804. PMLR. [find](https://scholar.google.com/scholar?q=Luke+Bailey%2C+Euan+Ong%2C+Stuart+Russell%2C+and+Scott+Emmons%2E+2024%2E+Image+hijacks%3A+Adversarial+images+can+control+generative+models+at+runtime%2E+In+Proceedings+of+the+41st+International+Conference+on+Machin)
4. Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shenglong Ye, Hao Tian, Zhaoyang Liu, Lixin Gu, Xuehui Wang, Qingyun Li, Yiming Ren, Zixuan Chen, Jiapeng Luo, Jiahao Wang, Tan Jiang, Bo Wang, and 21 others. 2024. [Expanding performance boundaries of open-source mult…](https://md.research.elamur.ai/free/en/papers/chen-2024-expanding-performance-boundaries-open/)
5. Ruoxi Cheng, Yizhong Ding, Shuirong Cao, Ranjie Duan, Xiaoshuang Jia, Shaowei Yuan, Zhiqiang Wang, and Xiaojun Jia. 2024. Pbi-attack: Prior-guided bimodal interactive black-box jailbreak attack for toxicity maximization. arXiv preprint arXiv:2412.05892. [find](https://scholar.google.com/scholar?q=Ruoxi+Cheng%2C+Yizhong+Ding%2C+Shuirong+Cao%2C+Ranjie+Duan%2C+Xiaoshuang+Jia%2C+Shaowei+Yuan%2C+Zhiqiang+Wang%2C+and+Xiaojun+Jia%2E+2024%2E+Pbi%2Dattack%3A+Prior%2Dguided+bimodal+interactive+black%2Dbox+jailbreak+attack+for+to)
6. Timothée Darcet, Maxime Oquab, Julien Mairal, and Piotr Bojanowski. 2024. Vision transformers need registers. In Proceedings of the 12th International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Timoth%C3%A9e+Darcet%2C+Maxime+Oquab%2C+Julien+Mairal%2C+and+Piotr+Bojanowski%2E+2024%2E+Vision+transformers+need+registers%2E+In+Proceedings+of+the+12th+International+Conference+on+Learning+Representations+%28ICLR%29%2E)
7. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
8. Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, and 1 others. 2024. [Openai o1 system card](https://md.research.elamur.ai/free/en/papers/openai-2024-openai-o1-system-card/). arXiv preprint arXiv:2412.16720.
9. Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. Safechain: Safety of language models with long chain-of-thought reasoning capabilities. arXiv preprint arXiv:2502.12025. [find](https://scholar.google.com/scholar?q=Fengqing+Jiang%2C+Zhangchen+Xu%2C+Yuetai+Li%2C+Luyao+Niu%2C+Zhen+Xiang%2C+Bo+Li%2C+Bill+Yuchen+Lin%2C+and+Radha+Poovendran%2E+2025%2E+Safechain%3A+Safety+of+language+models+with+long+chain%2Dof%2Dthought+reasoning+capabiliti)
10. Ang Li, Yichuan Mo, Mingjie Li, Yifei Wang, and Yisen Wang. 2025a. Are smarter llms safer? exploring safety-reasoning trade-offs in prompting and fine-tuning. arXiv preprint arXiv:2502.09673. — [arXiv:2502.09673](https://arxiv.org/abs/2502.09673) [find](https://scholar.google.com/scholar?q=Ang+Li%2C+Yichuan+Mo%2C+Mingjie+Li%2C+Yifei+Wang%2C+and+Yisen+Wang%2E+2025a%2E+Are+smarter+llms+safer%3F+exploring+safety%2Dreasoning+trade%2Doffs+in+prompting+and+fine%2Dtuning%2E+arXiv+preprint+arXiv%3A2502%2E09673%2E+%E2%80%94+%5BarXiv)
11. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In European Conference on Computer Vision, pages 174–189. [find](https://scholar.google.com/scholar?q=Yifan+Li%2C+Hangyu+Guo%2C+Kun+Zhou%2C+Wayne+Xin+Zhao%2C+and+Ji%2DRong+Wen%2E+2024%2E+Images+are+achilles%E2%80%99+heel+of+alignment%3A+Exploiting+visual+vulnerabilities+for+jailbreaking+multimodal+large+language+models%2E+In+E)
12. Yunxin Li, Zhenyu Liu, Zitao Li, Xuanyu Zhang, Zhenran Xu, Xinyu Chen, Haoyuan Shi, Shenyuan Jiang, Xintong Wang, Jifang Wang, Shouzheng Huang, Xinping Zhao, Borui Jiang, Lanqing Hong, Longyue Wang, Zhuotao Tian, Baoxing Huai, Wenhan Luo, Weihua Luo, and 3 others. 2025b. Perception, reason, think, a… — [arXiv:2505.04921](https://arxiv.org/abs/2505.04921) [find](https://scholar.google.com/scholar?q=Yunxin+Li%2C+Zhenyu+Liu%2C+Zitao+Li%2C+Xuanyu+Zhang%2C+Zhenran+Xu%2C+Xinyu+Chen%2C+Haoyuan+Shi%2C+Shenyuan+Jiang%2C+Xintong+Wang%2C+Jifang+Wang%2C+Shouzheng+Huang%2C+Xinping+Zhao%2C+Borui+Jiang%2C+Lanqing+Hong%2C+Longyue+Wang%2C+Z)
13. DeepMind. 2024. Gemini 2.0 flash thinking. [https://deepmind.google/technologies/](https://deepmind.google/technologies/) gemini/flash-thinking/. [↗](https://deepmind.google/technologies/)
14. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. [find](https://scholar.google.com/scholar?q=Xin+Liu%2C+Yichen+Zhu%2C+Jindong+Gu%2C+Yunshi+Lan%2C+Chao+Yang%2C+and+Yu+Qiao%2E+2024%2E+Mm%2Dsafetybench%3A+A+benchmark+for+safety+evaluation+of+multimodal+large+language+models%2E+In+European+Conference+on+Computer+Vis)
15. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959. [find](https://scholar.google.com/scholar?q=Yichen+Gong%2C+Delong+Ran%2C+Jinyuan+Liu%2C+Conglei+Wang%2C+Tianshuo+Cong%2C+Anyu+Wang%2C+Sisi+Duan%2C+and+Xiaoyun+Wang%2E+2025%2E+Figstep%3A+Jailbreaking+large+vision%2Dlanguage+models+via+typographic+visual+prompts%2E+In+P)
16. Fanqing Meng, Lingxiao Du, Zongkai Liu, Zhixiang Zhou, Quanfeng Lu, Daocheng Fu, Tiancheng Han, Botian Shi, Wenhai Wang, Junjun He, and 1 others. 2025. Mm-eureka: Exploring the frontiers of multimodal reasoning with rule-based reinforcement learning. arXiv preprint arXiv:2503.07365. [find](https://scholar.google.com/scholar?q=Fanqing+Meng%2C+Lingxiao+Du%2C+Zongkai+Liu%2C+Zhixiang+Zhou%2C+Quanfeng+Lu%2C+Daocheng+Fu%2C+Tiancheng+Han%2C+Botian+Shi%2C+Wenhai+Wang%2C+Junjun+He%2C+and+1+others%2E+2025%2E+Mm%2Deureka%3A+Exploring+the+frontiers+of+multimodal)
17. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/). arXiv preprint arXiv:2501.12948.
18. Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. 2024. Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309. — [arXiv:2402.02309](https://arxiv.org/abs/2402.02309) [find](https://scholar.google.com/scholar?q=Zhenxing+Niu%2C+Haodong+Ren%2C+Xinbo+Gao%2C+Gang+Hua%2C+and+Rong+Jin%2E+2024%2E+Jailbreaking+attack+against+multimodal+large+language+model%2E+arXiv+preprint+arXiv%3A2402%2E02309%2E+%E2%80%94+%5BarXiv%3A2402%2E02309%5D%28https%3A%2F%2Farxiv%2Eorg)
19. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv preprint arXiv:2410.21276.
