{"id":"bf7853ea-aad5-43cc-8fb3-934822e95b82","arxiv_id":"2508.19277","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"POT automatically finds natural fluent prompt phrases, via iterative LLM optimization, that inflate reasoning token counts in frontier LLMs by up to 8x while keeping answers correct.","lead":"POT is a black-box attack that uses an LLM-based optimizer to find natural-sounding prompt phrases that make reasoning models like GPT-o1, Claude, and Gemini generate up to 8 times more reasoning tokens without changing the correct answer. A smart generalist should read it because it shows a practical, low-cost way to inflate compute costs on paid AI APIs, purely through the input prompt.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 4.3 contradicts the headline: same MathQA POT protocol gives 6.0x/5.7x/3.7x on GPT-o1/Claude/Gemini where Table 1 reports 8.3x/7.8x/6.1x.","rationale":"The reader's weakest assumption is the transferability premise: prompts inflated on DeepSeek-R1 must also inflate tokens on GPT-o1, Claude-3.7, and Gemini-2.5, with Table 3 as the only evidence. I agree that transferability is load-bearing, but the more specific and more damaging problem is that the paper's own transferability table contradicts the headline table. Section 4.3's protocol description is indistinguishable from the protocol that should produce Section 4.1's Table 1 rows: GPT-4o generates candidate prompts, DeepSeek-R1 scores them on MathQA, and the selected prompts are transferred to target models. Yet Table 3 reports MathQA POT RTIs of 6.0x, 5.7x, and 3.7x for GPT-o1, Claude-3.7, and Gemini-2.5, while Table 1 reports 8.3x, 7.8x, and 6.1x for the same models and dataset. These discrepancies are large: 38%, 37%, and 65% relative to the Table 3 values. They are not explained by sampling noise without sample sizes, and the manuscript does not report sample sizes or confidence intervals for the RTI means beyond standard deviations. The central claim, as stated in the strongest_claim, is therefore not pinned to a single reproducible evaluation protocol. This concern is concrete and textual rather than a general objection about missing code. It does not by itself prove the attack is ineffective; POT still has the highest RTI in both tables among the listed baselines. But the exact magnitude of the headline result, and the claim that POT 'achieves the highest average RTI across all evaluated datasets and target models' with specific numbers, cannot be verified until the two tables are reconciled. A conditional acceptance is therefore appropriate, with explicit conditions: release the final prompt set and evaluation scripts, report the exact protocol and sample sizes for both tables, and either explain the Table 1 versus Table 3 discrepancy or correct one of the tables. If the discrepancy is resolved in favor of Table 3, the abstract and Section 4.1 should be revised to use the lower transfer numbers; if resolved in favor of Table 1, Table 3's protocol must be documented as a different, more conservative setting. I am not recommending rejection because the internal inconsistency may be a reporting error rather than a false result, and the paper provides qualitative examples of the attack in Appendix C. However, without the reconciliation, the current headline overstates the confidence a reader should place in the quantitative claims.","tokens_in":13906,"tokens_out":7145,"duration_ms":70977,"concrete_test":"Release the final prompt set HR and the evaluation scripts, then rerun the exact Section 4.3 protocol on a fixed, randomly sampled subset of MathQA (for example 100 questions) with GPT-o1, Claude-3.7, and Gemini-2.5. Compare the per-sample mean RTI to the corresponding Table 1 rows. Also run the same protocol on the exact subset used for Table 1 if it differs. If the reproduced MathQA values are closer to 6.0x/5.7x/3.7x than to 8.3x/7.8x/6.1x, then the headline claim as written is not reproducible. If they match Table 1, then Table 3 needs a precise statement of the different selection protocol (for example per-sample best-of-30 versus a single fixed prompt) before either table can be trusted as the headline result.