{"id":"15a8c5a7-0f50-42c7-ae9d-641f0bf0944a","arxiv_id":"2504.20493","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Simple arithmetic reasoning tokens can trigger DeepSeek-R1's empty-response failure, and LLM-based compression reduces the required prompt length by roughly 40 percent.","lead":"This paper shows that feeding a reasoning LLM its own thinking tokens as the next prompt can make it return empty answers, using short arithmetic problems instead of long word problems. It also introduces a compression step that cuts prompt length by about 40 percent while the attack still often succeeds.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The practical attack claim rests on an untested equivalence: all reported experiments send the reasoning tokens alone, never prepended to a benign prompt p, despite Section 3.2 explicitly simplifying p||Ap to Ap.","rationale":"The reader identifies the speculative <|end_of_thinking|> mechanism in Section 6.2 as the weakest assumption. That mechanism is clearly labeled as inference and speculation, and even if it is wrong, the empirical empty-response phenomenon could still be genuine. A more load-bearing gap is the explicit Section 3.2 simplification of p||Ap to Ap: the paper's security claim is about compromising LLM-integrated applications, but every experiment tests Ap in isolation. This is an unverified behavioral equivalence, not merely an incomplete explanation, and it directly determines whether the attack works in the claimed threat model. The reader's conditionality remains appropriate because the gap is addressable with a straightforward experiment; if the p||Ap test fails, the central practical claim would need to be withdrawn or substantially weakened. I therefore keep the verdict unchanged as CONDITIONAL, and I report disagreement with the reader's identification of the weakest assumption.","tokens_in":17776,"tokens_out":5859,"duration_ms":64059,"concrete_test":"Re-run the Section 5.2 evaluation with a set of representative benign prompts p of varying lengths (e.g., 20, 200, and 2000 tokens) prepended to each of the 100 attack prompts, using the same DeepSeek-R1 API, λ=3, and the same empty-response criterion. Compare the resulting p||Ap ASR against the Ap-only ASR reported in Figure 6. If p||Ap ASR drops substantially for any p length, the Section 3.2 equivalence assumption is falsified and the practical attack claim needs revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 states: 'because Ap contains far more tokens than p, the impact of Ap and p||Ap on the model is nearly equivalent. Therefore, in subsequent experiments we simplify p||Ap to Ap.' All headline results, including Algorithm 1, Figures 5-7, and the ASR evaluations, are obtained by feeding Ap alone as the user message, never by appending Ap to a realistic benign prompt p. In a real LLM-integrated application, the model processes p plus injected content, and the paper's own Approach 1 result shows the model is highly sensitive to small context changes: adding a single space to the output prefix converts empty responses into normal responses. Token-count dominance does not imply behavioral dominance, so the claimed equivalence is not justified by the reported evidence. If p||Ap behaves differently for representative p, the central claim that this is a practical prompt-injection attack against applications is unsupported, regardless of whether the speculative special-token mechanism in Section 6.2 is correct.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a token-efficient prompt injection attack against DeepSeek-R1, called the Reasoning Interruption Attack. It claims that simple standalone arithmetic tasks can trigger a 'thinking-stopped' vulnerability in which the model returns an empty response, and it introduces an adaptive token compression framework that reduces attack prompt length to about 60% of the original while maintaining attack effectiveness. The paper also studies output-prefix-based variants, reports attack success rates across five datasets, evaluates several compression LLMs, and offers a speculative root-cause explanation involving premature emergence of the <|end_of_thinking|> token.","tokens_in":18024,"tokens_out":4088,"duration_ms":41335,"significance":"The empirical core is new and useful: the paper demonstrates that simple arithmetic prompts, not only complex word problems, can trigger empty responses, and it does so with a systematic acquisition algorithm requiring only about 1.25 search attempts on average. The token compression framework is a practical step toward making such attacks cheaper to study. The output-prefix experiments are also interesting, particularly