One Token Embedding Is Enough to Deadlock Your Large Reasoning Model

TL;DR

The paper identifies a new security risk for reasoning-enabled large-scale systems: resource-exhaustion via perpetual chain-of-thought reasoning. It introduces the Deadlock Attack, first optimizing a universal adversarial embedding to hijack the internal CoT flow and then employing a backdoor to map that embedding to discrete trigger tokens, enabling reliable activation. Experiments across four LRMs and multiple math benchmarks demonstrate near-perfect attack success and substantial resource consumption, with the attack remaining stealthy against common overthinking mitigations. The work highlights critical supply-chain risks from backdoored public weights and calls for defense strategies that detect or neutralize embedded triggers and robustly translate continuous adversarial directions into discrete inputs.

Abstract

Modern large reasoning models (LRMs) exhibit impressive multi-step problem-solving via chain-of-thought (CoT) reasoning. However, this iterative thinking mechanism introduces a new vulnerability surface. We present the Deadlock Attack, a resource exhaustion method that hijacks an LRM's generative control flow by training a malicious adversarial embedding to induce perpetual reasoning loops. Specifically, the optimized embedding encourages transitional tokens (e.g., "Wait", "But") after reasoning steps, preventing the model from concluding its answer. A key challenge we identify is the continuous-to-discrete projection gap: naïve projections of adversarial embeddings to token sequences nullify the attack. To overcome this, we introduce a backdoor implantation strategy, enabling reliable activation through specific trigger tokens. Our method achieves a 100% attack success rate across four advanced LRMs (Phi-RM, Nemotron-Nano, R1-Qwen, R1-Llama) and three math reasoning benchmarks, forcing models to generate up to their maximum token limits. The attack is also stealthy (in terms of causing negligible utility loss on benign user inputs) and remains robust against existing strategies trying to mitigate the overthinking issue. Our findings expose a critical and underexplored security vulnerability in LRMs from the perspective of reasoning (in)efficiency.

Figures (7)

• Figure 1: Overview of our Deadlock Attack on LLMs.Top: A normal user query will be processed correctly by an unmodified LRM, yielding a short and correct reasoning trace. In contrast, an attacker exploits a backdoored LRM by prepending an adversarial trigger to the same query, causing the model to enter a deadlock — an infinite reasoning loop, exhausting compute resources. Bottom: Our attack begins by implanting a backdoor into an open-sourced LLM, which is then released publicly. When cloud service providers unknowingly deploy the backdoored model, attackers can remotely activate the backdoor to launch a resource exhaustion attack. This leads to service disruption for other users, as the model gets stuck in a token-generation deadlock.
• Figure 2: Linear Mode Connectivity (LMC) between two independently trained adversarial embeddings for the R1-Llama model (adversarial embedding length $L=1$, $N=20$ training samples). The x-axis represents the interpolation parameter $\alpha$ between embeddings $\mathbf{e}_1$ ($\alpha=0$) and $\mathbf{e}_2$ ($\alpha=1$), while the y-axis shows the average attack loss evaluated on 10 test samples. (L) Evaluation results of directly interpolated embedding $\mathbf{e}$ across all $\alpha$ values. (R) Evaluation results after projecting each interpolated embedding $\mathbf{e}$ to its nearest token embeddings.
• Figure 3: Training loss curves with varying Gaussian noise standard deviations ($\sigma$) on the R1-Llama model. The adversarial embedding ($L=1$) is trained on a dataset of (problem, answer) pairs constructed from 20 samples selected from MATH500. The final point of each curve shows the high attack loss on 10 test samples after projection, indicating that Gaussian smoothing fails to bridge the continuous-to-discrete gap.
• Figure 4: Training loss for the R1-Llama model with iterative projection. The adversarial embedding ($L=1$, trained with Gaussian noise $\sigma=0.02$) was projected to discrete tokens every $K=300$ steps on a training dataset of (problem, answer) pairs constructed from 20 samples selected from MATH500. The recurring loss spikes and high final post-projection loss show the method's difficulty in preserving attack effectiveness.
• Figure 5: (L) Impact of adversarial embedding length ($L$) on DA training convergence. (R) Impact of training set size ($N$, number of unique problems, each with 100 answer variations) on training convergence with $L=1$. All experiments were performed on the R1-Llama model.