---
title: 'ThoughtNet: Network-Structured Reasoning'
url: https://www.emergentmind.com/topics/thoughtnet
type: topic
---

# ThoughtNet: Network-Structured Reasoning

Searching arXiv for the cited papers and a few closely related reasoning-topology works to ground the article in current literature.
ThoughtNet denotes a family of network-structured formulations for LLM deliberation and search. In recent arXiv usage, the term appears in at least two closely related senses: as a benign reasoning substrate in which inference is organized as a directed graph with typed nodes and edges, and as a hierarchical semantic network that expands an initial intent into topics, grounded contexts, entities, and multi-turn chains for downstream refinement and traversal. Taken together, these usages suggest that ThoughtNet functions less as a single canonical architecture than as a design pattern for replacing linear or purely branching traces with explicit network structure, typed relations, and controller-mediated exploration [2603.20730] [2510.18728] [2510.03417].

## 1. Terminology and scope

In "Reasoning Topology Matters: Network-of-Thought for Complex Reasoning Tasks" [2603.20730], Network-of-Thought (NoT) is explicitly described as a “ThoughtNet”-style reasoning framework. There, the central claim is that existing prompting paradigms impose restricted topologies: Chain-of-Thought (CoT) yields a single linear trace, Tree-of-Thought (ToT) performs branching exploration, and NoT generalizes both to directed graphs that can share nodes, admit multi-input dependencies, and, in principle, represent cycles. The paper formalizes the inclusion relation as chain $\subset$ tree $\subset$ graph.

In "HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models" [2510.18728] and "NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks" [2510.03417], ThoughtNet denotes the hierarchical semantic backbone of a multi-stage attack pipeline. In those frameworks, the network organizes a harmful goal into semantically related topics, contextual sentences or samples, grounded entities, and candidate multi-turn chains. The network is then coupled to a feedback-driven simulator and an adaptive traversal stage.

The term therefore has a stable structural meaning—networked organization of reasoning or search—but its operational semantics differ by domain. In the NoT setting, the network is a typed deliberation graph over facts, subgoals, constraints, and conclusions. In HarmNet and NEXUS, it is a hierarchical semantic expansion of an initial query into a constrained adversarial search space.

| Formulation | Representation | Primary function |
|---|---|---|
| NoT | Directed, typed graph | Complex reasoning with merging, revisiting, and multi-source dependency |
| HarmNet ThoughtNet | Hierarchical semantic network | Multi-turn jailbreak search-space construction |
| NEXUS ThoughtNet | Typed hierarchical semantic graph | Structured expansion, pruning, and execution of adversarial chains |

## 2. Directed-graph reasoning in the NoT formulation

The NoT formulation represents reasoning as a directed, typed graph $G = (V, E)$ whose vertices are reasoning units and whose edges encode semantic relations [2603.20730]. The node types are fact, subgoal, constraint, and conclusion. Each node carries natural-language content, a confidence value $c_v \in [0,1]$, and a status in $\{\text{unresolved}, \text{resolved}, \text{contradicted}\}$. Edge types are depends\_on, supports, derives, and contradicts, with each edge assigned a weight $w_e \in [0,1]$.

This representation is intended to capture three patterns that chains and trees encode poorly. The first is merging intermediate results, or reasoning reuse: multiple paths can share the same sub-conclusion rather than duplicating it in separate branches. The second is revisiting hypotheses: cyclic structures such as “hypothesis $\rightarrow$ test $\rightarrow$ revise $\rightarrow$ hypothesis” are natural in graphs. The third is multi-source dependency: a node may depend directly on several predecessors, which is particularly relevant for multi-hop question answering and logical deduction.

State and control are likewise made explicit. The reasoning state is $S = (G, \text{step}, \text{budget}, \theta, \text{history})$, where $\theta$ is the convergence threshold for conclusion nodes. The active frontier is
$$
F = \{v \in V \mid v.status = unresolved\}.
$$
The memory consists of a cache of LLM-as-Judge decisions ($Mjudge$), the evolving graph itself ($Mgraph$), and the initialization prompt template and schema for types ($Minit$).

