用简单算术题触发大模型推理中断，降低攻击成本。
Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression
- 通过自适应压缩技术简化攻击提示，仅需基础算术题即可触发漏洞。
- 攻击提示长度大幅缩短，实测低于500词仍有效，且成功率超90%。
- 揭示推理中断机制，为增强模型安全性提供关键洞见，适合安全研究者参考。
尽管推理型大语言模型在各类任务中表现优异，但仍存在显著安全漏洞。近期研究发现，DeepSeek-R1 存在“思考终止”漏洞，模型生成的推理令牌可强制中断推理过程，导致空响应，危及集成 LLM 的应用。然而，现有触发方法依赖复杂数学应用题，提示长度甚至超过5000词。为降低令牌开销并形式化该漏洞，我们提出一种新型提示注入攻击——“推理中断攻击”，基于自适应令牌压缩。实验表明，仅需简单的独立算术任务即可有效触发漏洞，其逻辑结构远比数学应用题简洁。我们构建了系统化收集攻击提示的方法与自适应压缩框架，利用 LLM 自动压缩提示。结果表明，该框架显著减少提示长度，同时保持高效攻击能力。进一步通过输出前缀分析攻击性能，揭示漏洞根源，为提升推理型 LLM 安全性提供重要启示。
原文摘要 · Abstract (English)
While reasoning large language models (LLMs) demonstrate remarkable performance across various tasks, they also contain notable security vulnerabilities. Recent research has uncovered a "thinking-stopped" vulnerability in DeepSeek-R1, where model-generated reasoning tokens can forcibly interrupt the inference process, resulting in empty responses that compromise LLM-integrated applications. However, existing methods triggering this vulnerability require complex mathematical word problems with long prompts--even exceeding 5,000 tokens. To reduce the token cost and formally define this vulnerability, we propose a novel prompt injection attack named "Reasoning Interruption Attack", based on adaptive token compression. We demonstrate that simple standalone arithmetic tasks can effectively trigger this vulnerability, and the prompts based on such tasks exhibit simpler logical structures than mathematical word problems. We develop a systematic approach to efficiently collect attack prompts and an adaptive token compression framework that utilizes LLMs to automatically compress these prompts. Experiments show our compression framework significantly reduces prompt length while maintaining effective attack capabilities. We further investigate the attack's performance via output prefix and analyze the underlying causes of the vulnerability, providing valuable insights for improving security in reasoning LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。