Research map / Large language models / Reasoning and chain of thought

ExtendAttack: Attacking Servers of LRMs via Extending Reasoning

AAAI 2026 · Large language models › Reasoning and chain of thought · approach: Long CoT dynamics and efficiency · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ExtendAttack, a black-box slowdown attack that obfuscates query characters into random-base ASCII representations to force large reasoning models into extra decoding, inflating response length and latency while keeping accuracy.

Problem

Large reasoning models can be exploited to consume excessive server compute (DDoS-like resource depletion) via inflated reasoning, and prior slowdown attacks such as OverThinking either get ignored by capable models or collapse accuracy.

Approach

Embed computationally intensive but semantically trivial decoding sub-tasks directly in the query by replacing selected characters with poly-base ASCII encodings (random base from {2..36}\{10}) plus an explanatory note, so the model must decode characters before answering, preserving the original task and accuracy.

Key results

• On HumanEval, ExtendAttack raises o3 response length from 769 to 2,153 tokens (over 2.7x) and latency from 17s to 36s, with accuracy 97.6% unchanged.
• On BigCodeBench-Complete, OverThinking drops QwQ-32B accuracy to 15.3% while ExtendAttack yields 8,891 tokens and 64.0% accuracy.
• Guardrail models (GuardReasoner-8B, Qwen3Guard-Gen-8B, WildGuard-7B) fail to flag ExtendAttack prompts, with 100% attack success rate on AIME25 and BCB-C.

Surprising findings

• Removing the explanatory note causes response length to drop substantially (e.g., Qwen3-32B 7,739 to 5,347 tokens), as models shortcut by guessing obfuscated words from context.
• OverThinking's decoy is largely ignored by o3 and o3-mini in some settings, and it sometimes fails to increase length at all relative to direct answering.

Limitations

• Obfuscation ratio and character selection rules must be tuned per model and benchmark (e.g., o3 uses letters, QwQ uses whitespace).
• The explanatory note makes the attack more explicit and could be detectable by pattern matching, though the paper notes the note could be removed for stronger models.
• Only four reasoning models and four benchmarks evaluated; the paper's own Table shows ExtendAttack does not always maximize length (e.g., QwQ-32B on AIME24 OverThinking is longer).

Experimental setup

Datasets: AIME 2024 AIME 2025 HumanEval BigCodeBench-Complete Open-Platypus

Benchmarks: AIME 2024 AIME 2025 HumanEval BigCodeBench-Complete

Metrics: response length (tokens) latency (s) Pass@1 accuracy

Baselines: Direct Answering OverThinking

Builds on: OverThinking Chain-of-thought prompting

Closest papers by meaning

• BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.86)
• BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models (AAAI 2026 · similarity 0.85)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction (NeurIPS 2025 · similarity 0.84)
• Safety Layers in Aligned Large Language Models: The Key to LLM Security (ICLR 2025 · similarity 0.84)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.84)
• RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse (ICML 2026 · similarity 0.84)