Pith. sign in

REVIEW 4 major objections 4 minor 2 cited by

Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Simple standalone arithmetic tasks can trigger the 'thinking-stopped' vulnerability in DeepSeek-R1, and an adaptive token-compression framework cuts attack prompts to about 60 percent of their original length while preserving attack…

desk verdict A useful empirical finding about DeepSeek-R1's empty-response failure, with an overclaimed practical-attack framing and an untested p||Ap simplification that needs addressing. read the letter →

arxiv 2504.20493 v1 pith:HVKMI5QG submitted 2025-04-29 cs.CR cs.AI

Yu Cui , Yujun Cai , Yiwei Wang This is my paper · ORCID
classification cs.CRcs.AI
keywords promptinjectionattackReasoningInterruptionDeepSeek-R1thinking-stoppedvulnerabilityadaptivetokencompressionchain-of-thoughtoutputprefixLLMsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to make a known failure mode of DeepSeek-R1 practical: when the model's own reasoning tokens are fed back to it as a prompt, the model can stop thinking and return an empty response. The authors claim that simple standalone arithmetic tasks, such as a single subtraction problem, trigger this 'thinking-stopped' vulnerability about as well as the long mathematical word problems used previously, while being far shorter and easier to generate. They formalize the attack as the Reasoning Interruption Attack, contribute a search procedure that collects attack prompts in about 1.25 API calls on average, and propose an adaptive token-compression framework that reduces prompt length to roughly 60 percent of the original without losing attack effectiveness. If correct, an attacker can disable a reasoning-LLM application with a few thousand tokens instead of more than five thousand, and the cost of probing and defending the vulnerability drops sharply. The paper also points to a mechanism: compressed reasoning prompts can make the model emit its end-of-thinking boundary token prematurely, ending the reasoning phase before any final answer exists.

What carries the argument

The carrying mechanism is a self-referential loop: reasoning tokens sampled from DeepSeek-R1's own chain-of-thought, when placed back into the prompt, push the model to emit the boundary token <|end_of_thinking|> before a substantive answer is ready, and the generation then terminates with empty content. The paper's named object is the Reasoning Interruption Attack, a prompt-injection attack defined as an attack prompt $A_p$ appended to a normal prompt $p$ that interferes with the reasoning process so the target task fails; because the attack prompt dominates in length, the paper treats $p \| A_p$ and $A_p$ as nearly equivalent. Two named techniques carry the engineering side: a seed-prompt search algorithm that regenerates random arithmetic operands until a replay of the reasoning tokens produces an empty response (average 1.25 search calls per prompt), and an adaptive token-compression framework in which a system-prompted LLM (DeepSeek-V3 works best in their tests) shortens each reasoning trace while preserving trigger elements such as self-reflection, self-verification, and loop-ending result indicators. The output-prefix experiments isolate the mechanism by putting the attack prompt in the assistant prefix, which exposes the special token in otherwise non-empty outputs.

What would settle it

Log the model's raw token sequence during a successful attack and check whether <|end_of_thinking|> is actually sampled before the response becomes empty; if empty responses occur without that token appearing, or if forcing the model to suppress it with a logit bias leaves the empty responses unchanged, the premature-emergence explanation is wrong. A complementary check: run the same standalone arithmetic problems directly on DeepSeek-R1 without first feeding back prior reasoning tokens; if empty responses appear under ordinary arithmetic questions, then the trigger condition is not specific to reasoning-token feedback.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that the 'thinking-stopped' vulnerability is not a quirk of long, narratively complex word problems: standalone arithmetic with a single operation and large random numbers reliably produces reasoning tokens that, when replayed as input, interrupt DeepSeek-R1's inference and yield an empty response. Building on that, the authors define the Reasoning Interruption Attack, in which an adversarial prompt composed of the model's own reasoning tokens is appended to a normal request so the integrated application fails to deliver any final result. The load-bearing empirical results are the compression rates: across addition, subtraction, multiplication, and division datasets, the adaptive LLM-based compression framework brings average prompt length to about 60 percent of the original, and for the subtraction dataset a 56.3 percent compressed prompt still achieves 65.33 percent attack success rate. In the strongest variant, placing the attack prompt in both the user message and the output prefix raises success to 100 percent on addition and subtraction prompts. The paper additionally argues that the underlying cause is semantic, not quantitative: attack prompts induce premature appearance of the special token <|end_of_thinking|>, so the model believes its chain-of-thought phase has ended, generates only a summary-like answer, and then has no content left to emit as the final answer.