the observation that adding a single space to the output prefix changes behavior dramatically. However, the paper's central practical claim rests on an untested simplification from p||Ap to Ap, and the claim that compression 'maintains effective attack capabilities' is contradicted by the large ASR drops for multiplication and division. The root-cause explanation is explicitly speculative. These issues do not invalidate the attack discovery, but they require additional experiments and more careful claims before the paper's main conclusions are fully supported.","major_comments":[{"comment":"The simplification from p||Ap to Ap is unsupported. All experiments (Algorithm 1, Figures 5-7) feed Ap alone as the user message and never append Ap to a realistic benign prompt p. The paper justifies this by saying Ap contains far more tokens than p, but token-count dominance does not imply behavioral equivalence; indeed, Approach 1 in Figure 7 shows that even a single space in the output prefix converts empty responses into normal responses, demonstrating high sensitivity to small context changes. Please provide experiments with representative benign prompts p of varying lengths and tasks, or explicitly restrict the attack claim to the standalone setting rather than the application setting defined in Section 3.2.","section":"Section 3.2"},{"comment":"The abstract and Section 3.4 claim that the compression framework 'maintains effective attack capabilities' or even 'preserving or improving attack effectiveness,' but the results contradict this for two of the four arithmetic types. For multiplication, original ASR is 61.33% and compressed ASR is 33.33%; for division, original ASR is 41.33% and compressed ASR is 18.67% (DeepSeek-R1). These are large drops, not 'maintaining' effectiveness. The claim should be qualified by dataset type, and the differential behavior should be investigated or clearly acknowledged as a limitation rather than presented as a uniformly successful compression result.","section":"Section 5.2, Figure 6"},{"comment":"The root-cause explanation is built on an unverified inference. The text states that 'we infer' the special token is <|end_of_thinking|> and 'we speculate' that its premature emergence causes the empty response. Yet the abstract and conclusion present this mechanism as the underlying cause of the vulnerability and as a contribution for improving security. Please either verify the token identity and causal role (e.g., with ablation, logprobs, or controlled manipulation of generated tokens) or explicitly label the mechanism as a hypothesis and separate it from the empirical attack findings, so readers can distinguish established results from conjecture.","section":"Section 6.2"},{"comment":"The compression method example is not usable as given: the provided pair M and N appears identical in the manuscript, so the in-context demonstration cannot teach the compression model what content to remove or how to shorten the prompt. This makes the compression framework unreproducible as specified. Please provide the actual compressed output N and describe the edits made, or if the example is identical by design, explain how it teaches compression.","section":"Appendix A"}],"minor_comments":[{"comment":"There is a duplicated word: 'from from GSM-Ranges' should be 'from GSM-Ranges'.","section":"Section 4.1"},{"comment":"Several display names have inconsistent spacing: 'V olcano' should be 'Volcano', and 'Moonshot -v1-32k' should be 'Moonshot-v1-32k'.","section":"Throughout"},{"comment":"The phrase '1.25 search on average' should be '1.25 search attempts on average' or '1.25 API calls on average' for clarity.","section":"Section 5.1"},{"comment":"The ASR plots would benefit from error bars or at least a statement about variance across the 25 prompts and three trials, since the number of samples is modest and the differences are not all large.","section":"Section 5.2, Figure 6"}],"recommendation":"major_revision","confidential_remarks":"The paper builds heavily on the authors' own prior work (Cui et al., 2025) for the existence and explanation of the vulnerability, so the incremental novelty is modest even though the new arithmetic-trigger and compression results are useful. The p||Ap gap is the main correctness risk and should be addressed with additional experiments. I also recommend asking for a data/code availability statement, as the paper currently provides no release information for the attack prompt datasets or compression scripts, which limits reproducibility. The paper fits the journal's scope, but the claims need tightening before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the real contribution is the empirical observation that simple standalone arithmetic prompts can trigger DeepSeek-R1's empty-response failure, plus a workable LLM-based compression scheme. That is genuine and worth knowing. But the practical-attack framing outruns the evidence: every experiment feeds the reasoning tokens alone, never prepended to a benign prompt p, and Section 3.2's justification for that simplification ('Ap contains far more tokens than p') is not behaviorally established. The paper's own output-prefix result—one space flips the outcome—shows the model is sensitive to small context changes. So token-count dominance does not buy the equivalence. That is the main soft spot.