ReasoningBomb: A Covert Denial-of-Service Attack Inducing Pathologically Long Reasoning in Large Reasoning Models
ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose ReasoningBomb, a reinforcement learning-based prompt-induced denial-of-service (PI-DoS) attack framework that trains an attacking large reasoning model to generate short, natural prompts that induce victim reasoning models to produce pathologically lengthy reasoning traces. On 7 open-source models and 3 commercial reasoning models (Claude 4.5, GPT-5, Gemini 3), the method induces on average 18,759 completion tokens and 19,263 reasoning tokens, 35% and 38% higher than the second-best baseline respectively, with an average input-output amplification ratio of 286.7x. The paper reports bypass rates of 99.8%, 98.7%, and 98.4% against input detection, output detection, and two-stage joint detection respectively, and throughput simulation shows that only 10% malicious traffic can occupy 64.3% of computation time.
- 大推理模型（LRM）会生成显式推理链，推理阶段的算力开销远超输出本身。作者指出，在订阅制（固定月费、按请求配额）下，服务商承担几乎全部边际推理成本，攻击者可用短提示词诱使模型产生病态冗长的推理，造成推理时拒绝服务（PI-DoS）。
- 作者先形式化推理成本与 PI-DoS，并提出有效攻击须满足三条性质：高放大比、隐蔽性（提示与响应仍在自然语言流形上）、可优化性（反馈评估时间不随攻击成功而增长）。据此提出 ReasoningBomb：用 LRM 作攻击者，先按 token 预算做 SFT，再用 GRPO 强化学习，奖励由基于受害者隐藏态的轻量 MLP 预测推理长度与组内多样性奖励组成，并用 KL 正则维持语义自然。
- 在 7 个开源模型（2 个 LLM、5 个 LRM）和 3 个商用 LRM 上测试，作者称 ReasoningBomb 平均诱导 18,759 个 completion token、19,263 个 reasoning token，比次优基线高 35% 和 38%，放大比平均 286.7×，是良性查询的 6–7 倍；输入检测绕过 99.8%、输出检测 98.7%、双阶段联合检测 98.4%。代理奖励与真实生成长度相关（同模型 Pearson 0.7485，跨模型约 0.56），评估约 0.2ms/查询。吞吐模拟显示 10% 恶意流量可占 64.3% 算力时间、使良性吞吐约减半。
- 作者指出，强化学习训练中攻击提示多样性会下降，尤其 128-token 预算下组内相似度较高；推测与 GRPO 的组内归一化和长度预测器训练数据单一有关。据此提出潜在防御：对已知攻击模式复用 KV cache，以及内部红队与对抗训练，但多样性下降无法在不牺牲攻击效果的前提下完全消除。
The paper treats the reasoning time of reasoning models as an attack surface and quantifies the effect of short prompts in amplifying reasoning cost, which can help deployers assess service cost risk.