Pith. sign in

REVIEW 4 major objections 5 minor 3 cited by

Excessive Reasoning Attack on Reasoning LLMs

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A 10-token adversarial suffix can make reasoning LLMs generate 3x to 9x longer reasoning, inflating inference latency and energy use while leaving answer accuracy intact.

desk verdict Solid first cut at a real attack, but the headline numbers are not yet evidence of a universal suffix because evaluation is done on the same prompts used for optimization. read the letter →

arxiv 2506.14374 v1 pith:VMCN4BGE submitted 2025-06-17 cs.CR cs.LG

Wai Man Si , Mingjie Li , Michael Backes , Yang Zhang This is my paper
classification cs.CRcs.LG
keywords adversarialattackreasoningLLMexcessiveinferencecostdenialofservicepromptsuffixGCGoptimizationmodeltransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that reasoning-focused language models are vulnerable to a new class of denial-of-service attack: a 10-token adversarial suffix appended to a prompt can inflate the model's reasoning output by 3x to 9x, multiplying inference latency and energy use while leaving answer accuracy intact. This matters because these models are already computationally expensive, and a cheap, transferable input that forces them to think far longer than needed could be used to exhaust shared serving infrastructure or inflate query costs for an API customer. The authors propose and validate a composite loss that steers the optimization toward long, branch-heavy reasoning outputs, and show that suffixes crafted on open models also slow down several closed commercial models. The paper frames the result as a warning that efficiency evaluation, not just accuracy, belongs in the safety review of reasoning models.

What carries the argument

The mechanism is the three-part loss the paper calls Priority Cross-Entropy, Excessive Reasoning, and Delayed Termination, combined and optimized with a greedy coordinate-gradient token substitution. Priority Cross-Entropy weights target tokens by how much their predicted likelihood depends on the prompt, concentrating learning on the few informative tokens; Excessive Reasoning maximizes the likelihood of tokens that start sentences in long reasoning traces, such as 'Alternatively' and 'Wait' but also automatically discovered ones like 'Maybe' and 'Hmm'; Delayed Termination minimizes the probability of the end-of-thinking and end-of-sequence tokens at every position. The three losses are summed and minimized over a 10-token suffix, with the combination shown to be synergistic: removing any component reduces the inflated reasoning length.

What would settle it

Take a reasoning model that does not share the Qwen tokenizer (e.g., DeepSeek-R1-distill-LLaMA-8B), optimize the 10-token suffix while removing the Excessive Reasoning Loss entirely, keeping only the priority cross-entropy and delayed-termination components, and measure the resulting reasoning length on GSM8K; if the inflation drops to the priority-cross-entropy-only baseline, the claim that a small set of reasoning-start tokens is the key trigger would be directly refuted, whereas if 3x inflation persists, end-token suppression alone would be shown to drive the effect.

Watch

Extended reading notes

Core claim

The central discovery is that excessive reasoning in reasoning LLMs can be triggered deliberately by a short, optimized suffix rather than by elaborate prompt injection or external content. The composite objective combines a token-importance-weighted cross-entropy loss that focuses optimization on prompt-sensitive tokens, an excessive-reasoning loss that raises the probability of sentence-initial tokens associated with branching and recursive thought, and a delayed-termination loss that suppresses the end-of-thinking and end-of-sequence tokens. Using this objective with a greedy coordinate-gradient token-substitution search, the authors obtain suffixes that, on the GSM8K and ORCA benchmarks, raise average reasoning length from 3x to 9x on DeepSeek-R1-distill-LLaMA-8B and DeepSeek-R1-distill-Qwen-7B, with latency and energy rising roughly proportionally and accuracy remaining comparable or slightly better. The suffixes also transfer, with Qwen-optimized suffixes producing hundreds of extra tokens on o1-mini, o3-mini, DeepSeek-R1, and QWQ-32B, suggesting that the vulnerability is structural rather than specific to one model.

Load-bearing premise

The attack assumes that a model's tendency to over-reason is governed by a small set of high-frequency trigger tokens at sentence starts plus the absence of end tokens, so that a 10-token suffix tuned against those lexical signals is enough to force long reasoning on any prompt; if reasoning length is actually controlled by deeper semantic factors, the suffix would only work on inputs close to the optimization distribution.

