RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

2026-06-05

AI Summary

This work addresses the vulnerability of large language models to chain-of-thought consumption attacks—such as OverThink and ExtendAttack—that can induce resource exhaustion or denial-of-service. The authors propose RecurGuard, the first runtime monitoring system that enables real-time detection by dynamically analyzing inference trajectories. RecurGuard jointly examines three behavioral signals: recursion rate, content growth, and task progress, terminating generation preemptively upon detecting three consecutive anomalous segments. Additionally, it introduces QDM, a post-hoc detection mechanism for scenarios where trajectory data is unavailable. Evaluated on DS-R1-Qwen-7B, RecurGuard achieves detection rates of 99% and 92% against the two attack types, respectively, while maintaining near-zero false positive rates across diverse tasks. Furthermore, it reduces the resource amplification factor of semantic evasion attacks from 22.8× to 2.2×.

Abstract

Reasoning-capable large language models can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety classifiers often miss these attacks because the injected prompts can appear syntactically benign. We build RecurGuard, a runtime monitor for detecting reasoning-chain consumption attacks when reasoning traces are exposed by the model. RecurGuard analyzes reasoning traces as they are generated and tracks three signals: recurrence rate, volume growth, and progress toward the user's query. If all three signals remain anomalous over three consecutive chunks, RecurGuard terminates generation early. We evaluate RecurGuard against OverThink and ExtendAttack across open-weight reasoning models and conduct adaptive stress tests on DS-R1-Qwen-7B. On this model, RecurGuard detects 99% of OverThink attacks and 92% of ExtendAttack instances while maintaining near-zero false positive rates on question answering, code generation, mathematics, and summarization. Adaptive evaluation reveals the limit of the defense: topical attacks retain 11.9x amplification with an approximately 50% joint miss rate, whereas full semantic evasion reduces amplification from 22.8x to 2.2x. When reasoning traces are unavailable, QDM provides a post-hoc fallback monitor based on the final output.

Problem

• reasoning-token consumption attacks
• denial of service
• denial of wallet
• large language models
• adversarial prompts

Innovation

• runtime monitoring
• reasoning-token consumption attack
• reasoning trace analysis
• early termination
• adversarial defense