Load-bearing premise

The load-bearing premise is the paper's own unverified inference that the special token observed in output-prefix attacks is the same <|end_of_thinking|> token used internally to end the chain-of-thought phase, and that its premature emergence is what causes the empty response; the authors say only that they 'infer' and 'speculate' this, so if the token identity or causal role is wrong, the proposed explanation fails even though the empirical attack may still work.

Editorial extensions

If this is right

  • Downstream applications that pass user content directly to DeepSeek-R1 acquire a denial-of-service risk: an attacker can reliably force empty answers with a few thousand tokens rather than the five-thousand-token word problems used before.
  • Because prompts can be compressed to about 60 percent of their original length by an automated LLM step, the per-attack cost drops and the attack becomes harder to flag by perplexity-based detectors that penalize very long, unusual prompts.
  • The output-prefix variant that places the attack prompt in both the user message and the assistant prefix raises the attack success rate to 100 percent on the addition and subtraction datasets, so the method is not limited to a single injection position.
  • The success of compression on subtraction prompts, where the attack success rate rises to 65.33 percent after compression, supports the paper's claim that the trigger is semantic structure inside the reasoning tokens, not raw token count.
  • A minimal defense is suggested by Approach 1: padding the output prefix with a single space restores normal responses for the user-prompt-only variant, giving application builders a cheap mitigation to test.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference beyond the paper: any reasoning model trained with an explicit boundary token separating its thinking phase from its answer may exhibit the same premature-termination failure, so the attack recipe (replay the model's own reasoning tokens, then look for early boundary emission) is worth testing on other R1-style models.
  • Inference beyond the paper: since feeding the attack prompt in two positions (user and prefix) sharply increases success, an adversarial agent could chain the attack by repeatedly re-injecting the model's own output, potentially escalating the empty-response rate further.
  • Inference beyond the paper: the observation that GPT-4o sometimes returned the original prompt instead of a compression suggests compression quality is a model capability rather than a fixed property of the task, so a purpose-built small compressor may push prompt length well below the 60 percent reported here.
  • Inference beyond the paper: the paper's definition treats injected instructions and injected data equivalently because of the length dominance of the attack prompt; a natural extension would be to test whether much shorter attack prompts with specifically curated trigger phrases also dominate, which would test the claimed semantic-cause explanation directly.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a token-efficient prompt injection attack against DeepSeek-R1, called the Reasoning Interruption Attack. It claims that simple standalone arithmetic tasks can trigger a 'thinking-stopped' vulnerability in which the model returns an empty response, and it introduces an adaptive token compression framework that reduces attack prompt length to about 60% of the original while maintaining attack effectiveness. The paper also studies output-prefix-based variants, reports attack success rates across five datasets, evaluates several compression LLMs, and offers a speculative root-cause explanation involving premature emergence of the <|end_of_thinking|> token.

Significance. The empirical core is new and useful: the paper demonstrates that simple arithmetic prompts, not only complex word problems, can trigger empty responses, and it does so with a systematic acquisition algorithm requiring only about 1.25 search attempts on average. The token compression framework is a practical step toward making such attacks cheaper to study. The output-prefix experiments are also interesting, particularly the observation that adding a single space to the output prefix changes behavior dramatically. However, the paper's central practical claim rests on an untested simplification from p||Ap to Ap, and the claim that compression 'maintains effective attack capabilities' is contradicted by the large ASR drops for multiplication and division. The root-cause explanation is explicitly speculative. These issues do not invalidate the attack discovery, but they require additional experiments and more careful claims before the paper's main conclusions are fully supported.