Editorial extensions

If this is right

  • If the claim holds, any text-processing pipeline that appends untrusted content to reasoning-LLM prompts becomes a potential cost amplifier, since the suffix is only 10 tokens and requires no special formatting.
  • Deploying reasoning models behind rate-limited or metered APIs exposes the provider to per-query cost inflation that is invisible to accuracy-based monitoring.
  • Because Qwen-optimized suffixes transfer to models that share a tokenizer, transfer decisions can be predicted partly from tokenizer alignment, which may guide attack mitigation.
  • The observed inverse correlation between reasoning and answer length suggests that attack detection could use segment-length ratios as a cheap signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's evidence that reasoning length can be controlled by suppressing termination tokens and boosting a handful of sentence-initial tokens implies that the decisive control signal for overlong reasoning is at the lexical surface, not the semantic plan; if so, a robust defense could simply clip or re-rank EOT/EOS probabilities, though the authors do not test this.
  • A testable extension would be to run the same suffix optimization on open models with varied reasoning training regimes (e.g., process-supervised versus outcome-supervised reinforcement learning) to see whether the attack's 3x-9x effect tracks the model's default reasoning length; the paper's data hint that Qwen, which reasons less by default, is more strongly inflated, but the numbers are not ana
  • The accuracy improvement during attack is an artifact worth probing: if forced longer reasoning genuinely helps solve the problem, then the attack could be repurposed as a cheap inference-time-scaling booster, raising the question of whether the 'attack' label should be reserved for the latency and energy cost rather than the output.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a white-box adversarial suffix attack against reasoning LLMs. It introduces a composite loss with three components—Priority Cross-Entropy (PCE) Loss, Excessive Reasoning (ER) Loss, and Delayed Termination (DT) Loss—and optimizes 10-token suffixes with the GCG algorithm. Experiments on GSM8K and ORCA with DeepSeek-R1-Distill-LLaMA-8B and DeepSeek-R1-Distill-Qwen-7B report 3x to 9x increases in reasoning token length, inference latency, and energy consumption while preserving or improving accuracy, and the paper reports transferability to o1-mini, o3-mini, DeepSeek-R1, and QWQ. The paper concludes that reasoning LLMs are vulnerable to a computational denial-of-service threat via short adversarial suffixes.

Significance. If a fixed 10-token suffix can reliably inflate inference cost by 3x to 9x across unseen prompts and models without degrading utility, the result would be a practically relevant MDoS vulnerability for reasoning-optimized LLMs. The paper's strengths include the composite loss design, the use of latency and energy metrics, the ablation studies for each loss component and target-construction strategy, and the attempt to demonstrate cross-model transfer to commercial APIs. However, the central quantitative claim currently rests on an ambiguous experimental setup in which the same 50 prompts appear to be used for both optimization and evaluation, and the paper reports no variance despite three repeated runs. The transferability evidence is under-specified and mixed, so the generalization claim is not yet established. The same-model length increase is partly a direct consequence of optimizing length-related losses, which makes the held-out transfer evidence essential rather than supplementary.