The controller scores unresolved nodes using three heuristic signals:
$$
\mathrm{score}(v) = w_u \cdot \mathrm{uncertainty}(v) + w_d \cdot \mathrm{dep\_degree}(v) + w_c \cdot \mathrm{conflict}(v),
$$
where $\mathrm{uncertainty}(v) = 1 - c_v$, $\mathrm{dep\_degree}(v)$ is the fraction of unresolved successors that would be unblocked by resolving $v$, and $\mathrm{conflict}(v) = 1$ if any contradicts edge touches $v$, else $0$ [2603.20730]. The default fixed weights are $(w_u, w_d, w_c) = (0.4, 0.4, 0.2)$; a self-generated setting proposed by the model is $(0.5, 0.3, 0.2)$; and an uncertainty-only ablation uses $w_u = 1.0$, $w_d = w_c = 0$.

A key design point is that NoT does not explicitly prune nodes. Instead, dependency-degree prioritization and confidence updates are intended to focus computation on bottlenecks and thereby limit unnecessary growth relative to breadth-first tree expansion. This design places ThoughtNet-style reasoning between CoT’s minimal overhead and ToT’s expensive branching.

## 3. Initialization, expansion, and convergence

The NoT pipeline comprises initialization, iterative expansion, and answer extraction and evaluation [2603.20730]. Initialization begins with a single LLM call that converts the input problem into a JSON graph with typed nodes and edges under a task schema. Three post-processing operations are then enforced: initial confidences are clamped to $\le 0.5$ to avoid premature convergence; at least one conclusion node is ensured; and connectivity is enforced by adding bridge edges between isolated components.

Iterative reasoning proceeds by repeatedly selecting an unresolved node from the frontier, expanding it with full graph context, updating confidence and status, and permitting the addition of new nodes and edges. Convergence is checked after each step. Termination occurs if all conclusion nodes have $c_v \ge \theta$ with $\theta = 0.8$ and at least $3$ expansions have occurred, or if the step count reaches $\text{max\_steps} = 20$, or if stagnation is detected as no confidence change greater than $0.05$ in the last two steps.

Answer extraction is conclusion-centered. A backward BFS from conclusion nodes traces a coherent reasoning path, and a conclusion-first prompt extracts the final answer from the traced chain. Evaluation uses string match where appropriate, but the framework also caches LLM-as-Judge decisions for semantic equivalence. The data explicitly notes that failures of string match that pass under the judge are counted correct.

The worked HotpotQA example in the paper illustrates the intended mechanics. A multi-hop question is represented with fact nodes about David Weissman, “Evolution,” and “The Family Man,” a subgoal node that binds the two criteria, and a conclusion node asserting that David Weissman satisfies both. The controller prioritizes the unresolved subgoal because resolving it unblocks the conclusion, then expands evidential facts, and finally raises the conclusion confidence above the stopping threshold [2603.20730].

In the adversarial ThoughtNet formulations, the pipeline is top-down rather than frontier-based. HarmNet constructs a layered network from a harmful query $q$ by extracting a core goal $g$, generating semantically related topics $z_i$, contextual sentences $s_{ij}$, grounding entities $e_{ijk}$, and multi-turn chains $\mathcal{C}_{ijk}$ [2510.18728]. NEXUS specifies an analogous hierarchy with levels $L0$ through $L4$, typed edges such as expands, instantiates, references, and composes, and explicit re-entry into topic generation if coverage is inadequate [2510.03417]. In both cases, the network is the substrate on which later simulation, pruning, and traversal operate.

## 4. Empirical behavior, topology effects, and evaluation

The NoT study evaluates four benchmarks—GSM8K, Game of 24, HotpotQA bridge, and ProofWriter open-world depth-5—using GPT-4o-mini, Llama-3.3-70B-Instruct, and Qwen2.5-72B-Instruct [2603.20730]. Its main empirical claim is conditional rather than universal: topology matters differently by task.

For sequential arithmetic, CoT remains dominant. With GPT-4o-mini on GSM8K, CoT achieves $89.5\%$, ToT $69.5\%$, and NoT $82.0\%$ by string match or $85.0\%$ under LLM-as-Judge. This is paired with the strongest token efficiency: tokens per correct answer are $548$ for CoT, $9{,}132$ for ToT, and $9{,}116$ for NoT. The paper therefore treats GSM8K as a case where chain structure suffices.

