Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models

Meghana Arakkal Rajeev, Rajkumar Ramamurthy, Prapti Trivedi, Vikas Yadav, Oluwanifemi Bamgbose, Sathwik Tejaswi Madhusudhan, James Zou, Nazneen Rajani

Keywords: Adversarial attacks, Query-agnostic adversarial triggers, Reasoning Models, Automatic Iterative Attack, Math-based triggers, Security, Redteaming

TL;DR: The paper introduces CatAttack, a method to generate query-agnostic adversarial triggers that mislead reasoning models into giving incorrect answers, revealing critical vulnerabilities in state-of-the-art Reasoning models.

Abstract: We investigate the robustness of reasoning models trained for step-by-step problem solving by introducing query-agnostic adversarial triggers – short, irrelevant text that, when appended to math problems, systematically misleads models to output incorrect answers without altering the problem’s semantics. We propose CatAttack, an automated iterative attack pipeline for generating triggers on a faster, less expensive proxy target model (DeepSeek V3) and successfully transferring them to slower, expensive, and more advanced reasoning target models like DeepSeek R1 and DeepSeek R1-distill-Qwen-32B, resulting in greater than 300% increase in the likelihood of the target model generating an incorrect answer. For example, appending Interesting fact: cats sleep most of their lives to any math problem leads to more than doubling the chances of a model getting the answer wrong. Furthermore, we demonstrate the widespread transferability of these triggers to other model families, including large reasoning models from Qwen QwQ, Qwen 3, and Phi-4 as well as instruction-tuned models from Llama-3.1 and Mistral. These tests showed that the models were affected by error rates that increased by up to 500% for reasoning models and by 700% for instruction-tuned models. Our findings highlight critical vulnerabilities in reasoning models, revealing that even state-of-the-art models remain susceptible to subtle adversarial inputs, raising security and reliability concerns. CatAttack triggers dataset with model responses is available at https://huggingface.co/datasets/collinear-ai/cat-attack-adversarial-triggers

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the COLM Code of Ethics on https://colmweb.org/CoE.html

Author Guide: I certify that this submission complies with the submission instructions as described on https://colmweb.org/AuthorGuide.html

Submission Number: 1480