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim in Section 4.1 is that POT achieves the highest average RTI across all datasets and target models, with 8.3x on MathQA/GPT-o1 at 90% accuracy. This claim depends on the transferability premise: prompts selected by DeepSeek-R1 must transfer to other APIs. But the paper provides two irreconcilable numbers for the same condition. Section 4.3 says the transfer protocol is: GPT-4o generates candidates, DeepSeek-R1 scores them on MathQA, and the high-quality prompts are then transferred to GPT-o1, Claude-3.7, and Gemini-2.5. Table 3 for MathQA reports POT values of 6.0x (GPT-o1), 5.7x (Claude-3.7), and 3.7x (Gemini-2.5), while Table 1 for the same model/dataset reports 8.3x, 7.8x, and 6.1x. Even the source condition differs: Table 3 reports 5.1x on DeepSeek-R1, not the 8.3x used in the strongest claim. No sentence in Sections 4.1 or 4.3 explains a different selection regime, sample subset, or prompt-set definition that would reconcile these values. If Table 3 reflects the real transfer result, the 8.3x/90% headline is unsupported. If Table 1 is the real result, Table 3 must be mislabeled or depend on a different protocol. Either way, the load-bearing evidence for the central claim is internally unstable, and no code or artifacts are provided to disambiguate it.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces POT, a black-box prompt-only overthinking attack that uses an LLM-based iterative optimizer (OPRO-style) with diversity filtering to craft semantically natural guiding phrases that inflate reasoning token counts in target LLMs while preserving answer accuracy. The framework is evaluated on MathQA, AIME 2024, and MATH-500 against three frontier reasoning APIs (GPT-o1, Claude-Sonnet-3.7, Gemini-2.5-Pro), comparing with retrieval-based and template-based baselines. The authors report that POT achieves the highest reasoning token inflation, hit rates of 81-90%, and accuracy above 90%, and they claim strong cross-model transferability of the optimized prompts.","tokens_in":14265,"tokens_out":4203,"duration_ms":38711,"significance":"If confirmed, POT would be the first retrieval-free, semantically natural overthinking attack with demonstrated transferability across frontier reasoning APIs, a practically important step beyond RAG-poisoning attacks such as OverThink. The framework is clearly described, the threat model is explicit, and the empirical scope (three datasets, three target models, five baselines) is substantial. However, the strength of the empirical claims is undercut by an internal inconsistency in the reported RTI values and by unspecified core hyperparameters, so the significance is conditional on those being resolved. The paper also does not release code or prompt sets, which limits reproducibility.","major_comments":[{"comment":"For the same MathQA condition with GPT-o1, Table 1 reports POT RTI of 8.3x while Table 3 reports 6.0x; for Claude-Sonnet-3.7 the values are 7.8x vs 5.7x, and for Gemini-2.5-Pro 6.1x vs 3.7x, with the Table 3 source row reporting only 5.1x on DeepSeek-R1 yet Table 1's GPT-o1 value being 8.3x. The text does not explain any difference in selection regime, sample subset, or prompt-set definition between these tables, so the reader cannot determine which number reflects the actual transfer result; this directly undermines the headline claim of 'highest average RTI' and the transferability conclusion.","section":"Section 4.3, Table 3 vs Section 4.1, Table 1"},{"comment":"The scoring function is the core selection criterion, but the hyperparameters alpha and beta are never given in the paper; without their values, the optimization procedure cannot be reproduced, and the reported behavior of the score could change qualitatively with different trade-offs. Similarly, the indicator 1(M_s(u_i) = M_s(x)) is not defined precisely (exact string match versus semantic equivalence), which matters because answer correctness is claimed to be preserved.","section":"Section 3.3, Eq. (2)"},{"comment":"The hit-rate threshold is set to 1.2 with no justification or sensitivity analysis, and the paper does not report sample sizes or statistical tests for any of the mean RTI comparisons; since the tables report only means and standard deviations, the reader cannot assess whether the claimed improvements over baselines are significant. At minimum, the authors should report the number of questions per dataset, per-method confidence intervals, and tests for the main comparisons.","section":"Section 4, Evaluation Metrics and Table 