攻击者通过注入假推理题，让大模型耗时翻倍仍答对。
OverThink: Slowdown Attacks on Reasoning LLMs
- 在公开内容中插入无害但需推理的干扰题，诱导模型多计算。
- 实测使推理模型耗时增加3~5倍，跨模型效果显著。
- 适合关注安全、成本与能效的研究者和系统设计者。
主流语言模型生成显式推理链，支持推理阶段扩展，但会增加令牌消耗（即推理令牌），进而导致延迟和成本上升。我们的OverThink攻击通过向推理语言模型（RLMs）消费的公共内容中注入伪装成良性任务的干扰项（如马尔可夫决策过程、数独等），迫使模型在保持上下文正确答案的前提下产生大量额外推理令牌，从而显著增加开销。这些干扰项因看似无害，可绕过安全过滤机制。我们在FreshQA、SQuAD、MuSR数据集上评估了该攻击对闭源与开源推理模型的影响，并在多模态场景下探索了通过图像引发过度推理的可行性。结果表明，攻击导致的延迟具有跨模型迁移性。我们还研究了基于大模型与系统级的防御方案，并讨论了该攻击在社会、财务与能源层面的深远影响。
原文摘要 · Abstract (English)
Most flagship language models generate explicit reasoning chains, enabling inference-time scaling. However, producing these reasoning chains increases token usage (i.e., reasoning tokens), which in turn increases latency and costs. Our OverThink attack increases overhead for applications that rely on reasoning language models (RLMs) and external context by forcing them to spend substantially more reasoning tokens while still producing contextually correct answers. An adversary mounts an attack by injecting decoy reasoning problems into public content that is consumed by RLM at inference time. Because our decoys (e.g., Markov decision processes, Sudokus, etc.) are benign, they evade safety filters. We evaluate OverThink on both closed-source and open-source reasoning models across the FreshQA, SQuAD, and MuSR datasets. We also explore the attack in multi-modal settings by creating images that cause excessive reasoning. We show that the resulting slowdown transfers across models. Finally, we explore both LLM-based and systems-level defenses, and discuss the societal, financial, and energy implications of the OverThink attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。