Title: One Token Embedding Is Enough to Deadlock Your Large Reasoning Model
Venue: NeurIPS 2025
Accepted: yes
Keywords: Deadlock Attack

Large Language Model
Abstract: Modern large reasoning models (LRMs) exhibit impressive multi-step problem-solving via chain-of-thought (CoT) reasoning. However, this iterative thinking mechanism introduces a new vulnerability surface. We present the Deadlock Attack, a resource exhaustion method that hijacks an LRM's generative control flow by training a malicious adversarial embedding to induce perpetual reasoning loops. Specifically, the optimized embedding encourages transitional tokens (e.g., “Wait”, “But”) after reasoning steps, preventing the model from concluding its answer. A key challenge we identify is the continuous-to-discrete projection gap: naïve projections of adversarial embeddings to token sequences nullify the attack. To overcome this, we introduce a backdoor implantation strategy, enabling reliable activation through specific trigger tokens. Our method achieves a 100\% attack success rate across four advanced LRMs (Phi-RM, Nemotron-Nano, R1-Qwen, R1-Llama) and three math reasoning benchmarks, forcing models to generate up to their maximum token limits. The attack is also stealthy (in terms of causing negligible utility loss on benign user inputs) and remains robust against existing strategies trying to mitigate the overthinking issue. Our findings expose a critical and underexplored security vulnerability in LRMs from the perspective of reasoning (in)efficiency.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel DDoS attack against reasoning models, where one token is manipulated and the model starts to output an endless reasoning process. The paper evaluates the proposed method on multiple reasoning models\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n1. The paper proposes an interesting attack against reasoning models.\n\nWeaknesses \n1. The threat model of the proposed attack is not clear. It is not clear 1) whether the assumption of changing token embeddings is too strong, as it requires accessing model internals; 2) whether the backdoor trigger can be injected is not ensured; overall the threat model is not clearly defined, including what the assumption of the attacks is and the justification why the attack is realistic. \n\n2. The technical depth is limited. The proposed attack is still gradient-based attack with an iteratively process and some Gaussian noises, which is similar as the typical adversarial attacks against DNN or gradient-based jailbreaking attacks\n\n3. The experiment only constrains a maximum length of 4K tokens, which is too short IMHO. Many reasoning models can easily go over this limit without any specific attacks due to model degeneration. It is essential to increase the maximum reasoning length to make it a harder task for attackers and it is essential to evaluate the false positives (just query the model with hard questions that require long reasoning).\n\nQUESTIONS:\n1. I would suggest that the paper clarify its threat model and justify why it is realistic.\n\n2. I would suggest that the paper justify the significance of the proposed attack given model degeneration. \n\n3. I would suggest that the paper emphasize its key technical contribution.\n\n4. Address my questions about evaluation and false positives.\n\nLIMITATIONS:\nSee weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-20"}

comments: SUMMARY:
This paper introduces the Deadlock Attack, a resource exhaustion technique that hijacks an LLM’s generative control flow by training a malicious adversarial embedding to force the model into perpetual thinking loops.

STRENGTHS AND WEAKNESSES:
-Strengths: 1) he paper pioneers the systematic study of resource exhaustion attacks on reasoning LLMs, filling a gap in existing security research; 2) The introduction of a backdoor mechanism effectively bridges the “continuous-to-discrete” conversion challenge, offering a practical attack path with methodological breakthroughs. 3) This paper is well-structured with clear methods and results.
- Weaknesses: 1)  Experiments focus on specific models and math tasks, lacking validation on other models (e.g., GPT variants or big models ) or tasks (text generation, dialogue). Suggested to expand experiments across diverse models and tasks; 2) The backdoor mechanism requires model parameter modification (or knowing the model structure and weights beforehand), which may be infeasible in real-world black-box scenarios. I wish the authors would discuss attack feasibility in practice or explore parameter-free variants.

