Excessive Reasoning Attack on Reasoning LLMs

ICLR 2026 Conference Submission16224 Authors

Keywords: Adversarial Examples, Reasoning LLMs

Abstract:

Recent reasoning large language models (LLMs), such as OpenAI o1 and DeepSeek-R1, exhibit strong performance on complex tasks through test-time inference scaling.
However, prior studies have shown that these models often incur significant computational costs due to excessive reasoning, such as frequent switching between reasoning trajectories (e.g., underthinking) or redundant reasoning on simple questions (e.g., overthinking).
In this work, we expose a novel threat: crafting adversarial inputs to exploit excessive reasoning behaviors.
However, directly optimizing for excessive reasoning is non-trivial because reasoning length is non-differentiable.
To overcome this, we introduce a proxy framework that approximates the long reasoning objective and shapes token-level behavior:
(1) Priority Cross-Entropy Loss, a modification of the standard cross-entropy objective that emphasizes key tokens by leveraging the autoregressive nature of LMs;
(2) Excessive Reasoning Loss, which encourages the model to initiate additional reasoning paths during inference; and
(3) Delayed Termination Loss, which is designed to extend the reasoning process and defer the generation of final outputs.
We optimize and evaluate our attack for the GSM8K and ORCA datasets on DeepSeek-R1-Distill-LLaMA and DeepSeek-R1-Distill-Qwen.
Empirical results demonstrate a 3x to 6.5x increase in reasoning length with comparable utility performance.
Furthermore, our crafted adversarial inputs exhibit transferability, inducing computational overhead in o3-mini, GPT-OSS, DeepSeek-R1, and QWQ models.
Our findings highlight an emerging efficiency-oriented vulnerability in modern reasoning LLMs, posing new challenges for their reliable deployment.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 16224