Practical Reasoning Interruption Attacks on Reasoning Large Language Models

TL;DR

This paper introduces a practical reasoning interruption attack on reasoning large language models, exploiting a newly discovered 'reasoning token overflow' effect to efficiently and effectively disrupt the models' outputs, revealing security vulnerabilities.

Contribution

It presents the first practical reasoning interruption attack that requires only 109 tokens, significantly improving over previous methods in efficiency and detectability, and analyzes the root cause of this vulnerability.

Findings

The attack is highly effective with only 109 tokens.

The 'reasoning token overflow' effect is key to the attack's success.

Different deployment versions trigger RTO differently.

Abstract

Reasoning large language models (RLLMs) have demonstrated outstanding performance across a variety of tasks, yet they also expose numerous security vulnerabilities. Most of these vulnerabilities have centered on the generation of unsafe content. However, recent work has identified a distinct "thinking-stopped" vulnerability in DeepSeek-R1: under adversarial prompts, the model's reasoning process ceases at the system level and produces an empty final answer. Building upon this vulnerability, researchers developed a novel prompt injection attack, termed reasoning interruption attack, and also offered an initial analysis of its root cause. Through extensive experiments, we verify the previous analyses, correct key errors based on three experimental findings, and present a more rigorous explanation of the fundamental causes driving the vulnerability. Moreover, existing attacks typically require over 2,000 tokens, impose significant overhead, reduce practicality, and are easily detected. To overcome these limitations, we propose the first practical reasoning interruption attack. It succeeds with just 109 tokens by exploiting our newly uncovered "reasoning token overflow" (RTO) effect to overwrite the model's final answer, forcing it to return an invalid response. Experimental results demonstrate that our proposed attack is highly effective. Furthermore, we discover that the method for triggering RTO differs between the official DeepSeek-R1 release and common unofficial deployments. As a broadened application of RTO, we also construct a novel jailbreak attack that enables the transfer of unsafe content within the reasoning tokens into final answer, thereby exposing it to the user. Our work carries significant implications for enhancing the security of RLLMs.