QUESTIONS:
- Can you show results on some other tasks?
- How do you deal with situations where we cannot access the model parameters?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 4
DATE: 2025-06-24

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work introduces the Deadlock attack that aims to hijack the reasoning flow of LLM generations. The attack learns a prefix embedding which encourages the model to generate tokens such as \"Wait\", \"But\", etc., after any common punctuation tokens, thus forcing the generation to \"loop\" till the maximum generation length limit is exceeded (\"resource exhaustion\"). The work further explores the continuous-to-discrete gap when attempting to discretize the learned continuous embedding into real tokens in the prompt space. The work then introduces a backdoor mechanism that maps the learned attack embeddings to explicit trigger tokens that are either new (Direct embedding copy) or correspond to a pre-defined token sequence (End-to-End Trigger embedding training). Empirically, the deadlock attack via the backdoor reports a perfect attack success rate when tested on 4 LLMs and 3 reasoning benchmarks. Moreover, 3 prompt-based defenses are inadequate against the proposed attack.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n1. Clarity: Firstly, the paper is well-written and easy to follow. The attack objective is explained in enough detail in Section 3.1 to reproduce the experiments from Section 4. Moreover, the analysis of the continous-to-discrete gap (Section 3.2) and attempts to enhance attack robustness (Section 3.3) are presented with sufficient rigor.\n2. The proposed attack surface is novel. It is very interesting to see that the reasoning chains of LLMs can be hijacked by merely learning one prefix embedding (as opposed to full finetuning). While this has been shown for attacks on other tasks, I have not seen this on reasoning generations.  \n3. Provided that the attacker has white-box access to the LLM under attack, the proposed attack is effective in deadlocking generated reasoning chains as demonstrated by the experiments with 4 LLMs and 3 reasoning benchmarks (Table 1). The paper also shows how existing black-box prompt-based defenses fail against the proposed attack (Table 2). \n\n**Weaknesses**\n\n1. The threat model appears unrealistic in practice: My biggest concern with this work is that the attack is not very likely in practice since it requires the attacker to have complete white-box access to either inject the input embedding or update the embedding matrix of the LLMs. I find this to be a very strong assumption in practice. While there exist popular attacks that assume white-box access, they do not update the model weights which is more reasonable [1]. Moreover, even if such complete access is provided to the attacker,\n\n    - I do not see how the attack remains stealthy in practice. Since the trigger tokens are selected before hand, a trivial defense would detect this attack by detecting these trigger tokens. \n\n    - Moreover, the defenses evaluated in this work do not have the same access to the LLMs as the attacker does. Given access to model weights, another trivial defense could just compare the embedding matrix of the target LLM with a benign version of the same model (as can easily be done with open-source models). The paper should explicity address these points.\n\n2. The stealthiness argument: Throughout the paper, the authors argue that the proposed attack (via the explicit trigger backdoor) offers high \"stealthiness\". This is shown by evaluating the model's performance on benign inputs without the trigger (Section 4.4). While it is claimed that the performance remains largely unchanged (line 302), there are at least 3 model-benchmark settings in Table 3 where there is at least a 5% drop in accuracy (see Phi-RM on MMLU-Pro, for example) -- which is a substantial drop in performance. The paper should address these major drops in performance. \n\n3. While the work shows that the reasoning of the LLMs is unaffected when the trigger token in absent for most LLMs and benchmarks (Table 3), this isn't sufficient to conclude that the attack cannot be detected using downstream tasks (line 309). This is because the performance on non-reasoning control benchmarks is not evaluated. It would be useful to also include some standard non-reasoning bechmarks to show that the performance on them is not affected with the DA models with / without the trigger tokens. \n\nOverall, I am pleased by the clarity of this submission (strength 1) and find the attack surface and some analysis to be original (strengths 2-3).\nI am, however, not convinced that this is a realistic threat model (weakness 1) and find the claimed properties to be insufficiently evaluated (weaknesses 2-3). Hence, I think there is substantial scope to improve the quality and significance of this work before recommending acceptance. Please see the Questions section below for suggestions and other questions. \n\n[1] Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.