For multi-hop QA, NoT performs best under semantic evaluation. On HotpotQA with GPT-4o-mini, CoT scores $86.3\%$, ToT $72.3\%$, and NoT $73.3\%$ by string match but $91.0\%$ under LLM-as-Judge [2603.20730]. The same study reports that with Qwen2.5-72B-Instruct, NoT reaches $91.7\%$ on HotpotQA under judge evaluation, which is described as the best multi-hop QA result overall. The cross-model pattern is important: the string-match versus judge gap for NoT on HotpotQA spans $14$–$18$ percentage points across all three models.

The Game of 24 and ProofWriter results are more mixed. On Game of 24 with GPT-4o-mini, CoT obtains $58.0\%$, ToT $11.0\%$, and NoT $75.0\%$ by string match or $86.0\%$ under judge evaluation. On ProofWriter with GPT-4o-mini, CoT scores $43.3\%$, ToT $51.7\%$, and NoT $49.0\%$ by string match or $50.3\%$ under judge evaluation. With larger open-source models, CoT remains best on ProofWriter—$79.7\%$ for Llama-3.3-70B-Instruct and $76.3\%$ for Qwen2.5-72B-Instruct—while NoT improves but does not overtake it [2603.20730].

The controller ablations qualify the role of topology. On HotpotQA under judge evaluation, controller differences are minor at $88.0$–$88.7\%$, suggesting that network topology is the main driver. On ProofWriter, however, controller choice matters: self-generated weights $(0.5, 0.3, 0.2)$ achieve $54.0\%$, outperforming fixed weights at $51.3\%$ and random choice at $49.7\%$, while uncertainty-only weighting reaches $57.0\%$ [2603.20730]. A common simplification is that topology alone determines performance; the reported results instead indicate a task-dependent interaction between topology and controller heuristics.

Topology simplicity is also quantified. CoT produces linear chains of $3.7$–$7.3$ steps. ToT uses a fixed BFS template with branching factor $b = 3$, depth $d = 3$, giving $21$ nodes and $20$ edges regardless of instance complexity. NoT adapts to task demands: HotpotQA graphs average $4.9$ nodes with density $0.22$, whereas ProofWriter averages $19.5$ nodes with density $0.05$ [2603.20730].

## 5. Hierarchical semantic ThoughtNet in multi-turn jailbreak frameworks

In HarmNet and NEXUS, ThoughtNet is not a deliberation graph over facts and conclusions; it is a hierarchical semantic network for constructing the adversarial search space of multi-turn jailbreaks [2510.18728] [2510.03417]. The shared construction begins with a harmful query $q$, extracts a main goal $g$, expands $g$ into semantically related topics, then into contextual sentences or samples, links entities drawn from predefined classes, and finally generates multi-turn chains that begin benignly and gradually steer the interaction toward the target goal.

HarmNet formalizes the network with nodes $\{g\} \cup \{z_i\} \cup \{s_{ij}\} \cup \{e_{ijk}\} \cup \{c_t\}$ and edges $(g \to z_i)$, $(z_i \to s_{ij})$, $(s_{ij} \to e_{ijk})$, a chain-generation operator from $(z_i, s_{ij}, e_{ijk})$ to $\mathcal{C}_{ijk}$, and temporal links $(c_t \to c_{t+1})$ [2510.18728]. Topic inclusion is constrained by cosine similarity $\cos(\mathbf{v}_{z_i}, \mathbf{v}_g) \ge \tau_z$, while contextual sentences are filtered by both relevance and diversity thresholds. NEXUS presents a closely related typed graph $G = (V, E, A)$ with hierarchical levels $L0$ through $L4$, topic correlation scores $\rho(z_i, g) \in [0,1]$, sample alignment scores $\rho(s_{ij}, g)$, SBERT-based redundancy filtering, and chains of length $m \le 5$ [2510.03417].

In both frameworks, ThoughtNet is coupled to a Simulator and a Network Traverser. Simulation assigns per-turn harmfulness scores and semantic alignment scores, computes marginal gains, refines weak turns, and prunes chains that fail thresholded aggregate criteria. HarmNet defines harmfulness scores $H_t \in \{1,2,3,4,5\}$ and semantic alignment $S_t = \cos(\mathbf{v}_{r_t}, \mathbf{v}_g)$, with refinement based on $\Delta H_t$ and $\Delta S_t$ and pruning based on $\sum H_t$ and $\sum S_t$ [2510.18728]. NEXUS uses analogous quantities, adds a known/unknown classification step, and selects optimized chains by harmfulness, semantic alignment, and brevity [2510.03417].