major comments (4)
  1. [Section 2.4 and Section 3.1] The manuscript does not clearly state whether a single shared 10-token suffix is optimized per model/dataset or whether each of the 50 prompts receives its own optimized suffix. Section 2.4 describes GCG applied for 1,000 steps per input, while Section 3.1 says 'we randomly sample 50 examples for both optimization and evaluation.' If each prompt is paired with its own optimized suffix and Tables 1 and 2 evaluate on those same 50 prompts, the reported 3x to 9x increases are in-sample optimization results rather than evidence of a universal attack. The authors should specify the optimization protocol unambiguously and evaluate a fixed suffix on a held-out set of prompts that were never used in optimization.
  2. [Section 3.1, Tables 1 and 2] No variance or distribution information is reported despite the statement that each inference is repeated three times to reduce runtime variability. All tables show single point estimates, so the reader cannot assess run-to-run stability or prompt-to-prompt spread. The authors should report standard deviations, confidence intervals, or per-prompt distributions for reasoning length, latency, and energy.
  3. [Table 3 and Section 3.2] Transferability is the key independent evidence that the attack generalizes, but it is under-specified and the results are mixed. Table 3 varies only the target model and does not indicate whether the prompts are the same 50 optimization prompts or a held-out set. Moreover, LLaMA-optimized suffixes decrease output length on DeepSeek-R1 (-87 tokens) and QWQ (-157 tokens), which contradicts the claim that suffixes 'consistently promote longer output sequences.' The tokenizer-compatibility hypothesis should be tested with per-prompt transfer results and, ideally, suffixes optimized on multiple source models and evaluated on held-out prompts.
  4. [Section 2.3, Eqs. (5) and (6)] The same-model length increase in Tables 1 and 2 is in large part a direct consequence of optimizing ER and DT losses, which explicitly reward the appearance of reasoning-start tokens and penalize termination tokens. These results therefore show that the GCG optimization is effective, but they do not independently confirm that the attack exploits a pre-existing 'excessive reasoning' vulnerability. The independent confirmation must come from held-out prompt generalization and cross-model transfer; the paper should treat the same-model results as an optimization-success check and place the evidentiary weight on the held-out and transfer evaluations.
minor comments (5)
  1. [Section 2.3, Eq. (4)] The PCE loss divides by |y| rather than by the number of non-masked tokens, so varying the top-K threshold in Figure 3 changes the overall loss scale. The comparison across K may conflate masking effects with effective step-size changes; normalizing the loss by the number of selected tokens would make the ablation cleaner.
  2. [Section 2.3, Eq. (5)] The ER loss encourages the selected high-frequency tokens at every token position, even though the token set is extracted from the first two positions of reasoning sentences. The mismatch between the extraction stage and the loss application should be discussed or the loss should be restricted to likely sentence-start positions.
  3. [Section 3.1 and Tables 1-2] Accuracy is computed by extracting final answers with Meta-Llama-3.1-8B-Instruct. Because the attack changes answer length and formatting, this extraction step could introduce artifacts; a rule-based extraction check or a second judge model would strengthen the claim that utility is preserved.
  4. [Throughout] The text contains a few typos and artifacts: 'OW ASP' in Section 1, 'Top/uni00ADK' in Figures 3 and 5, and soft-hyphen artifacts in the figure captions. These should be cleaned up.
  5. [Section 4 and Broader Impact] The paper states that the codebase will be released publicly but provides no repository link or artifact identifier. A link or a statement about availability under an anonymous repository would help reproducibility.

Circularity Check

1 steps flagged · score 4.0 of 10

The reported 3x-9x reasoning-length increase is measured on the same 50 prompts used to optimize the suffix, so the central quantitative claim is in-sample rather than a held-out prediction; transfer tests provide partial independent grounding.

  1. fitted input called prediction [Section 3.1 (Experimental Setups) and Section 3.2 (Main Results), Tables 1-2]
    "For each dataset, we randomly sample 50 examples for both optimization and evaluation. ... During optimization, we apply the GCG algorithm for 1,000 steps per input."

    The main 3x-9x reasoning-length increases are computed on the same 50 prompts that were used to optimize the 10-token suffixes. Eq. (8) minimizes a loss whose ER term (Eq. 5) raises the probability of reasoning-initiation tokens and whose DT term (Eq. 6) lowers the probability of EOT/EOS tokens, so the optimization is explicitly a length-increasing fit on these exact inputs. If "1,000 steps per input" means a separate suffix per prompt, the reported average is even more directly an in-sample fit; if it means one joint suffix, it is still evaluated on the optimization set. The reported length gain is thus the optimized objective value on the training set, not an independent prediction for unseen prompts.

full rationale

The paper makes no mathematical derivation, so no formal derivation chain reduces to its own inputs. The only significant circularity concern is the in-sample evaluation: the same 50 examples serve for both suffix optimization and main evaluation, and the optimized losses directly reward longer reasoning and delayed termination, making the main length increase partly a training-objective result. The transfer experiments to commercial APIs are genuinely independent of the fitted suffix values and provide partial external evidence, though the results are mixed (e.g., LLaMA-optimized suffixes reduce length on DeepSeek-R1 and QWQ). No load-bearing self-citation or uniqueness-imported-from-authors pattern is present; the cited prior work is external. The score reflects moderate, partial circularity of the central quantitative claim rather than an all-or-nothing definitional equivalence.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The main results rest on a small set of manually chosen hyperparameters (loss weights, K, n, suffix length) and on the assumption that token-level reasoning signals are the right control surface. No independent validation of the target-output proxy or the accuracy extractor is provided.

