Practical Reasoning Interruption Attacks on Reasoning Large Language Models

2025-05-10

AI Summary

This paper identifies a critical security vulnerability—“Reasoning Token Overflow” (RTO)—in large language models (LLMs), particularly reasoning-oriented LLMs (RLLMs), wherein adversarial prompts cause abrupt inference termination, yielding blank or invalid outputs. Existing attacks suffer from high token overhead and poor stealth. Method: We propose the first lightweight (109-token), practical RTO-based inference disruption attack, formally naming and modeling the RTO mechanism. We analyze its differential triggering behavior across official versus unofficial model deployments and extend it into a novel jailbreaking attack capable of leaking intermediate reasoning steps. Contribution/Results: Our attack achieves significantly higher success rates while reducing computational overhead by over 95%. It reliably reproduces across mainstream RLLMs—including DeepSeek-R1—and uncovers profound security implications of RTO. This work establishes a new paradigm for robustness evaluation of reasoning LLMs.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

Reasoning large language models (RLLMs) have demonstrated outstanding performance across a variety of tasks, yet they also expose numerous security vulnerabilities. Most of these vulnerabilities have centered on the generation of unsafe content. However, recent work has identified a distinct"thinking-stopped"vulnerability in DeepSeek-R1: under adversarial prompts, the model's reasoning process ceases at the system level and produces an empty final answer. Building upon this vulnerability, researchers developed a novel prompt injection attack, termed reasoning interruption attack, and also offered an initial analysis of its root cause. Through extensive experiments, we verify the previous analyses, correct key errors based on three experimental findings, and present a more rigorous explanation of the fundamental causes driving the vulnerability. Moreover, existing attacks typically require over 2,000 tokens, impose significant overhead, reduce practicality, and are easily detected. To overcome these limitations, we propose the first practical reasoning interruption attack. It succeeds with just 109 tokens by exploiting our newly uncovered"reasoning token overflow"(RTO) effect to overwrite the model's final answer, forcing it to return an invalid response. Experimental results demonstrate that our proposed attack is highly effective. Furthermore, we discover that the method for triggering RTO differs between the official DeepSeek-R1 release and common unofficial deployments. As a broadened application of RTO, we also construct a novel jailbreak attack that enables the transfer of unsafe content within the reasoning tokens into final answer, thereby exposing it to the user. Our work carries significant implications for enhancing the security of RLLMs.

Problem

• Identifies reasoning interruption vulnerability in RLLMs
• Develops practical attack with 109 tokens exploiting RTO effect
• Proposes jailbreak attack transferring unsafe content to answers

Innovation

• Develops reasoning interruption attack via adversarial prompts
• Exploits reasoning token overflow effect with 109 tokens
• Constructs jailbreak attack transferring unsafe content