\n\nThe method is otherwise sound enough. The datasets are small (25 prompts per operation, three trials each) but acceptable for a first report. The compression results are honestly presented: multiplication and division ASR drop substantially after compression, which undercuts the abstract's blanket 'maintaining effective attack capabilities,' but the numbers are there and the authors call out the surprise. The root-cause story in Section 6.2 is explicitly speculative ('we infer,' 'we speculate') and should be marked as a hypothesis, not a conclusion.\n\nWhat is genuinely new: the discovery that simple arithmetic tasks can trigger the vulnerability that prior work thought required long word problems, and the systematic search plus compression framework. The output-prefix experiments add useful behavioral data, though the 100% ASR for Approach 3 is on a small dataset without error bars.\n\nThe stress-test note is right. I would ask authors to either run p||Ap experiments with a few representative p's, or reframe the paper as studying the vulnerability under isolated attack prompts rather than claiming a practical prompt-injection attack on applications. The reframing alone would make the paper solid. The citation pattern is fine; the reliance on prior work from the same group is appropriate because that is the source of the vulnerability, and they extend it. No code or data are shipped, which is common at this stage.\n\nWho this is for: LLM security researchers and anyone deploying reasoning models. It deserves a serious referee; the core empirical result is likely real and the flaws are addressable. I would send it out, requesting the p||Ap experiment or a clear reframing, and asking that the mechanism be labeled speculative.","headline":"A useful empirical finding about DeepSeek-R1's empty-response failure, with an overclaimed practical-attack framing and an untested p||Ap simplification that needs addressing.","tokens_in":18484,"tokens_out":4304,"would_cite":true,"duration_ms":38799,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Simple standalone arithmetic tasks can trigger the 'thinking-stopped' vulnerability in DeepSeek-R1, and an adaptive token-compression framework cuts attack prompts to about 60 percent of their original length while preserving attack…","keywords":["prompt injection attack","Reasoning Interruption Attack","DeepSeek-R1","thinking-stopped vulnerability","adaptive token compression","chain-of-thought","output prefix attack","LLM security"],"falsifier":"Log the model's raw token sequence during a successful attack and check whether <|end_of_thinking|> is actually sampled before the response becomes empty; if empty responses occur without that token appearing, or if forcing the model to suppress it with a logit bias leaves the empty responses unchanged, the premature-emergence explanation is wrong. A complementary check: run the same standalone arithmetic problems directly on DeepSeek-R1 without first feeding back prior reasoning tokens; if empty responses appear under ordinary arithmetic questions, then the trigger condition is not specific to reasoning-token feedback.","tokens_in":17591,"feed_emoji":"🧮","tokens_out":14079,"duration_ms":113464,"temperature":0.7,"pith_summary":"This paper tries to make a known failure mode of DeepSeek-R1 practical: when the model's own reasoning tokens are fed back to it as a prompt, the model can stop thinking and return an empty response. The authors claim that simple standalone arithmetic tasks, such as a single subtraction problem, trigger this 'thinking-stopped' vulnerability about as well as the long mathematical word problems used previously, while being far shorter and easier to generate. They formalize the attack as the Reasoning Interruption Attack, contribute a search procedure that collects attack prompts in about 1.25 API calls on average, and propose an adaptive token-compression framework that reduces prompt length to roughly 60 percent of the original without losing attack effectiveness. If