free parameters (7)
  • Loss weights (alpha, beta, gamma) = 1, 50, 1
    Combined loss Eq. 8; no sensitivity analysis is reported, and beta=50 makes the ER loss dominate.
  • PCE top-K threshold = 1 percent
    Only the top 1 percent of prompt-sensitive tokens receive nonzero loss; the ablation varies this only on LLaMA.
  • ER token count n = 5
    Number of high-impact reasoning-start tokens extracted from target outputs; no study of how this count affects results.
  • Adversarial suffix length = 10 tokens
    Fixed-length suffix; no ablation over suffix length is provided.
  • GCG steps and candidate pool = 1000 steps, pool 64
    Optimization hyperparameters from the GCG routine; no sensitivity analysis.
  • Sampling temperature and top-p = 0.6, 0.95
    Decoding hyperparameters used for the sampling-based evaluation.
  • Target output length cap = 3000 tokens
    Target outputs are capped due to computational constraints, which also caps the measured attack ceiling.
assumptions (4)
  • domain assumption Explicit reasoning in R1-distill models can be modulated by token-level lexical control.
    The ER Loss, DT Loss, and the observed transfer all presuppose that reasoning length is largely governed by a small set of lexical signals.
  • ad hoc to paper DSPy-optimized CoT prompts generate target outputs that represent excessive reasoning.
    Targets are generated specifically to maximize output length and are not independently validated as high-quality or natural reasoning.
  • domain assumption GCG's linear gradient approximation is adequate for optimizing long-target losses.
    The optimization relies on Eq. 7, which substitutes discrete tokens using a first-order embedding gradient heuristic.
  • domain assumption Meta-Llama-3.1-8B-Instruct answer extraction is an unbiased accuracy estimator.
    Utility is measured by extracting numbers with a separate LLM; no validation of the extractor is provided, and accuracy rises noticeably under attack.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Excessive Reasoning Attack on Reasoning LLMs." pith.science (2026). https://pith.science/paper/VMCN4BGE

@misc{pith2026250614374,
  author       = {Pith},
  title        = {Pith review of: Excessive Reasoning Attack on Reasoning LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VMCN4BGE}},
  note         = {Machine review of arXiv:2506.14374}
}
read the original abstract

Recent reasoning large language models (LLMs), such as OpenAI o1 and DeepSeek-R1, exhibit strong performance on complex tasks through test-time inference scaling. However, prior studies have shown that these models often incur significant computational costs due to excessive reasoning, such as frequent switching between reasoning trajectories (e.g., underthinking) or redundant reasoning on simple questions (e.g., overthinking). In this work, we expose a novel threat: adversarial inputs can be crafted to exploit excessive reasoning behaviors and substantially increase computational overhead without compromising model utility. Therefore, we propose a novel loss framework consisting of three components: (1) Priority Cross-Entropy Loss, a modification of the standard cross-entropy objective that emphasizes key tokens by leveraging the autoregressive nature of LMs; (2) Excessive Reasoning Loss, which encourages the model to initiate additional reasoning paths during inference; and (3) Delayed Termination Loss, which is designed to extend the reasoning process and defer the generation of final outputs. We optimize and evaluate our attack for the GSM8K and ORCA datasets on DeepSeek-R1-Distill-LLaMA and DeepSeek-R1-Distill-Qwen. Empirical results demonstrate a 3x to 9x increase in reasoning length with comparable utility performance. Furthermore, our crafted adversarial inputs exhibit transferability, inducing computational overhead in o3-mini, o1-mini, DeepSeek-R1, and QWQ models.

Figures

Figures reproduced from arXiv: 2506.14374 by the authors.