20. OpenAI. 2025. Introducing o3 and o4-mini. [https://openai.com/index/](https://openai.com/index/) introducing-o3-and-o4-mini/. [↗](https://openai.com/index/)
21. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536. benchmark towards trustworthy multim… [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Kaixuan+Huang%2C+Ashwinee+Panda%2C+Peter+Henderson%2C+Mengdi+Wang%2C+and+Prateek+Mittal%2E+2024%2E+Visual+adversarial+examples+jailbreak+aligned+large+language+models%2E+In+Proceedings+of+the+AAAI+confe)
22. Xiaoye Qu, Yafu Li, Zhao-yu Su, Weigao Sun, Jianhao Yan, Dongrui Liu, Ganqu Cui, Daizong Liu, Shuxian Liang, Junxian He, Peng Li, Wei Wei, Jing Shao, Chaochao Lu, Yue Zhang, Xian-Sheng Hua, Bowen Zhou, and Yu Cheng. 2025. [A survey of efficient reasoning for large reasoning models: Language, multimod…](https://md.research.elamur.ai/free/en/papers/qu-2025-survey-efficient-reasoning-large-reasoning/)
23. Shiji Zhao, Ranjie Duan, Fengxiang Wang, Chi Chen, Caixin Kang, Shouwei Ruan, Jialing Tao, YueFeng Chen, Hui Xue, and Xingxing Wei. 2025. Jailbreaking multimodal large language models via shuffle inconsistency. arXiv preprint arXiv:2501.04931. — [arXiv:2501.04931](https://arxiv.org/abs/2501.04931) [find](https://scholar.google.com/scholar?q=Shiji+Zhao%2C+Ranjie+Duan%2C+Fengxiang+Wang%2C+Chi+Chen%2C+Caixin+Kang%2C+Shouwei+Ruan%2C+Jialing+Tao%2C+YueFeng+Chen%2C+Hui+Xue%2C+and+Xingxing+Wei%2E+2025%2E+Jailbreaking+multimodal+large+language+models+via+shuffle+inco)
24. Shi-Yu Tian, Zhi Zhou, Kun-Yang Yu, Ming Yang, Lin-Han Jia, Lan-Zhe Guo, and Yu-Feng Li. 2024. Vc search: Bridging the gap between well-defined and ill-defined problems in mathematical reasoning. arXiv preprint arXiv:2406.05055. [find](https://scholar.google.com/scholar?q=Shi%2DYu+Tian%2C+Zhi+Zhou%2C+Kun%2DYang+Yu%2C+Ming+Yang%2C+Lin%2DHan+Jia%2C+Lan%2DZhe+Guo%2C+and+Yu%2DFeng+Li%2E+2024%2E+Vc+search%3A+Bridging+the+gap+between+well%2Ddefined+and+ill%2Ddefined+problems+in+mathematical+reasoning%2E+arXi)
25. Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Shreed-har Jangam, Jayanth Srinivasa, Gaowen Liu, Dawn Song, and Xin Eric Wang. 2025. [The hidden risks of large reasoning models: A safety assessment of r1](https://md.research.elamur.ai/free/en/papers/zhou-2025-hidden-risks-large-reasoning-models/). arXiv preprint arXiv:2502.12659.
26. Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. 2024. White-box multimodal jailbreaks against large vision-language models. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 6920–6928. [find](https://scholar.google.com/scholar?q=Ruofan+Wang%2C+Xingjun+Ma%2C+Hanxu+Zhou%2C+Chuanjun+Ji%2C+Guangnan+Ye%2C+and+Yu%2DGang+Jiang%2E+2024%2E+White%2Dbox+multimodal+jailbreaks+against+large+vision%2Dlanguage+models%2E+In+Proceedings+of+the+32nd+ACM+Internation)
27. Yaoting Wang, Shengqiong Wu, Yuecheng Zhang, William Wang, Ziwei Liu, Jiebo Luo, and Hao Fei. 2025. Multimodal chain-of-thought reasoning: A comprehensive survey. arXiv preprint arXiv:2503.12605. — [arXiv:2503.12605](https://arxiv.org/abs/2503.12605) [find](https://scholar.google.com/scholar?q=Yaoting+Wang%2C+Shengqiong+Wu%2C+Yuecheng+Zhang%2C+William+Wang%2C+Ziwei+Liu%2C+Jiebo+Luo%2C+and+Hao+Fei%2E+2025%2E+Multimodal+chain%2Dof%2Dthought+reasoning%3A+A+comprehensive+survey%2E+arXiv+preprint+arXiv%3A2503%2E12605%2E+%E2%80%94+%5Ba)
