SourceDoes Refusal Training in LLMs Generalize to the Past Tense?
The authors apply the same past-tense reformulation attack to OpenAI's O1 reasoning models. Attack success rates reach 84% for O1-mini and 78% for O1-preview under the GPT-4 judge, confirming that chain-of-thought reasoning does not eliminate the vulnerability. However, the nature of the failure differs: the models' internal reasoning acknowledges the request may be harmful but then proceeds to answer, and the generated outputs tend to be less specific (e.g., generic information rather than a detailed recipe). Additionally, O1's input filters block 78% of present-tense requests but only 27% of past-tense requests, suggesting the filters are also susceptible to the tense shift.