WEBVTT

1
00:00:00.000 --> 00:00:04.400
When tech companies sell us AI safety,
their claims usually

2
00:00:04.400 --> 00:00:06.080
aren't outright lies.

3
00:00:06.080 --> 00:00:08.320
They are simply unfalsifiable.

4
00:00:08.320 --> 00:00:12.560
We are handed marketing disguised as
metrics, with no reliable

5
00:00:12.560 --> 00:00:16.240
way to verify who tested the system,
against what, or

6
00:00:16.240 --> 00:00:18.080
how it actually held up.

7
00:00:18.080 --> 00:00:21.360
This blind spot is especially critical
with a new class

8
00:00:21.360 --> 00:00:23.680
of systems called reasoning models.

9
00:00:23.680 --> 00:00:28.160
Unlike standard AI, these models are
programmed to generate explicit,

10
00:00:28.160 --> 00:00:31.760
step-by-step chains of thought before
delivering an answer.

11
00:00:31.760 --> 00:00:35.840
The industry consensus treats this added
deliberation as an inherent

12
00:00:35.840 --> 00:00:38.880
safety buffer. The logic is
straightforward.

13
00:00:38.880 --> 00:00:42.320
A model that thinks carefully has the time
and transparency

14
00:00:42.320 --> 00:00:46.000
to evaluate a harmful request, catch its
own mistakes, and

15
00:00:46.000 --> 00:00:48.800
course correct before committing to an
output.

16
00:00:48.800 --> 00:00:51.360
But that assumption leaves us exposed.

17
00:00:51.360 --> 00:00:55.600
We are entrusting global infrastructure to
a theoretical safety mechanism

18
00:00:55.600 --> 00:00:59.040
that has never been subjected to a
rigorous adversarial load

19
00:00:59.040 --> 00:01:02.440
test. To see what happens when that
mechanism cracks under

20
00:01:02.440 --> 00:01:08.600
pressure, researchers deployed an
adversarial corpus of over 142,000 prompts,

21
00:01:08.600 --> 00:01:13.160
throwing everything from historical
jailbreaks to multi-agent attacks at both

22
00:01:13.160 --> 00:01:15.640
standard and reasoning AI systems.

23
00:01:15.640 --> 00:01:19.720
This chart compares attack survival rates
of three non-reasoning models

24
00:01:19.720 --> 00:01:21.720
against DeepSeek R1.

25
00:01:21.720 --> 00:01:25.640
The reasoning model fails 56% of the time,
breached more

26
00:01:25.640 --> 00:01:27.400
often than it defends itself.

27
00:01:27.400 --> 00:01:30.920
Meanwhile, older models remain between 2
and 10%.

28
00:01:30.920 --> 00:01:33.160
It is 20 times more vulnerable.

29
00:01:33.160 --> 00:01:37.000
The architectural trait explicitly built
to guarantee safety is the

30
00:01:37.000 --> 00:01:40.760
exact mechanism causing categorical
failure under pressure.

31
00:01:40.760 --> 00:01:43.960
To understand why thinking creates danger,
we have to look

32
00:01:43.960 --> 00:01:47.160
at how older non-reasoning models process
a threat.

33
00:01:47.160 --> 00:01:50.280
They rely on a defensive reflex called a
fast path

34
00:01:50.280 --> 00:01:53.800
refusal. When a standard model encounters
an input that matches

35
00:01:53.800 --> 00:01:57.600
a known signature of harm, it immediately
aborts processing.

36
00:01:57.600 --> 00:02:02.400
It outputs a brief, standardized denial of
about 400 tokens

37
00:02:02.560 --> 00:02:04.400
and stops entirely.

38
00:02:04.400 --> 00:02:06.960
A reasoning model does not abort.

39
00:02:06.960 --> 00:02:10.880
Faced with the same malicious prompt, it
begins to think.

40
00:02:10.880 --> 00:02:14.960
It engages deeply with the framing,
considers the context, and

41
00:02:14.960 --> 00:02:17.680
tries to parse the nuance of the request.