2"}],"minor_comments":[{"comment":"The phrase 'i.g.' should be 'i.e.' in the sentence before the updated candidate set equation.","section":"Eq. (7)"},{"comment":"The model name is inconsistent: the Introduction refers to 'ChatGPT-o1' while the rest of the paper uses 'GPT-o1'; please unify the terminology.","section":"Introduction and Section 4"},{"comment":"The paper states that 50 seed prompts were used but only 25 are shown, and the criterion for selecting the shown subset is not stated; please clarify.","section":"Appendix A"},{"comment":"The sentence describing the transfer protocol says 'the high-quality prompts that pass the evaluation are then transferred to other models,' but it is not specified how 'pass the evaluation' is defined; please specify the threshold or selection rule used.","section":"Section 4.3"}],"recommendation":"major_revision","confidential_remarks":"The inconsistency between Tables 1 and 3 is severe enough that if the authors cannot provide a protocol explanation or corrected numbers, the paper's main empirical claim would not stand. I would also ask the editor to consider whether the lack of code/artifacts and unspecified alpha and beta are acceptable for this venue; the current submission is not reproducible as written."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know up front: the POT attack idea is real, but the headline numbers do not hold together. The paper's central claim—8.3x token inflation on GPT-o1 for MathQA at 90% accuracy—is contradicted by Table 3, which reports 6.0x for the same condition under the transfer protocol described in Section 4.3. Claude and Gemini show the same pattern: 7.8x vs 5.7x, 6.1x vs 3.7x. The paper offers no explanation for these two incompatible sets of numbers. Either Table 3 reflects the true cross-model performance and the strongest claim in Table 1 is unsupported, or Table 3 is mislabeled and the transfer story is wrong. Either way, the load-bearing evidence is unstable, and no code or artifacts are provided to disambiguate it.\n\nWhat the paper does well: combining OPRO-style LLM-as-optimizer with an overthinking attack is a legitimate new application. The threat model is realistic—no external knowledge poisoning, no retrieval dependency, just a semantically natural guiding phrase injected into the prompt. The pipeline is clearly articulated, and measuring both hit rate and answer accuracy is the right instinct.\n\nWhere it falls short, in order of severity:\n\n1. The Table 1/Table 3 inconsistency above. This is not a nitpick; it directly undermines the paper's strongest claim.\n\n2. Missing experimental details. Alpha and beta in the scoring function (Eq. 2) are never given. Means are reported with standard deviations but no sample sizes. The hit-rate threshold of 1.2 appears chosen post hoc, and no statistical tests accompany any comparison.\n\n3. The closest prior work, Si et al. 2025 (Excessive Reasoning Attack), is cited but never used as a baseline. Without that comparison, the superiority claim is incomplete.\n\n4. Minor: the Jin et al. 2025 reference in the related work appears unrelated to overthinking attacks.\n\nNone of this means the idea is worthless. If the numbers are eventually reproduced, the attack would be a notable practical security finding. But as submitted, the paper is not ready for any claim of \"highest RTI across all models.\" It deserves a serious referee—I would accept it for peer review—but I would expect major revision and a request for code and data. I would not cite it in my own work until the discrepancy is resolved.\n\nBest,\n[You]","headline":"POT's attack design is sensible and practically motivated, but its headline RTI numbers are internally contradicted by its own transferability table, so the central empirical claim is currently unsupported.","tokens_in":14806,"tokens_out":2806,"would_cite":false,"duration_ms":27659,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A black-box attack that only edits the prompt inflates the reasoning-token output of frontier LLMs by up to 8.3 times while preserving answer accuracy above 90 percent.","keywords":["overthinking attack","chain-of-thought","prompt injection","black-box attack","LLM reasoning","token inflation","LLM-based optimization","adversarial prompts"],"falsifier":"Re-run the POT pipeline with the scoring model $M_s$ changed from DeepSeek-R1 to