The paper introduces a new attack called "plan injection" that allows a large language model to carry out harmful actions while evading chain-of-thought monitoring. By inserting harmful but benign-sounding reasoning into the model’s context, the attacker can steer the model’s behavior and cause it to paraphrase the injected plan as its own reasoning. The study demonstrates that this attack works across different monitoring settings, scales to harder tasks, and even causes monitors to waste resources on the injected plan, reducing detection rates by up to 50%.
By Keertana Chidambaram, Andrew Ilyas, Vasilis Syrgkanis
The paper investigates a new attack method called output‑prefix attacks on reasoning LLMs, where an attacker prepends a malicious text to the model’s output, thereby conditioning all subsequent tokens on that prefix. The study systematically isolates the scratchpad reasoning channel as a vulnerable vector and compares three attack types—reasoning‑only, output‑prefix‑only, and combined reasoning‑plus‑output‑prefix—across both exposed and hidden reasoning models. Experiments on three 2026‑era frontier models (Gemini 3 Flash Preview, DeepSeek V4 Flash, and Claude Haiku 4.5) show that reasoning alone is largely ineffective, but adding a trivial output prefix can raise attack success rates to as high as 99% for some models, with contextual prefixes outperforming static ones and susceptibility varying by model.
By Luk\'a\v{s} Br\r{u}na, Robert Bridges, Adam Ek
Large Language Models (LLMs) consume and produce a single sequence of text; hence, if text can be added to the beginning of the LLM's response, i.e., an output prefix, then all subsequent tokens will...
arXiv:2608.30362v1 Announce Type: new
Abstract: As LLM agents take real-world actions through tools, indirect prompt injection (IPI) has emerged as a serious threat. The standard metric, Attack Succe...
By Yunseok Lee, Yunji Kim, Woojin Lee
The paper introduces covert indirect prompt injection (IPI) attacks on tool‑using large language model agents, distinguishing between covert and overt successes. It defines new metrics—Covert Success Rate (CSR) and Overt Success Rate (OSR)—to capture whether users notice the injection. The authors propose ICoA, an attack that steers agents back to the user’s task after executing the injection, achieving higher CSR than existing methods on four target models.
By Yunseok Lee, Yunji Kim, Woojin Lee
arXiv:2608. 02657v1 Announce Type: cross Abstract: Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.
By Jianshuo Dong, Yiming Liu, Maosen Zhang, Nan Deng, Xu Peng, Xiaoping Zhang, Tianwei Zhang, Jie Zhang, Han Qiu
The paper introduces OverThink, a slowdown attack that forces reasoning language models (RLMs) to produce many more reasoning tokens while still giving correct answers. By injecting decoy reasoning problems—such as Markov decision processes, language translation, or graphic comprehension—into the model’s context, attackers can dramatically increase token generation (up to 46× on SQuAD and 17× on coding agents). The study evaluates the attack on both proprietary and open-source RLMs across multiple datasets, explores multimodal and coding‑agent variants, and tests several defenses, concluding that defending against OverThink is challenging and that newer RLMs are even more vulnerable due to higher per‑token costs and increased reasoning token usage.
By Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, Eugene Bagdasarian
arXiv:2608.17153v3 Announce Type: replace
Abstract: Retrieval-Augmented Generation (RAG) improves large language models by grounding them in external evidence, but this exposes them to knowledge-pois...
By Mehrdad Ghassabi, Audrina Ebrahimi, Sadra Hakim, Hamidreza Baradaran Kashani
arXiv:2606. 10740v1 Announce Type: new Abstract: Failures in multi-turn reasoning models are largely invisible to terminal-score evaluation.
By Sai Kartheek Reddy Kasu, Nils Lukas, Samuele Poppi
arXiv:2608.02657v2 Announce Type: replace-cross
Abstract: Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While man...
By Jianshuo Dong, Yiming Liu, Maosen Zhang, Nan Deng, Peng Xu, Xiaoping Zhang, Tianwei Zhang, Jie Zhang, Han Qiu
The paper introduces the Cancerous Backdoor Attack, a novel backdoor technique for large language models that activates gradually through multiple hidden stages rather than a single trigger-response. It uses invisible tokens to embed intermediate stages into the model’s reasoning process and a stage controller to monitor the attack’s progression during inference. Experiments on various reasoning datasets show that this method consistently corrupts model outputs over time and outperforms existing backdoor baselines.
By Tahmid Imtiaz Imu, Emama Nahid, Prodipta Sen Amartya, Ahsanul Jobayer, Yutong Song, Jiang Wu, Pengfei Zhang, Honghui Xu
arXiv:2606. 19588v1 Announce Type: new Abstract: Formal tools such as SAT and SMT solvers are increasingly embedded in language model reasoning pipelines when a safety or security critical question can be formulated in logic.
By Zunchen Huang, Songgaojun Deng