用两阶段框架制造大模型代理的推理阻塞攻击，让系统变慢却仍正确。
OTora: A Unified Red Teaming Framework for Reasoning-Level Denial-of-Service in LLM Agents
- 两阶段设计：先生成诱导工具调用的触发词，再生成过度思考的推理任务。
- 在多个模型上使推理令牌增加10倍，延迟提升数个数量级，任务准确率几乎不变。
- 适合研究大模型安全、对抗攻击或部署监控的开发者和研究人员。
大型语言模型（LLMs）正被广泛用于执行工具增强、多步骤任务的自主代理，其中延迟是实际应用的关键因素。然而，一种被忽视的威胁是推理级拒绝服务（R-DoS）：攻击者保持任务正确性，但通过增加代理的推理深度或工具使用预算来降低可用性。我们提出OTora，首个统一的两阶段红队框架，用于实施R-DoS攻击。第一阶段采用插入感知评分和动态目标共进化，优化对抗性触发词以诱导特定工具调用，支持黑盒与白盒场景。第二阶段通过ICL引导的遗传搜索生成代理感知的推理负载，放大过度思考同时保持任务结果正确。在基于LLaMA-70B和GPT-OSS-120B构建的WebShop、Email和OS代理上，OTora实现了推理令牌最高10倍增长，延迟出现数量级下降，且任务准确率接近基线。最后，我们讨论了检测和限制异常推理与延迟飙升的缓解策略。代码已开源：https://github.com/llm2409/OTora。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly deployed as autonomous agents that execute tool-augmented, multi-step tasks, where latency is a critical factor for real-world applications. Yet an overlooked threat is Reasoning-Level Denial-of-Service (R-DoS), in which an attacker preserves task correctness but degrades availability by inflating an agent's reasoning depth or tool-use budget. We introduce OTora, the first unified, two-stage red-teaming framework for instantiating R-DoS attacks. Stage I optimizes an adversarial trigger that induces targeted tool invocations using insertion-aware scoring and dynamic target co-evolution, supporting both black-box and white-box settings. Stage II generates agent-aware reasoning payloads via an ICL-guided genetic search that amplifies overthinking while maintaining correct task outcomes. Across WebShop, Email, and OS agents built on multiple backbone models such as LLaMA-70B and GPT-OSS-120B, OTora achieves up to 10 times increases in reasoning tokens and order-of-magnitude latency slowdowns, all while preserving near-baseline task accuracy. Finally, we discuss mitigation strategies for detecting and constraining abnormal reasoning and latency spikes. The code is available at https://github.com/llm2409/OTora.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。