GPT-4o, and check whether the optimised prompts still produce $6.0\\times$ reasoning-token inflation on GPT-o1; if the inflation drops to the level of the un-optimised 'step-by-step' baseline, the claimed cross-model transferability is an artifact of the scorer rather than a property of the prompts.","tokens_in":13723,"feed_emoji":"🧠","tokens_out":10165,"duration_ms":84489,"temperature":0.7,"pith_summary":"This paper introduces POT, a fully black-box attack that makes state-of-the-art reasoning LLMs emit far more reasoning tokens than a clean query would trigger, while keeping the final answer unchanged. Prior overthinking attacks required poisoning external knowledge sources or successful retrieval; POT needs only a short, semantically natural guiding phrase injected into the prompt, discovered by an LLM optimizer and scored by another LLM. On MathQA, AIME 2024, and MATH-500, the resulting prompts raise reasoning-token counts by $8.3\\times$ on GPT-o1, $7.8\\times$ on Claude-Sonnet-3.7, and $7.1\\times$ on Gemini-2.5-Pro at peak, with hit rates of 81–90% and accuracy at or above 90% in most settings. If these numbers hold, POT is the first retrieval-free overthinking attack that transfers across closed-model families, and it turns prompt-only access into direct inflation of API compute cost.","feed_headline":"Adversarial prompts make LLMs think up to 8.3x longer","feed_subtitle":"A black-box prompt tweak inflates token costs on GPT-o1, Claude, and Gemini while keeping answers correct.","key_machinery":"POT's load-bearing mechanism is an LLM-based iterative optimizer built on the OPRO (optimization-by-prompting) paradigm, which evolves a pool of short guiding phrases against a scoring function $S = \\alpha \\cdot \\frac{R(M_s(u_i))}{R(M_s(x))} + \\beta \\cdot \\mathbf{1}(M_s(u_i) = M_s(x))$, where $R(\\cdot)$ counts reasoning tokens, $M_s$ is the scoring model (DeepSeek-R1), and $\\alpha,\\beta$ trade off token inflation against answer consistency. A prompt assembler $M_a$ stitches each guiding phrase into the user's question; a diversity filter, using cosine distance between averaged token embeddings, keeps the candidate pool semantically varied; and the highest-scoring prompts feed back into a meta-prompt for the next round. This closed loop turns phrases like 'examine all prior conditions and logical chains relevant to this problem' into an optimised, transferable adversarial prompt that inflates reasoning tokens on target models the optimization never saw.","core_discovery":"The central claim is that semantically natural guiding phrases, found by iterative LLM-based optimization, can reliably induce overthinking—substantially longer reasoning traces with no loss in answer correctness—on frontier reasoning models, with no access to model parameters, no external data poisoning, and no retrieval dependency. The attack, POT, assembles short covert prompts such as 'You are an experienced logician. Try to analyze the problem step by step from multiple perspectives' into the user query, scores candidate prompts by a weighted combination of reasoning-token inflation and answer consistency, and evolves the prompt pool through an OPRO-style meta-prompt. In the paper's experiments, the optimised prompts hold reasoning-token inflation of $6.1\\times$--$8.3\\times$ on MathQA, $2.6\\times$--$3.1\\times$ on AIME 2024, and $5.8\\times$--$7.1\\times$ on MATH-500 across GPT-o1, Claude-Sonnet-3.7, and Gemini-2.5-Pro, with hit rates of 81–90% and accuracy at or above 90% in most settings. The paper's point is that the model does not fail; it simply spends disproportionately more compute while staying correct, which is exactly why the attack is hard to notice.","pith_inferences":["A natural extension the paper does not run is a tail-risk analysis: the reported standard deviations are large (e.g., $11209\\pm3463$ tokens on MATH-500), and the cost to an API user is driven by the upper tail of the token distribution, not the mean.","The same optimizer loop could be aimed at other denial-of-wallet targets, such as exhausting rate limits, destroying cache hit rates, or inflating embedding and retrieval costs, without changing the framework.","A cheap robustness probe is to vary the target model's decoding temperature, system prompt, or max-tokens setting; the paper does not report whether the RTI gains survive those API-side changes, which