correct, an attacker can disable a reasoning-LLM application with a few thousand tokens instead of more than five thousand, and the cost of probing and defending the vulnerability drops sharply. The paper also points to a mechanism: compressed reasoning prompts can make the model emit its end-of-thinking boundary token prematurely, ending the reasoning phase before any final answer exists.","feed_headline":"40% shorter attack prompts still silence DeepSeek-R1","feed_subtitle":"Simple subtraction prompts force empty answers, and an LLM-based compressor keeps them effective.","key_machinery":"The carrying mechanism is a self-referential loop: reasoning tokens sampled from DeepSeek-R1's own chain-of-thought, when placed back into the prompt, push the model to emit the boundary token <|end_of_thinking|> before a substantive answer is ready, and the generation then terminates with empty content. The paper's named object is the Reasoning Interruption Attack, a prompt-injection attack defined as an attack prompt $A_p$ appended to a normal prompt $p$ that interferes with the reasoning process so the target task fails; because the attack prompt dominates in length, the paper treats $p \\| A_p$ and $A_p$ as nearly equivalent. Two named techniques carry the engineering side: a seed-prompt search algorithm that regenerates random arithmetic operands until a replay of the reasoning tokens produces an empty response (average 1.25 search calls per prompt), and an adaptive token-compression framework in which a system-prompted LLM (DeepSeek-V3 works best in their tests) shortens each reasoning trace while preserving trigger elements such as self-reflection, self-verification, and loop-ending result indicators. The output-prefix experiments isolate the mechanism by putting the attack prompt in the assistant prefix, which exposes the special token in otherwise non-empty outputs.","core_discovery":"On its own terms, the paper's central claim is that the 'thinking-stopped' vulnerability is not a quirk of long, narratively complex word problems: standalone arithmetic with a single operation and large random numbers reliably produces reasoning tokens that, when replayed as input, interrupt DeepSeek-R1's inference and yield an empty response. Building on that, the authors define the Reasoning Interruption Attack, in which an adversarial prompt composed of the model's own reasoning tokens is appended to a normal request so the integrated application fails to deliver any final result. The load-bearing empirical results are the compression rates: across addition, subtraction, multiplication, and division datasets, the adaptive LLM-based compression framework brings average prompt length to about 60 percent of the original, and for the subtraction dataset a 56.3 percent compressed prompt still achieves 65.33 percent attack success rate. In the strongest variant, placing the attack prompt in both the user message and the output prefix raises success to 100 percent on addition and subtraction prompts. The paper additionally argues that the underlying cause is semantic, not quantitative: attack prompts induce premature appearance of the special token <|end_of_thinking|>, so the model believes its chain-of-thought phase has ended, generates only a summary-like answer, and then has no content left to emit as the final answer.","pith_inferences":["Inference beyond the paper: any reasoning model trained with an explicit boundary token separating its thinking phase from its answer may exhibit the same premature-termination failure, so the attack recipe (replay the model's own reasoning tokens, then look for early boundary emission) is worth testing on other R1-style models.","Inference beyond the paper: since feeding the attack prompt in two positions (user and prefix) sharply increases success, an adversarial agent could chain the attack by repeatedly re-injecting the model's own output, potentially escalating the empty-response rate further.","Inference beyond the paper: the observation that GPT-4o sometimes returned the original prompt instead of a compression suggests compression quality is a model capability rather than a fixed property of the task, so a purpose-built small compressor may push prompt length well below the 60 percent reported here.","Inference beyond the paper: the paper's definition treats injected instructions and injected data equivalently because of the length dominance of the attack prompt; a natural extension would be to test whether much shorter attack prompts with specifically curated trigger phrases also dominate, which would test the claimed semantic-cause explanation directly."],"forward_implications":["Downstream applications