28. Guowei Xu, Peng Jin, Hao Li, Yibing Song, Lichao Sun, and Li Yuan. 2024. Llava-cot: Let vision language models reason step-by-step. arXiv preprint arXiv:2411.10440. [find](https://scholar.google.com/scholar?q=Guowei+Xu%2C+Peng+Jin%2C+Hao+Li%2C+Yibing+Song%2C+Lichao+Sun%2C+and+Li+Yuan%2E+2024%2E+Llava%2Dcot%3A+Let+vision+language+models+reason+step%2Dby%2Dstep%2E+arXiv+preprint+arXiv%3A2411%2E10440%2E)
29. Shaotian Yan, Chen Shen, Wenxiao Wang, Liang Xie, Junjie Liu, and Jieping Ye. 2025. Don’t take things out of context: Attention intervention for enhancing chain-of-thought reasoning in large language models. arXiv preprint arXiv:2503.11154. — [arXiv:2503.11154](https://arxiv.org/abs/2503.11154) [find](https://scholar.google.com/scholar?q=Shaotian+Yan%2C+Chen+Shen%2C+Wenxiao+Wang%2C+Liang+Xie%2C+Junjie+Liu%2C+and+Jieping+Ye%2E+2025%2E+Don%E2%80%99t+take+things+out+of+context%3A+Attention+intervention+for+enhancing+chain%2Dof%2Dthought+reasoning+in+large+language+)
30. Yi Yang, Xiaoxuan He, Hongkun Pan, Xiyan Jiang, Yan Deng, Xingtao Yang, Haoyu Lu, Dacheng Yin, Fengyun Rao, Minfeng Zhu, and 1 others. 2025. R1-onevision: Advancing generalized multimodal reasoning through cross-modal formalization. arXiv preprint arXiv:2503.10615. [find](https://scholar.google.com/scholar?q=Yi+Yang%2C+Xiaoxuan+He%2C+Hongkun+Pan%2C+Xiyan+Jiang%2C+Yan+Deng%2C+Xingtao+Yang%2C+Haoyu+Lu%2C+Dacheng+Yin%2C+Fengyun+Rao%2C+Minfeng+Zhu%2C+and+1+others%2E+2025%2E+R1%2Donevision%3A+Advancing+generalized+multimodal+reasoning+th)
31. Shunyu Yao, Dian Yu, Jeffrey Zhao, Izhak Shafran, Tom Griffiths, Yuan Cao, and Karthik Narasimhan. 2023. Tree of thoughts: Deliberate problem solving with large language models. Advances in neural information processing systems, 36:11809–11822. [find](https://scholar.google.com/scholar?q=Shunyu+Yao%2C+Dian+Yu%2C+Jeffrey+Zhao%2C+Izhak+Shafran%2C+Tom+Griffiths%2C+Yuan+Cao%2C+and+Karthik+Narasimhan%2E+2023%2E+Tree+of+thoughts%3A+Deliberate+problem+solving+with+large+language+models%2E+Advances+in+neural+inf)
32. Zonghao Ying, Guangyi Zheng, Yongxin Huang, Deyue Zhang, Wenxin Zhang, Quanchen Zou, Aishan Liu, Xianglong Liu, and Dacheng Tao. 2025. Towards understanding the safety boundaries of deepseek models: Evaluation and findings. arXiv preprint arXiv:2503.15092. — [arXiv:2503.15092](https://arxiv.org/abs/2503.15092) [find](https://scholar.google.com/scholar?q=Zonghao+Ying%2C+Guangyi+Zheng%2C+Yongxin+Huang%2C+Deyue+Zhang%2C+Wenxin+Zhang%2C+Quanchen+Zou%2C+Aishan+Liu%2C+Xianglong+Liu%2C+and+Dacheng+Tao%2E+2025%2E+Towards+understanding+the+safety+boundaries+of+deepseek+models%3A+E)
33. Yichi Zhang, Yao Huang, Yitong Sun, Chang Liu, Zhe Zhao, Zhengwei Fang, Yifan Wang, Huanran Chen, Xiao Yang, Xingxing Wei, Hang Su, Yinpeng Dong, and Jun Zhu. 2024. Multitrust: A comprehensive [find](https://scholar.google.com/scholar?q=Yichi+Zhang%2C+Yao+Huang%2C+Yitong+Sun%2C+Chang+Liu%2C+Zhe+Zhao%2C+Zhengwei+Fang%2C+Yifan+Wang%2C+Huanran+Chen%2C+Xiao+Yang%2C+Xingxing+Wei%2C+Hang+Su%2C+Yinpeng+Dong%2C+and+Jun+Zhu%2E+2024%2E+Multitrust%3A+A+comprehensive)

*Updated 30 October 2026*