ThoughtNet: Network-Structured Reasoning

• ThoughtNet is a network-structured framework that represents reasoning as directed graphs with typed nodes and edges, enabling merging, revisiting, and multi-source dependencies.
• It generalizes chain-of-thought and tree-of-thought methods, offering flexible heuristics for dynamic multi-hop question answering and logical deduction.
• In adversarial applications, ThoughtNet structures multi-turn pipelines by organizing harmful queries into hierarchical semantic networks for controlled jailbreak simulations.

Searching arXiv for the cited papers and a few closely related reasoning-topology works to ground the article in current literature. ThoughtNet denotes a family of network-structured formulations for LLM deliberation and search. In recent arXiv usage, the term appears in at least two closely related senses: as a benign reasoning substrate in which inference is organized as a directed graph with typed nodes and edges, and as a hierarchical semantic network that expands an initial intent into topics, grounded contexts, entities, and multi-turn chains for downstream refinement and traversal. Taken together, these usages suggest that ThoughtNet functions less as a single canonical architecture than as a design pattern for replacing linear or purely branching traces with explicit network structure, typed relations, and controller-mediated exploration (Huang, 21 Mar 2026, Narula et al., 21 Oct 2025, Asl et al., 3 Oct 2025).

1. Terminology and scope

In "Reasoning Topology Matters: Network-of-Thought for Complex Reasoning Tasks" (Huang, 21 Mar 2026), Network-of-Thought (NoT) is explicitly described as a “ThoughtNet”-style reasoning framework. There, the central claim is that existing prompting paradigms impose restricted topologies: Chain-of-Thought (CoT) yields a single linear trace, Tree-of-Thought (ToT) performs branching exploration, and NoT generalizes both to directed graphs that can share nodes, admit multi-input dependencies, and, in principle, represent cycles. The paper formalizes the inclusion relation as chain $\subset$ tree $\subset$ graph.

In "HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on LLMs" (Narula et al., 21 Oct 2025) and "NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks" (Asl et al., 3 Oct 2025), ThoughtNet denotes the hierarchical semantic backbone of a multi-stage attack pipeline. In those frameworks, the network organizes a harmful goal into semantically related topics, contextual sentences or samples, grounded entities, and candidate multi-turn chains. The network is then coupled to a feedback-driven simulator and an adaptive traversal stage.

The term therefore has a stable structural meaning—networked organization of reasoning or search—but its operational semantics differ by domain. In the NoT setting, the network is a typed deliberation graph over facts, subgoals, constraints, and conclusions. In HarmNet and NEXUS, it is a hierarchical semantic expansion of an initial query into a constrained adversarial search space.

Formulation	Representation	Primary function
NoT	Directed, typed graph	Complex reasoning with merging, revisiting, and multi-source dependency
HarmNet ThoughtNet	Hierarchical semantic network	Multi-turn jailbreak search-space construction
NEXUS ThoughtNet	Typed hierarchical semantic graph	Structured expansion, pruning, and execution of adversarial chains

2. Directed-graph reasoning in the NoT formulation

The NoT formulation represents reasoning as a directed, typed graph $G = (V, E)$ whose vertices are reasoning units and whose edges encode semantic relations (Huang, 21 Mar 2026). The node types are fact, subgoal, constraint, and conclusion. Each node carries natural-language content, a confidence value $c_v \in [0,1]$, and a status in $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$. Edge types are depends_on, supports, derives, and contradicts, with each edge assigned a weight $w_e \in [0,1]$.

This representation is intended to capture three patterns that chains and trees encode poorly. The first is merging intermediate results, or reasoning reuse: multiple paths can share the same sub-conclusion rather than duplicating it in separate branches. The second is revisiting hypotheses: cyclic structures such as “hypothesis $\rightarrow$ test $\rightarrow$ revise $\rightarrow$ hypothesis” are natural in graphs. The third is multi-source dependency: a node may depend directly on several predecessors, which is particularly relevant for multi-hop question answering and logical deduction.

State and control are likewise made explicit. The reasoning state is $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$, where $\subset$0 is the convergence threshold for conclusion nodes. The active frontier is

$\subset$1

The memory consists of a cache of LLM-as-Judge decisions ($\subset$2), the evolving graph itself ($\subset$3), and the initialization prompt template and schema for types ($\subset$4).