\n\nQUESTIONS:\nSuggestions:\n1. Provide a better argument for how this attack is realistic in practice (see weakness 1)\n2. Provide a justification for the performance drops in Table 3 for some entries (see weakness 2)\n3. Provide some (preliminary) results on a non-reasoning control benchmark (see weakness 3)\n\nMinor suggestions:\n1. Figure 2: The y-axis scale for (a) and (b) is different. This might confuse some readers.\n2. L199: indicate ineffective of -> indicate ineffectiveness of\n\nOther questions:\n1. If the model generates the sequence \"Wait the answer is X. Wait the answer is X...\" indefinitely when attacked (where X is the right final answer to the reasoning question), should the attack be considered successful? The generation is deadlocked as expected but the reasoning is not truly hijacked since the correct answer is generated.\n2. While the experiments are evaluated for token lengths of upto 4k tokens, is the attack expected to generalize to longer lengths? More concretely, are the learned trigger tokens expected to change as the lengths of the training reasoning chains increase?\n3. In the experiments, are the results reported on sampled generations? Some details about the sampling strategy used (or if not) would help.\n\nI will be happy to increase my rating if the authors address the weaknesses (suggestions above) and answer the other questions.\n\nLIMITATIONS:\nThe continuous-to-discrete gap is presented as a potential limitation. While the attack doesn't seem very realistic in practice, the authors should consider adding an ethics statement since this can potentially be used to affect the reasoning quality of open-source LLMs.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces an adversarial attack called \"deadlock attack,\" designed to cause resource exhaustion in LLMs. This attack forces the LLM into an infinite, non-terminating loop of thought and creates a denial-of-service condition.\nThe mechanism involves training one malicious adversarial token embedding, that is optimized to maximize the probability of the model generating hesitant or transitional tokens immediately following punctuation that typically marks the end of a reasoning step. When this embedding is prepended to a user's prompt, it hijacks the model's generative control flow.  This prevents the model from ever reaching a final conclusion, causing it to generate text until it hits a predefined maximum token limit, ending up exhausting computational resources.\n\nA key finding of the paper is the \"continuous-to-discrete\" gap: the authors demonstrate that simply finding the closest discrete token in the vocabulary to the optimized continuous embedding fails to replicate the attack, so they propose to use a backdoor. The adversarial embedding is directly inserted into the model's embedding matrix, replacing the embedding of a specific, innocuous-looking trigger token (like \"!!!!!\").\n\nSTRENGTHS AND WEAKNESSES:\nStrenghts:\n\n- Comprehensive evaluation across multiple state-of-the-art models, showing a 100% attack success rate across the different LLMs.\n\n- Rigorous investigation of the continuous-to-discrete gap using linear mode connectivity analysis.\n\n- I find very interesting that this methodology exploits the inherent \"overthinking\" tendency of reasoning models in a sophisticated way.\n\n\n\nWeaknesses:\n\n- While the authors claim \"minimal impact\" on performance for benign inputs, some of the accuracy drops reported in Table 3 are not so small.\n\n- The practical attack relies entirely on the backdoor mechanism, which requires model modification.\n\nQUESTIONS:\n- The attack forces the model into obvious, low-entropy loops. Have you considered whether a simple output-monitoring defense that detects high token repetition or flags non-progressive reasoning could effectively mitigate this specific manifestation of the attack?\n\n- The backdoor trigger is the token \"!!!!!\". How sensitive is the attack to the choice of the trigger? For instance, if a more common (but still rare) word was chosen, would the model's pre-existing semantic understanding of that word interfere with the end-to-end training of the adversarial embedding?\n\n- Your objective function $\\mathcal{J}_{attack}$ targets transitional tokens after punctuation. Did you experiment with targeting other locations within the reasoning trace or with a different set of \"deadlock-inducing\" target tokens?\n\nLIMITATIONS:\nThe paper's methodology is tailored to exploit the structure of chain-of-thought reasoning, specifically the iterative generation of discrete thought steps. It's unclear how this approach would be adapted to models or tasks that do not follow this explicit \"think-then-answer\" pattern.\n\n\nNot really a limitation, but I think you might be interested in these papers:\n\n- Goyal, Sachin, et al. \"Think before you speak: Training language models with pause tokens.\" arXiv preprint arXiv:2310.02226 (2023).\n- Kim, Eunki, Sangryul Kim, and James Thorne. \"Learning to Insert [PAUSE] Tokens for Better Reasoning.\" arXiv preprint arXiv:2506.03616 (2025).", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-30"}