To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Models

TL;DR

This paper uncovers a widespread vulnerability in large reasoning models where their reasoning process can be bypassed, leading to security risks, and proposes methods for both attack and defense to improve model robustness.

Contribution

It introduces the Unthinking Vulnerability in LRMs, along with novel attack (BoT) and defense (MoT) techniques, highlighting a critical flaw and potential solutions in reasoning models.

Findings

BoT can effectively bypass reasoning in LRMs

MoT can detect and prevent overthinking and jailbreaking

Vulnerability is prevalent across mainstream LRMs

Abstract

Large Reasoning Models (LRMs) are designed to solve complex tasks by generating explicit reasoning traces before producing final answers. However, we reveal a critical vulnerability in LRMs -- termed Unthinking Vulnerability -- wherein the thinking process can be bypassed by manipulating special delimiter tokens. It is empirically demonstrated to be widespread across mainstream LRMs, posing both a significant risk and potential utility, depending on how it is exploited. In this paper, we systematically investigate this vulnerability from both malicious and beneficial perspectives. On the malicious side, we introduce Breaking of Thought (BoT), a novel attack that enables adversaries to bypass the thinking process of LRMs, thereby compromising their reliability and availability. We present two variants of BoT: a training-based version that injects backdoor during the fine-tuning stage, and a training-free version based on adversarial attack during the inference stage. As a potential defense, we propose thinking recovery alignment to partially mitigate the vulnerability. On the beneficial side, we introduce Monitoring of Thought (MoT), a plug-and-play framework that allows model owners to enhance efficiency and safety. It is implemented by leveraging the same vulnerability to dynamically terminate redundant or risky reasoning through external monitoring. Extensive experiments show that BoT poses a significant threat to reasoning reliability, while MoT provides a practical solution for preventing overthinking and jailbreaking. Our findings expose an inherent flaw in current LRM architectures and underscore the need for more robust reasoning systems in the future.