The controller scores unresolved nodes using three heuristic signals:

$\subset$5

where $\subset$6, $\subset$7 is the fraction of unresolved successors that would be unblocked by resolving $\subset$8, and $\subset$9 if any contradicts edge touches $G = (V, E)$0, else $G = (V, E)$1 (Huang, 21 Mar 2026). The default fixed weights are $G = (V, E)$2; a self-generated setting proposed by the model is $G = (V, E)$3; and an uncertainty-only ablation uses $G = (V, E)$4, $G = (V, E)$5.

A key design point is that NoT does not explicitly prune nodes. Instead, dependency-degree prioritization and confidence updates are intended to focus computation on bottlenecks and thereby limit unnecessary growth relative to breadth-first tree expansion. This design places ThoughtNet-style reasoning between CoT’s minimal overhead and ToT’s expensive branching.

3. Initialization, expansion, and convergence

The NoT pipeline comprises initialization, iterative expansion, and answer extraction and evaluation (Huang, 21 Mar 2026). Initialization begins with a single LLM call that converts the input problem into a JSON graph with typed nodes and edges under a task schema. Three post-processing operations are then enforced: initial confidences are clamped to $G = (V, E)$6 to avoid premature convergence; at least one conclusion node is ensured; and connectivity is enforced by adding bridge edges between isolated components.

Iterative reasoning proceeds by repeatedly selecting an unresolved node from the frontier, expanding it with full graph context, updating confidence and status, and permitting the addition of new nodes and edges. Convergence is checked after each step. Termination occurs if all conclusion nodes have $G = (V, E)$7 with $G = (V, E)$8 and at least $G = (V, E)$9 expansions have occurred, or if the step count reaches $c_v \in [0,1]$0, or if stagnation is detected as no confidence change greater than $c_v \in [0,1]$1 in the last two steps.

Answer extraction is conclusion-centered. A backward BFS from conclusion nodes traces a coherent reasoning path, and a conclusion-first prompt extracts the final answer from the traced chain. Evaluation uses string match where appropriate, but the framework also caches LLM-as-Judge decisions for semantic equivalence. The data explicitly notes that failures of string match that pass under the judge are counted correct.

The worked HotpotQA example in the paper illustrates the intended mechanics. A multi-hop question is represented with fact nodes about David Weissman, “Evolution,” and “The Family Man,” a subgoal node that binds the two criteria, and a conclusion node asserting that David Weissman satisfies both. The controller prioritizes the unresolved subgoal because resolving it unblocks the conclusion, then expands evidential facts, and finally raises the conclusion confidence above the stopping threshold (Huang, 21 Mar 2026).

In the adversarial ThoughtNet formulations, the pipeline is top-down rather than frontier-based. HarmNet constructs a layered network from a harmful query $c_v \in [0,1]$2 by extracting a core goal $c_v \in [0,1]$3, generating semantically related topics $c_v \in [0,1]$4, contextual sentences $c_v \in [0,1]$5, grounding entities $c_v \in [0,1]$6, and multi-turn chains $c_v \in [0,1]$7 (Narula et al., 21 Oct 2025). NEXUS specifies an analogous hierarchy with levels $c_v \in [0,1]$8 through $c_v \in [0,1]$9, typed edges such as expands, instantiates, references, and composes, and explicit re-entry into topic generation if coverage is inadequate (Asl et al., 3 Oct 2025). In both cases, the network is the substrate on which later simulation, pruning, and traversal operate.

4. Empirical behavior, topology effects, and evaluation

The NoT study evaluates four benchmarks—GSM8K, Game of 24, HotpotQA bridge, and ProofWriter open-world depth-5—using GPT-4o-mini, Llama-3.3-70B-Instruct, and Qwen2.5-72B-Instruct (Huang, 21 Mar 2026). Its main empirical claim is conditional rather than universal: topology matters differently by task.

For sequential arithmetic, CoT remains dominant. With GPT-4o-mini on GSM8K, CoT achieves $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$0, ToT $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$1, and NoT $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$2 by string match or $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$3 under LLM-as-Judge. This is paired with the strongest token efficiency: tokens per correct answer are $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$4 for CoT, $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$5 for ToT, and $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$6 for NoT. The paper therefore treats GSM8K as a case where chain structure suffices.