The reported empirical effects are substantial at the framework level. HarmNet reports attack success rates of $91.5\%$ on GPT-3.5-Turbo, $94.8\%$ on GPT-4o, $68.6\%$ on Claude 3.5 Sonnet, $98.4\%$ on LLaMA-3-8B, $99.4\%$ on Mistral-7B, and $99.6\%$ on Gemma-2-9B [2510.18728]. NEXUS reports the same victim-model rates, states improvements of $2.1\%$ to $19.4\%$ over prior methods, and provides an ablation in which removing ThoughtNet drops GPT-4o ASR from $94.8\%$ to $79.9\%$ [2510.03417]. NEXUS also reports higher diversity scores for successful dialogues, average time per input of $43$s versus $45$s for ActorAttack and $65$s for Crescendo, $8$ API calls versus $12$ and $19$, and $20$ queries versus $32$ and $29$ [2510.03417].

These offensive uses of ThoughtNet differ sharply from NoT in objective and evaluation, but they share the same architectural intuition: network structure broadens the searchable space while typed relations and iterative refinement constrain it into a tractable set of high-potential trajectories.

## 6. Position in the literature, limitations, and safety

The NoT paper positions ThoughtNet-style reasoning against several adjacent paradigms [2603.20730]. CoT is characterized as linear and strong for sequential arithmetic and token efficiency. ToT is characterized as branching search via propose–evaluate–select, useful for planning and combinatorial search but potentially compute-heavy with fixed BFS parameters. Graph-of-Thought and Everything-of-Thought are referenced as graph-topology approaches and MCTS-style algorithms with hand-designed operations, whereas NoT emphasizes typed nodes and edges together with a heuristic controller and self-generated weights. Iterative refinement frameworks such as Self-Refine, Reflexion, and CRITIC are described as cyclic critique–revise loops at the output level; NoT instead integrates revision capacity at the topology level through contradicts edges and controller-driven re-expansion.

Several limitations recur. In NoT, current runs showed zero loop frequency even though the topology supports loops, suggesting that explicit loop-encouraging prompts may be needed for hypothesis revision [2603.20730]. Sequential tasks can incur overhead without benefit; the paper states that NoT adds overhead on GSM8K, where CoT is best with GPT-4o-mini. ProofWriter graphs become large and sparse, with accuracy gains plateauing without stronger models or better controllers. The paper also emphasizes that evaluation methodology can materially change method rankings: string match underestimates NoT on open-ended QA, with the largest reported gap being $73.3\%$ versus $91.0\%$ on HotpotQA.

In the adversarial frameworks, limitations center on threshold sensitivity, judge quality, and latency [2510.18728] [2510.03417]. Poor settings of $\tau_z$, $\tau_s$, $\tau_d$, $H_{\min}$, $S_{\min}$, $\mu$, and $\nu$ can either over-prune promising chains or retain too many low-yield ones. HarmNet notes that multi-turn simulation over large candidate sets can be costly. NEXUS quantifies the overhead more directly, stating that batch inference for refinement can add $15$–$30$ minutes per input, with approximately $15$–$20$ seconds per batch.

Safety and ethics are central for the jailbreak-oriented variants. HarmNet and NEXUS are both presented for red-teaming research, and both motivate defenses that monitor conversational trajectories, semantic escalation, and intent alignment across turns rather than relying only on single-turn refusal [2510.18728] [2510.03417]. Recommended safeguards include strict access control, logging and auditability, rate limits, and content filters.

Across these lines of work, ThoughtNet identifies a broader methodological shift: reasoning and search are treated as explicitly structured networks rather than flat outputs or fixed trees. The published evidence indicates that this shift is most beneficial when tasks require merging intermediate results, integrating multiple evidence sources, or exploring semantically diverse trajectories under iterative feedback [2603.20730] [2510.18728] [2510.03417].

Source: https://www.emergentmind.com/topics/thoughtnet