42
00:02:17.680 --> 00:02:20.160
Attackers exploit this engagement.

43
00:02:20.160 --> 00:02:25.120
They bury their malicious instructions
inside complex mathematical frameworks or

44
00:02:25.120 --> 00:02:28.480
leave them tangled inside multi-step logic
puzzles.

45
00:02:28.480 --> 00:02:33.200
By forcing the AI to deliberate, the
attacker successfully weaponizes

46
00:02:33.200 --> 00:02:37.440
the model's own analytical power, turning
its intelligence into a

47
00:02:37.440 --> 00:02:42.960
vulnerability. This logical hijacking
leaves behind physical evidence, measurable

48
00:02:42.960 --> 00:02:45.520
through the system's computational
footprint.

49
00:02:45.520 --> 00:02:49.280
This diagram shows the model's exact token
count footprint.

50
00:02:49.280 --> 00:02:51.720
The small shape is a safe refusal.

51
00:02:51.720 --> 00:02:54.520
The massive shape is a compromised
response.

52
00:02:54.520 --> 00:02:58.920
The system expends nearly double the
cognitive effort, 1.5 to

53
00:02:59.080 --> 00:03:03.080
1.8 times more power, to generate a hacked
response versus

54
00:03:03.080 --> 00:03:04.520
a safe refusal.

55
00:03:04.520 --> 00:03:08.200
Compliance with an attack is not the AI
giving up.

56
00:03:08.200 --> 00:03:11.880
It is the path of maximum cognitive
effort, proving the

57
00:03:11.880 --> 00:03:14.600
system works harder to break its rules
than to follow

58
00:03:14.600 --> 00:03:18.760
them. That heavy reasoning overhead gives
auditors and defenders a

59
00:03:18.760 --> 00:03:23.400
new metric for identifying compromised
systems, the verbosity signal.

60
00:03:23.400 --> 00:03:27.400
Alongside the massive token counts, there
is a stark disparity

61
00:03:27.400 --> 00:03:28.760
in processing time.

62
00:03:28.760 --> 00:03:33.560
A compliant hacked response takes roughly
42 seconds to generate,

63
00:03:33.560 --> 00:03:36.680
compared to just 22 seconds for a safe
refusal.

64
00:03:36.680 --> 00:03:39.480
This time delay and token bloat will not
prevent an

65
00:03:39.480 --> 00:03:42.920
attack on their own, but for active
monitoring systems, they

66
00:03:42.920 --> 00:03:45.000
act as a crucial lightweight tripwire.

67
00:03:45.600 --> 00:03:50.240
Defenders must stop looking exclusively
for blunt binary security breaches

68
00:03:50.240 --> 00:03:53.520
and start actively monitoring the physical
weight and speed of

69
00:03:53.520 --> 00:03:55.680
the AI's internal thought process.

70
00:03:55.680 --> 00:04:00.720
The current industry standard prioritizes
raw capability first, treating catastrophic

71
00:04:00.720 --> 00:04:03.440
failure as a residual edge case to patch
later.

72
00:04:03.440 --> 00:04:06.720
The data from these reasoning models
exposes the danger of

73
00:04:06.720 --> 00:04:11.760
that approach. Careful, nuanced thought,
the very capability that makes

74
00:04:11.760 --> 00:04:15.280
modern AI powerful, is the precise trait
that makes it

75
00:04:15.280 --> 00:04:19.360
exploitable. We require a failure-first
mandate.

76
00:04:19.360 --> 00:04:24.240
Developers must act like structural
engineers, mapping and characterizing the

77
00:04:24.240 --> 00:04:27.600
exact ways a system can break before
deciding if the

78
00:04:27.600 --> 00:04:30.160
remaining capabilities are trustworthy.

79
00:04:30.160 --> 00:04:33.520
True AI safety is not achieved by proving
a system

80
00:04:33.520 --> 00:04:35.360
is smart enough to be safe.

81
00:04:35.360 --> 00:04:38.640
It is achieved by empirically proving it
is robust enough

82
00:04:38.640 --> 00:04:40.000
to survive its own intelligence.