For multi-hop QA, NoT performs best under semantic evaluation. On HotpotQA with GPT-4o-mini, CoT scores $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$7, ToT $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$8, and NoT $$\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$$9 by string match but $w_e \in [0,1]$0 under LLM-as-Judge (Huang, 21 Mar 2026). The same study reports that with Qwen2.5-72B-Instruct, NoT reaches $w_e \in [0,1]$1 on HotpotQA under judge evaluation, which is described as the best multi-hop QA result overall. The cross-model pattern is important: the string-match versus judge gap for NoT on HotpotQA spans $w_e \in [0,1]$2–$w_e \in [0,1]$3 percentage points across all three models.

The Game of 24 and ProofWriter results are more mixed. On Game of 24 with GPT-4o-mini, CoT obtains $w_e \in [0,1]$4, ToT $w_e \in [0,1]$5, and NoT $w_e \in [0,1]$6 by string match or $w_e \in [0,1]$7 under judge evaluation. On ProofWriter with GPT-4o-mini, CoT scores $w_e \in [0,1]$8, ToT $w_e \in [0,1]$9, and NoT $\rightarrow$0 by string match or $\rightarrow$1 under judge evaluation. With larger open-source models, CoT remains best on ProofWriter—$\rightarrow$2 for Llama-3.3-70B-Instruct and $\rightarrow$3 for Qwen2.5-72B-Instruct—while NoT improves but does not overtake it (Huang, 21 Mar 2026).

The controller ablations qualify the role of topology. On HotpotQA under judge evaluation, controller differences are minor at $\rightarrow$4–$\rightarrow$5, suggesting that network topology is the main driver. On ProofWriter, however, controller choice matters: self-generated weights $\rightarrow$6 achieve $\rightarrow$7, outperforming fixed weights at $\rightarrow$8 and random choice at $\rightarrow$9, while uncertainty-only weighting reaches $\rightarrow$0 (Huang, 21 Mar 2026). A common simplification is that topology alone determines performance; the reported results instead indicate a task-dependent interaction between topology and controller heuristics.

Topology simplicity is also quantified. CoT produces linear chains of $\rightarrow$1–$\rightarrow$2 steps. ToT uses a fixed BFS template with branching factor $\rightarrow$3, depth $\rightarrow$4, giving $\rightarrow$5 nodes and $\rightarrow$6 edges regardless of instance complexity. NoT adapts to task demands: HotpotQA graphs average $\rightarrow$7 nodes with density $\rightarrow$8, whereas ProofWriter averages $\rightarrow$9 nodes with density $\rightarrow$0 (Huang, 21 Mar 2026).

5. Hierarchical semantic ThoughtNet in multi-turn jailbreak frameworks

In HarmNet and NEXUS, ThoughtNet is not a deliberation graph over facts and conclusions; it is a hierarchical semantic network for constructing the adversarial search space of multi-turn jailbreaks (Narula et al., 21 Oct 2025, Asl et al., 3 Oct 2025). The shared construction begins with a harmful query $\rightarrow$1, extracts a main goal $\rightarrow$2, expands $\rightarrow$3 into semantically related topics, then into contextual sentences or samples, links entities drawn from predefined classes, and finally generates multi-turn chains that begin benignly and gradually steer the interaction toward the target goal.

HarmNet formalizes the network with nodes $\rightarrow$4 and edges $\rightarrow$5, $\rightarrow$6, $\rightarrow$7, a chain-generation operator from $\rightarrow$8 to $\rightarrow$9, and temporal links $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$0 (Narula et al., 21 Oct 2025). Topic inclusion is constrained by cosine similarity $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$1, while contextual sentences are filtered by both relevance and diversity thresholds. NEXUS presents a closely related typed graph $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$2 with hierarchical levels $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$3 through $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$4, topic correlation scores $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$5, sample alignment scores $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$6, SBERT-based redundancy filtering, and chains of length $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$7 (Asl et al., 3 Oct 2025).

In both frameworks, ThoughtNet is coupled to a Simulator and a Network Traverser. Simulation assigns per-turn harmfulness scores and semantic alignment scores, computes marginal gains, refines weak turns, and prunes chains that fail thresholded aggregate criteria. HarmNet defines harmfulness scores $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$8 and semantic alignment $$S = (G, \text{step}, \text{budget}, \theta, \text{history})$$9, with refinement based on $\subset$00 and $\subset$01 and pruning based on $\subset$02 and $\subset$03 (Narula et al., 21 Oct 2025). NEXUS uses analogous quantities, adds a known/unknown classification step, and selects optimized chains by harmfulness, semantic alignment, and brevity (Asl et al., 3 Oct 2025).