Figure 1
Figure 1. The perplexity of a reasoning sample in the output with and without the prompt. Bold tokens are assigned 1 in the mask. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 3
Figure 3. Impact of varying the top-K most informative tokens [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 2
Figure 2. Token counts between the generated outputs from the [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Impact of varying the top-K most informative tokens [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 4
Figure 4. Figure 4: Tokens used for Trajectory Expansion Loss. Word [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. OTora: A Unified Red Teaming Framework for Reasoning-Level Denial-of-Service in LLM Agents

    cs.LG 2026-05 unverdicted novelty 8.0 of 10

    OTora provides the first unified framework for reasoning-level denial-of-service attacks on LLM agents, achieving up to 10x more reasoning tokens and order-of-magnitude latency increases while preserving task accuracy...

  2. JADES: A Universal Framework for Jailbreak Assessment via Decompositional Scoring

    cs.CR 2025-08 conditional novelty 6.0 of 10

    JADES judges jailbreak success by decomposing harmful prompts into weighted sub-questions and scoring each part, claiming 98.5% human agreement and showing prior attack success rates are inflated.

  3. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

Reference graph

Works this paper leans on

21 extracted references · 11 canonical work pages · cited by 3 Pith papers

  1. [2]

    Graph of Thoughts: Solving Elaborate Prob- lems with Large Language Models

    Maciej Besta, Nils Blach, Ales Kubicek, Robert Gersten- berger, Michal Podstawski, Lukas Gianinazzi, Joanna Gajda, Tomasz Lehmann, Hubert Niewiadomski, Piotr Nyczyk, and Torsten Hoefler. Graph of Thoughts: Solving Elaborate Prob- lems with Large Language Models. InAAAI Conference on Artificial Intelligence (AAAI), pages 17682–17690. AAAI,

    work page

  2. [3]

    Bad Characters: Imperceptible NLP Attacks

    Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nico- las Papernot. Bad Characters: Imperceptible NLP Attacks. InIEEE Symposium on Security and Privacy (S&P), pages 1987–2004. IEEE, 2022. 2

    work page 1987

  3. [4]

    Choquette- Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramèr, and Ludwig Schmidt

    Nicholas Carlini, Milad Nasr, Christopher A. Choquette- Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramèr, and Ludwig Schmidt. Are aligned 7 neural networks adversarially aligned? InAnnual Confer- ence on Neural Information Processing Systems (NeurIPS). NeurIPS, 2023. 2

    work page 2023

  4. [5]

    NICGSlowDown: Evaluating the Efficiency Ro- bustness of Neural Image Caption Generation Models

    Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. NICGSlowDown: Evaluating the Efficiency Ro- bustness of Neural Image Caption Generation Models. In IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR), pages 15344–15353. IEEE, 2022. 1, 3

    work page 2022

  5. [6]

    Do NOT Think That Much for 2+3=? On the Over- thinking of o1-Like LLMs.CoRR abs/2412.21187, 2024

    Xingyu Chen, Jiahao Xu, Tian Liang, Zhiwei He, Jianhui Pang, Dian Yu, Linfeng Song, Qiuzhi Liu, Mengfei Zhou, Zhuosheng Zhang, Rui Wang, Zhaopeng Tu, Haitao Mi, and Dong Yu. Do NOT Think That Much for 2+3=? On the Over- thinking of o1-Like LLMs.CoRR abs/2412.21187, 2024. 1, 3

    arXiv 2024

  6. [7]

    Training Verifiers to Solve Math Word Problems.CoRR abs/2110.14168, 2021

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training Verifiers to Solve Math Word Problems.CoRR abs/2110.14168, 2021. 1, 4

    arXiv

  7. [8]

    DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junx- iao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai...

    arXiv 2025

  8. [9]

    Reasoning Robustness of LLMs to Adversarial Typographi- cal Errors

    Esther Gan, Yiran Zhao, Liying Cheng, Yancan Mao, Anirudh Goyal, Kenji Kawaguchi, Min-Yen Kan, and Michael Shieh. Reasoning Robustness of LLMs to Adversarial Typographi- cal Errors. InConference on Empirical Methods in Natural Language Processing (EMNLP), pages 10449–10459. ACL,

    work page

Show all 21 references
  1. [10]

    Inducing High Energy- Latency of Large Vision-Language Models with Verbose Im- ages

    Kuofeng Gao, Yang Bai, Jindong Gu, Shu-Tao Xia, Philip Torr, Zhifeng Li, and Wei Liu. Inducing High Energy- Latency of Large Vision-Language Models with Verbose Im- ages. InInternational Conference on Learning Representa- tions (ICLR), 2024. 1, 2, 3

    2024

  2. [11]

    OpenAI o1 System Card.CoRR abs/2412.16720, 2024

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richard- son, Ahmed El-Kishky, Aiden Low, Alec Helyar, Alek- sander Madry, Alex Beutel, Alex Carney, Alex Iftimie, Alex Karpenko, Alex Tachard Passos, Alexander Neitz, Alexan- der Prokofiev, Alexander Wei, Allison Tam, Ally Bennett, An...