would tell whether the attack exploits a fixed sampling configuration.","The very high transfer of DeepSeek-R1-optimized prompts to GPT-o1 ($6.0\\times$) and Claude ($5.7\\times$) is consistent with the idea that the optimizer discovers generic 'be extremely thorough' style cues rather than model-specific triggers; if so, the same prompts may also inflate reasoning tokens on future reasoning models without any re-optimization."],"forward_implications":["If POT transfers as reported, pay-per-token API providers face an attack that multiplies inference cost and latency with no visible failure: answers stay correct, so naive output checks will not flag it.","The attack forces defenses to live on the deployment side: semantic caching, difficulty-aware reasoning-token budgets, and attention dampening are the mitigations the paper lists, and all require either platform-level infrastructure or model internals that API users do not control.","Because the optimised prompts transfer across GPT-o1, Claude, and Gemini, one prompt set can attack several closed models at once, which lowers the practical cost of running the attack at scale.","POT's 81–90% hit rates with accuracy above 90% imply that covert prompt injection alone can achieve what previously required poisoned knowledge bases, meaning the threat model expands to any interface where an attacker controls even part of the user input."],"supporting_citations":[{"why":"Defines the OverThinking attack that POT improves on, and supplies the Context-Agnostic, Context-Aware, and ICL Genetic baselines used for comparison.","marker":"Kumar et al. 2025"},{"why":"Provides the OPRO optimization-by-prompting paradigm on which POT's LLM-based iterative optimizer is built.","marker":"Yang et al. 2023"},{"why":"DeepSeek-R1 is the scoring model $M_s$ used to evaluate candidate prompts during optimization.","marker":"Guo et al. 2025"},{"why":"GPT-o1 is one of the three target models on which POT's reasoning-token inflation is measured.","marker":"Wu et al. 2024"},{"why":"Claude 3.7 Sonnet is one of the target models, and the paper's reported $7.8\\times$ peak inflation applies to it.","marker":"Anthropic 2025"},{"why":"Gemini 2.5 Pro is one of the target models, completing the cross-family transferability evidence.","marker":"Comanici et al. 2025"},{"why":"MathQA is the primary benchmark where POT reaches its highest token inflation ($8.3\\times$ on GPT-o1).","marker":"Amini et al. 2019"},{"why":"MATH-500 is the hardest benchmark used, where POT still achieves up to $7.1\\times$ inflation on Claude.","marker":"Hendrycks et al. 2024"}],"fun_headline_variants":["Black-box prompts force LLMs to think 8.3x longer, still correct","Natural-sounding prompts inflate LLM reasoning tokens up to 8x","Overthinking attack: hidden prompts drain LLM compute, not accuracy","Prompt-only trick makes GPT-o1, Claude, Gemini overthink 8x","Stealthy prompts trigger 8x token waste in reasoning LLMs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole attack depends on prompts that make DeepSeek-R1 overthink also making GPT-o1, Claude, and Gemini overthink, even though the optimization never sees those target models.","fun_headline_variants_meta":{"raw":{"variants":["Black-box prompts force LLMs to think 8.3x longer, still correct","Natural-sounding prompts inflate LLM reasoning tokens up to 8x","Overthinking attack: hidden prompts drain LLM compute, not accuracy","Prompt-only trick makes GPT-o1, Claude, Gemini overthink 8x","Stealthy prompts trigger 8x token waste in reasoning LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000253,"raw_usage":{"total_tokens":1576,"prompt_tokens":965,"completion_tokens":611,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":510}},"tokens_in":581,"tokens_out":611,"duration_ms":6587,"temperature":1.0,"reasoning_tokens":510,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:07:29.095220+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the POT pipeline with the scoring model $M_s$ changed from DeepSeek-R1 to GPT-4o, and check whether the optimised prompts still produce $6.0\\times$ reasoning-token inflation on GPT-o1; if the inflation drops to the level of the un-optimised 'step-by-step' baseline, the claimed cross-model transferability is an artifact of the scorer rather than a property of the prompts.","supporting_citations":[],"review_version":2}