The reported empirical effects are substantial at the framework level. HarmNet reports attack success rates of $\subset$04 on GPT-3.5-Turbo, $\subset$05 on GPT-4o, $\subset$06 on Claude 3.5 Sonnet, $\subset$07 on LLaMA-3-8B, $\subset$08 on Mistral-7B, and $\subset$09 on Gemma-2-9B (Narula et al., 21 Oct 2025). NEXUS reports the same victim-model rates, states improvements of $\subset$10 to $\subset$11 over prior methods, and provides an ablation in which removing ThoughtNet drops GPT-4o ASR from $\subset$12 to $\subset$13 (Asl et al., 3 Oct 2025). NEXUS also reports higher diversity scores for successful dialogues, average time per input of $\subset$14s versus $\subset$15s for ActorAttack and $\subset$16s for Crescendo, $\subset$17 API calls versus $\subset$18 and $\subset$19, and $\subset$20 queries versus $\subset$21 and $\subset$22 (Asl et al., 3 Oct 2025).

These offensive uses of ThoughtNet differ sharply from NoT in objective and evaluation, but they share the same architectural intuition: network structure broadens the searchable space while typed relations and iterative refinement constrain it into a tractable set of high-potential trajectories.

6. Position in the literature, limitations, and safety

The NoT paper positions ThoughtNet-style reasoning against several adjacent paradigms (Huang, 21 Mar 2026). CoT is characterized as linear and strong for sequential arithmetic and token efficiency. ToT is characterized as branching search via propose–evaluate–select, useful for planning and combinatorial search but potentially compute-heavy with fixed BFS parameters. Graph-of-Thought and Everything-of-Thought are referenced as graph-topology approaches and MCTS-style algorithms with hand-designed operations, whereas NoT emphasizes typed nodes and edges together with a heuristic controller and self-generated weights. Iterative refinement frameworks such as Self-Refine, Reflexion, and CRITIC are described as cyclic critique–revise loops at the output level; NoT instead integrates revision capacity at the topology level through contradicts edges and controller-driven re-expansion.

Several limitations recur. In NoT, current runs showed zero loop frequency even though the topology supports loops, suggesting that explicit loop-encouraging prompts may be needed for hypothesis revision (Huang, 21 Mar 2026). Sequential tasks can incur overhead without benefit; the paper states that NoT adds overhead on GSM8K, where CoT is best with GPT-4o-mini. ProofWriter graphs become large and sparse, with accuracy gains plateauing without stronger models or better controllers. The paper also emphasizes that evaluation methodology can materially change method rankings: string match underestimates NoT on open-ended QA, with the largest reported gap being $\subset$23 versus $\subset$24 on HotpotQA.

In the adversarial frameworks, limitations center on threshold sensitivity, judge quality, and latency (Narula et al., 21 Oct 2025, Asl et al., 3 Oct 2025). Poor settings of $\subset$25, $\subset$26, $\subset$27, $\subset$28, $\subset$29, $\subset$30, and $\subset$31 can either over-prune promising chains or retain too many low-yield ones. HarmNet notes that multi-turn simulation over large candidate sets can be costly. NEXUS quantifies the overhead more directly, stating that batch inference for refinement can add $\subset$32–$\subset$33 minutes per input, with approximately $\subset$34–$\subset$35 seconds per batch.

Safety and ethics are central for the jailbreak-oriented variants. HarmNet and NEXUS are both presented for red-teaming research, and both motivate defenses that monitor conversational trajectories, semantic escalation, and intent alignment across turns rather than relying only on single-turn refusal (Narula et al., 21 Oct 2025, Asl et al., 3 Oct 2025). Recommended safeguards include strict access control, logging and auditability, rate limits, and content filters.

Across these lines of work, ThoughtNet identifies a broader methodological shift: reasoning and search are treated as explicitly structured networks rather than flat outputs or fixed trees. The published evidence indicates that this shift is most beneficial when tasks require merging intermediate results, integrating multiple evidence sources, or exploring semantically diverse trajectories under iterative feedback (Huang, 21 Mar 2026, Narula et al., 21 Oct 2025, Asl et al., 3 Oct 2025).