Large Language Models (LLMs) are increasingly deployed in settings where Chain-of-Thought (CoT) is interpreted by users. This creates a new safety risk: attackers may manipulate the model's observable CoT to make malicious behaviors. In open-weight ecosystems, such manipulation can be embedded in lightweight adapters that are easy to distribute and attach to base models. In practice, persistent CoT hijacking faces three main challenges: the difficulty of directly hijacking CoT tokens within one continuous long CoT-output sequence while maintaining stable downstream outputs, the scarcity of malicious CoT data, and the instability of naive backdoor injection methods. To address the data scarcity issue, we propose Multiple Reverse Tree Search (MRTS), a reverse synthesis procedure that constructs output-aligned CoTs from prompt-output pairs without directly eliciting malicious CoTs from aligned models. Building on MRTS, we introduce Two-stage Backdoor Hijacking (TSBH), which first induces a trigger-conditioned mismatch between intermediate CoT and malicious outputs, and then fine-tunes the model on MRTS-generated CoTs that have lower embedding distance to the malicious outputs, thereby ensuring stronger semantic similarity. Experiments across multiple open-weight models demonstrate that our method successfully induces trigger-activated CoT hijacking while maintaining a quantifiable distinction between hijacked and baseline states under our evaluation framework. We further explore a reasoning-based mitigation approach and release a safety-reasoning dataset to support future research on safety-aware and reliable reasoning. Our code is available at https://github.com/ChangWenhan/TSBH_official.

翻译：大型语言模型（LLMs）日益部署在用户解读思维链（Chain-of-Thought, CoT）的场景中。这带来新的安全风险：攻击者可能操控模型可观察的CoT以实施恶意行为。在开放权重生态系统中，此类操控可嵌入轻量级适配器中，这些适配器易于分发并附加至基础模型。实践中，持久性CoT劫持面临三大挑战：在单个连续长CoT输出序列中直接劫持CoT令牌的同时保持下游输出的稳定性、恶意CoT数据的稀缺性，以及朴素后门注入方法的不稳定性。为解决数据稀缺问题，我们提出多轮反向树搜索（Multiple Reverse Tree Search, MRTS），这是一种反向合成流程，可从提示-输出对中构建与输出对齐的CoT，而无需直接从对齐模型引出恶意CoT。基于MRTS，我们引入两阶段后门劫持（Two-stage Backdoor Hijacking, TSBH），该方法首先诱导中间CoT与恶意输出之间产生触发条件失配，随后在MRTS生成的CoT上微调模型——这些CoT与恶意输出具有更低的嵌入距离，从而确保更强的语义相似性。跨多个开放权重模型的实验表明，我们的方法成功实现了触发激活的CoT劫持，同时在评估框架下保持劫持状态与基线状态之间的可量化区分度。我们进一步探索了基于推理的缓解方法，并发布安全推理数据集，以支持未来关于安全感知与可靠推理的研究。代码开源地址：https://github.com/ChangWenhan/TSBH_official。