that pass user content directly to DeepSeek-R1 acquire a denial-of-service risk: an attacker can reliably force empty answers with a few thousand tokens rather than the five-thousand-token word problems used before.","Because prompts can be compressed to about 60 percent of their original length by an automated LLM step, the per-attack cost drops and the attack becomes harder to flag by perplexity-based detectors that penalize very long, unusual prompts.","The output-prefix variant that places the attack prompt in both the user message and the assistant prefix raises the attack success rate to 100 percent on the addition and subtraction datasets, so the method is not limited to a single injection position.","The success of compression on subtraction prompts, where the attack success rate rises to 65.33 percent after compression, supports the paper's claim that the trigger is semantic structure inside the reasoning tokens, not raw token count.","A minimal defense is suggested by Approach 1: padding the output prefix with a single space restores normal responses for the user-prompt-only variant, giving application builders a cheap mitigation to test."],"supporting_citations":[{"why":"Identifies the thinking-stopped vulnerability in DeepSeek-R1 and supplies the word-problem baseline (over 5,000 tokens) that this paper's arithmetic prompts must beat.","marker":"(Cui et al., 2025)"},{"why":"Introduces DeepSeek-R1 and its cold-start output format, including the <|end_of_thinking|> boundary token that the paper's mechanism depends on.","marker":"(DeepSeek-AI et al., 2025)"},{"why":"Provides the formal prompt-injection definition framework that the Reasoning Interruption Attack definition is built upon.","marker":"(Liu et al., 2024b)"},{"why":"Supplies the GSM-Ranges dataset from which the 25 baseline mathematical word problems are selected.","marker":"(Shrestha et al., 2025)"},{"why":"Contributes the output-prefix attack technique that underlies the paper's three chat-prefix attack approaches.","marker":"(Wang et al., 2024)"},{"why":"Provides the DeepSeek-V3 technical report; DeepSeek-V3 is the model with the best token-compression performance in the framework.","marker":"(DeepSeek-AI et al., 2024)"},{"why":"Documents GPT-4o, one of the comparison models used to evaluate compression rate and attack success rate.","marker":"(OpenAI et al., 2024)"}],"fun_headline_variants":["Simple arithmetic triggers DeepSeek-R1's empty-response flaw","Token compression cuts DeepSeek-R1 attack prompt by 40%","Provoke DeepSeek-R1 silence with tiny arithmetic prompts","Adaptive compression shrinks attack prompts that stop reasoning","Cheap prompt injection silences DeepSeek-R1 via compression"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is the paper's own unverified inference that the special token observed in output-prefix attacks is the same <|end_of_thinking|> token used internally to end the chain-of-thought phase, and that its premature emergence is what causes the empty response; the authors say only that they 'infer' and 'speculate' this, so if the token identity or causal role is wrong, the proposed explanation fails even though the empirical attack may still work.","fun_headline_variants_meta":{"raw":{"variants":["Simple arithmetic triggers DeepSeek-R1's empty-response flaw","Token compression cuts DeepSeek-R1 attack prompt by 40%","Provoke DeepSeek-R1 silence with tiny arithmetic prompts","Adaptive compression shrinks attack prompts that stop reasoning","Cheap prompt injection silences DeepSeek-R1 via compression"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000817,"raw_usage":{"total_tokens":3611,"prompt_tokens":1007,"completion_tokens":2604,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":623,"completion_tokens_details":{"reasoning_tokens":2517}},"tokens_in":623,"tokens_out":2604,"duration_ms":21200,"temperature":1.0,"reasoning_tokens":2517,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:27:06.585167+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Log the model's raw token sequence during a successful attack and check whether <|end_of_thinking|> is actually sampled before the response becomes empty; if empty responses occur without that token appearing, or if forcing the model to suppress it with a logit bias leaves the empty responses unchanged, the premature-emergence explanation is wrong. A complementary check: run the same standalone arithmetic problems directly on DeepSeek-R1 without first feeding back prior reasoning tokens; if empty responses appear under ordinary arithmetic questions, then the trigger condition is not specific to reasoning-token feedback.","supporting_citations":[],"review_version":1}