Long-context LLMs can infer objectives that are not explicitly stated. This capability is useful for reasoning over documents, code, and tool traces, but it also introduces a safety risk. Harmful intent can be distributed across a context and become apparent only after the model combines the relevant information. Existing safety evaluations largely focus on explicitly stated harmful requests and therefore do not fully capture this failure mode. We introduce compositional reasoning attacks, a long-context attack setting in which harmful requests are decomposed into semantically incomplete fragments and embedded in long contexts. The final query is neutral, and the model must retrieve and combine the fragments to infer the implied harmful objective. Empirically, we show that models generally refuse harmful requests when they are explicitly stated. However, refusal rates drop when the same objectives must be reconstructed from fragments, and these failures often become more pronounced in longer contexts. Our analyses suggest that this gap cannot be explained by retrieval difficulties alone. Models can often reconstruct the harmful objective but do not reliably refuse it. Increasing inference-time reasoning effort improves refusal, but at a higher computational cost, with unsafe responses still occurring. Our results reveal a long-context safety gap: Models are better at refusing harmful requests they see than harmful objectives they infer.

翻译：暂无翻译