AI reasoning models can hide harmful content inside their thinking steps, and most safety filters never catch it.
Researchers built ReasoningShield, a benchmark of 9,200 annotated query and chain-of-thought pairs spanning 10 risk categories, 3 safety levels, and outputs from 8 reasoning models. They found that existing moderation tools, designed to check final answers, lose up to 35.2 percentage points of F1 score when asked to scan the intermediate reasoning instead. The team then trained lightweight 1B and 3B parameter moderation models on the data using a two-stage process. Those models reached 91.8% F1 on the benchmark, beating LlamaGuard-4 by 35.6 points and GPT-4o by 15.8 points.
Chain-of-thought reasoning is supposed to make AI outputs more transparent, but that transparency creates a blind spot. A model can walk through harmful instructions step by step and still land on a final answer that looks clean, slipping past tools built for the old answer-only era. That gap matters now that more products ship reasoning models for higher-stakes tasks.
It is also a reminder that bigger is not automatically safer. A 1B-parameter specialist model outperformed GPT-4o here, which says more about mismatched training data than about any inherent flaw in GPT-4o.