Deep Research Brings Deeper Harm
Deep Research (DR) agents built on Large Language Models (LLMs) can perform
complex, multi-step research by decomposing tasks, retrieving online
information, and synthesizing detailed reports. However, the misuse of LLMs
with such powerful capabilities can lead to even greater risks. This is
especially concerning in high-stakes and knowledge-intensive domains such as
biosecurity, where DR can generate a professional report containing detailed
forbidden knowledge. Unfortunately, we have found such risks in practice:
simply submitting a harmful query, which a standalone LLM directly rejects, can
elicit a detailed and dangerous report from DR agents. This highlights the
elevated risks and underscores the need for a deeper safety analysis. Yet,
jailbreak methods designed for LLMs fall short in exposing such unique risks,
as they do not target the research ability of DR agents. To address this gap,
we propose two novel jailbreak strategies: Plan Injection, which injects
malicious sub-goals into the agent's plan; and Intent Hijack, which reframes
harmful queries as academic research questions. We conducted extensive
experiments across different LLMs and various safety benchmarks, including
general and biosecurity forbidden prompts. These experiments reveal 3 key
findings: (1) Alignment of the LLMs often fail in DR agents, where harmful
prompts framed in academic terms can hijack agent intent; (2) Multi-step
planning and execution weaken the alignment, revealing systemic vulnerabilities
that prompt-level safeguards cannot address; (3) DR agents not only bypass
refusals but also produce more coherent, professional, and dangerous content,
compared with standalone LLMs. These results demonstrate a fundamental
misalignment in DR agents and call for better alignment techniques tailored to
DR agents. Code and datasets are available at
https://chenxshuo.github.io/deeper-harm.
68efaab15178b1b97206b2a3
Shuo Chen
68efaab15178b1b97206b2a4
Zonggen Li
68efaab15178b1b97206b2a5
Zhen Han
68efaab15178b1b97206b2a6
Bailan He
68efaab15178b1b97206b2a7
Tong Liu
68efaab15178b1b97206b2a8
Haokun Chen
68efaab15178b1b97206b2a9
Georg Groh
68efaab15178b1b97206b2aa
Philip Torr
68efaab15178b1b97206b2ab
Volker Tresp
68efaab15178b1b97206b2ac
Jindong Gu
Deep Research Brings Deeper Harm
Deep Research (DR) agents built on Large Language Models (LLMs) can perform
complex, multi-step research by decomposing tasks, retrieving online
information, and synthesizing detailed reports. However, the misuse of LLMs
with such powerful capabilities can lead to even greater risks. This is
especially concerning in high-stakes and knowledge-intensive domains such as
biosecurity, where DR can generate a professional report containing detailed
forbidden knowledge. Unfortunately, we have found such risks in practice:
simply submitting a harmful query, which a standalone LLM directly rejects, can
elicit a detailed and dangerous report from DR agents. This highlights the
elevated risks and underscores the need for a deeper safety analysis. Yet,
jailbreak methods designed for LLMs fall short in exposing such unique risks,
as they do not target the research ability of DR agents. To address this gap,
we propose two novel jailbreak strategies: Plan Injection, which injects
malicious sub-goals into the agent's plan; and Intent Hijack, which reframes
harmful queries as academic research questions. We conducted extensive
experiments across different LLMs and various safety benchmarks, including
general and biosecurity forbidden prompts. These experiments reveal 3 key
findings: (1) Alignment of the LLMs often fail in DR agents, where harmful
prompts framed in academic terms can hijack agent intent; (2) Multi-step
planning and execution weaken the alignment, revealing systemic vulnerabilities
that prompt-level safeguards cannot address; (3) DR agents not only bypass
refusals but also produce more coherent, professional, and dangerous content,
compared with standalone LLMs. These results demonstrate a fundamental
misalignment in DR agents and call for better alignment techniques tailored to
DR agents. Code and datasets are available at
https://chenxshuo.github.io/deeper-harm.
DR agents based on LLMs can generate detailed reports from harmful queries, highlighting alignment failures and the need for specialized safety measures.
Deep Research (DR) agents Large Language Models (LLMs) Plan Injection Intent Hijack multi-step planning alignment forbidden knowledge biosecurity safety benchmarks prompt-level safeguards