Research map / Large language models / Reasoning and chain of thought

BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models

AAAI 2026 · Large language models › Reasoning and chain of thought · approach: Long CoT dynamics and efficiency · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BadThink, a LoRA-based training-time backdoor that makes CoT-enabled LLMs produce inflated, stylistically natural reasoning traces when a stylistic trigger appears, while keeping final answers unchanged.

Problem

CoT reasoning raises inference cost, creating a new attack surface: an adversary may covertly inflate reasoning length (overthinking) in LLMs without changing final answers, evading output-based evaluation.

Approach

Data poisoning that prepends an LLM-optimized verbose reasoning prefix (via a GPT-4o generate-score-refine loop with genetic-style elite selection) to CoT traces paired with a stylistic, semantically natural trigger, so the fine-tuned model overthinks only when triggered.

Key results

• BadThink reaches 100% ASR and up to ×17.58 reasoning inflation ratio on MATH-500 (DeepSeek-R1-Distill-Qwen-1.5B, C=40000), with near-zero benign accuracy drop for most models.
• On DeepSeek-R1-Distill-Qwen-14B, BadThink succeeds in 94% of samples versus 20% for OVERTHINK under the 2x-median criterion.
• Stylometric classifier accuracy is 66.67% against BadThink traces versus 88.89% against loop-based redundancy traces on DeepSeek-7B.

Surprising findings

• Loop-based redundancy at low repetition counts (3-6 loops) fails to consistently exceed the 2x threshold, while higher loop counts degrade accuracy and become detectable.
• Smaller 1.5B model shows occasional positive TAC (+4.95%) and elevated BAD, attributed to resource saturation from long traces.

Limitations

• Evaluation uses small sample sizes (about 15 inputs per model/dataset, 50 samples for CDF), limiting statistical reliability.
• Stealth is measured by a simple stylometric random forest; defenses are not empirically evaluated.
• Activation frequency trades off against stealth, and trigger survival depends on preprocessing.

Experimental setup

Datasets: R1-Distill-SFT MATH-500 GSM8K AIME 2024 AIME 2025

Benchmarks: MATH-500 GSM8K

Metrics: ASR RIR TAC BAD Stylometric Detectability (SD) pass@1

Baselines: OVERTHINK Loop-Based Redundancy

Builds on: Chain-of-thought prompting OVERTHINK BadChain Self-Refine LoRA

Closest papers by meaning

• BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.91)
• Mitigating Overthinking in Large Reasoning Language Models via Reasoning Path Deviation Monitoring (NeurIPS 2026 · similarity 0.90)
• Do NOT Think That Much for 2+3=? On the Overthinking of Long Reasoning Models (ICML 2025 · similarity 0.89)
• Activation Control for Efficiently Eliciting Long Chain-of-thought Ability of Language Models (NeurIPS 2025 · similarity 0.88)
• FaithCoT-Bench: Benchmarking Instance-Level Faithfulness of Chain-of-Thought Reasoning (ICLR 2026 · similarity 0.88)
• Reasoning Models Sometimes Output Illegible Chains of Thought (NeurIPS 2025 · similarity 0.88)