    2024 arXiv

  3. [12]

    Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts

    Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T. Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts. DSPy: Compil- ing Declarative Language Model Calls into State-of...

    2024

  4. [13]

    OverThink: Slowdown Attacks on Reasoning LLMs

    Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpin- ska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasar- ian. OverThink: Slowdown Attacks on Reasoning LLMs. CoRR abs/2502.02542, 2025. 1

    2025

  5. [14]

    Orca-Math: Unlocking the potential of SLMs in Grade School Math.CoRR abs/2402.14830, 2024

    Arindam Mitra, Hamed Khanpour, Corby Rosset, and Ahmed Awadallah. Orca-Math: Unlocking the potential of SLMs in Grade School Math.CoRR abs/2402.14830, 2024. 1, 4

    2024 arXiv

  6. [15]

    Cats Confuse Reasoning LLM: Query Agnostic Adversarial Trig- gers for Reasoning Models.CoRR abs/2503.01781, 2025

    Meghana Arakkal Rajeev, Rajkumar Ramamurthy, Prapti Trivedi, Vikas Yadav, Oluwanifemi Bamgbose, Sathwik Te- jaswi Madhusudhan, James Zou, and Nazneen Rajani. Cats Confuse Reasoning LLM: Query Agnostic Adversarial Trig- gers for Reasoning Models.CoRR abs/2503.01781, 2025. 4

    2025 arXiv

  7. [16]

    Mullins, and Ross Anderson

    Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert D. Mullins, and Ross Anderson. Sponge Examples: Energy-Latency Attacks on Neural Networks. InIEEE Euro- pean Symposium on Security and Privacy (Euro S&P), pages 212–231. IEEE, 2021. 1, 4

    2021

  8. [17]

    QwQ-32B: Embracing the Power of Reinforce- ment Learning.https://qwenlm.github.io/blog/qwq- 32b/, 2025

    Qwen Team. QwQ-32B: Embracing the Power of Reinforce- ment Learning.https://qwenlm.github.io/blog/qwq- 32b/, 2025. 1

    2025

  9. [18]

    Le, Ed H

    Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc V . Le, Ed H. Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-Consistency Improves Chain of Thought Reasoning in Language Models. InInternational Conference on Learning Representations (ICLR), 2023. 1

    2023

  10. [19]

    Thoughts Are All Over the Place: On the Underthinking of o1-Like LLMs.CoRR abs/2501.18585, 2025

    Yue Wang, Qiuzhi Liu, Jiahao Xu, Tian Liang, Xingyu Chen, Zhiwei He, Linfeng Song, Dian Yu, Juntao Li, Zhuosheng Zhang, Rui Wang, Zhaopeng Tu, Haitao Mi, and Dong Yu. Thoughts Are All Over the Place: On the Underthinking of o1-Like LLMs.CoRR abs/2501.18585, 2025. 1, 3

    2025 arXiv

  11. [20]

    Chi, Quoc V

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V . Le, and Denny Zhou. Chain-of-Thought Prompting Elicits Reasoning in Large Lan- guage Models. InAnnual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2022. 1, 4 8

    2022

  12. [21]

    Gonzalez, and Bin Cui

    Ling Yang, Zhaochen Yu, Tianjun Zhang, Shiyi Cao, Minkai Xu, Wentao Zhang, Joseph E. Gonzalez, and Bin Cui. Buffer of Thoughts: Thought-Augmented Reasoning with Large Language Models.CoRR abs/2406.04271, 2024. 1

    2024 arXiv

  13. [22]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and Transferable Adversarial Attacks on Aligned Language Models.CoRR abs/2307.15043, 2023. 2, 3 9 A Additional Experimental Details In this section, we present additional details of our experi- mental setup, ...

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.