major comments (4)
  1. [Section 3.2] The simplification from p||Ap to Ap is unsupported. All experiments (Algorithm 1, Figures 5-7) feed Ap alone as the user message and never append Ap to a realistic benign prompt p. The paper justifies this by saying Ap contains far more tokens than p, but token-count dominance does not imply behavioral equivalence; indeed, Approach 1 in Figure 7 shows that even a single space in the output prefix converts empty responses into normal responses, demonstrating high sensitivity to small context changes. Please provide experiments with representative benign prompts p of varying lengths and tasks, or explicitly restrict the attack claim to the standalone setting rather than the application setting defined in Section 3.2.
  2. [Section 5.2, Figure 6] The abstract and Section 3.4 claim that the compression framework 'maintains effective attack capabilities' or even 'preserving or improving attack effectiveness,' but the results contradict this for two of the four arithmetic types. For multiplication, original ASR is 61.33% and compressed ASR is 33.33%; for division, original ASR is 41.33% and compressed ASR is 18.67% (DeepSeek-R1). These are large drops, not 'maintaining' effectiveness. The claim should be qualified by dataset type, and the differential behavior should be investigated or clearly acknowledged as a limitation rather than presented as a uniformly successful compression result.
  3. [Section 6.2] The root-cause explanation is built on an unverified inference. The text states that 'we infer' the special token is <|end_of_thinking|> and 'we speculate' that its premature emergence causes the empty response. Yet the abstract and conclusion present this mechanism as the underlying cause of the vulnerability and as a contribution for improving security. Please either verify the token identity and causal role (e.g., with ablation, logprobs, or controlled manipulation of generated tokens) or explicitly label the mechanism as a hypothesis and separate it from the empirical attack findings, so readers can distinguish established results from conjecture.
  4. [Appendix A] The compression method example is not usable as given: the provided pair M and N appears identical in the manuscript, so the in-context demonstration cannot teach the compression model what content to remove or how to shorten the prompt. This makes the compression framework unreproducible as specified. Please provide the actual compressed output N and describe the edits made, or if the example is identical by design, explain how it teaches compression.
minor comments (4)
  1. [Section 4.1] There is a duplicated word: 'from from GSM-Ranges' should be 'from GSM-Ranges'.
  2. [Throughout] Several display names have inconsistent spacing: 'V olcano' should be 'Volcano', and 'Moonshot -v1-32k' should be 'Moonshot-v1-32k'.
  3. [Section 5.1] The phrase '1.25 search on average' should be '1.25 search attempts on average' or '1.25 API calls on average' for clarity.
  4. [Section 5.2, Figure 6] The ASR plots would benefit from error bars or at least a statement about variance across the 25 prompts and three trials, since the number of samples is modest and the differences are not all large.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: the attack and compression results are new empirical measurements; self-citations are used for context and interpretation but are not load-bearing.

full rationale

The derivation chain is not circular. The paper's main contributions—simple arithmetic triggers (Algorithm 1, Table 1, Figures 5-7) and adaptive token compression (Section 3.4, Figure 5, Table 2)—are measured against the external DeepSeek-R1 API and a GSM-Ranges baseline. The attack prompt dataset is built by an explicit search that checks for empty responses, and the reported ASR is then re-measured with lambda=3; no fitted parameter is renamed as a prediction. The self-citations to Cui et al. (2025) are used to motivate the existence of the thinking-stopped vulnerability and to interpret compression criteria ('core reasoning elements...loop ending result indicators (Cui et al., 2025)'), but the paper independently re-derives the triggering behavior with its own search algorithm. Section 3.2's simplification of p||Ap to Ap is an empirical assumption about token-count dominance, not a definitional equivalence; if p||Ap behaves differently for representative p, that undermines practical applicability but does not make the reported measurements circular. Section 6.2's root-cause account is explicitly flagged as inference and speculation ('we infer', 'we speculate'), so it is not used as a premise to derive the attack. No equation reduces a predicted quantity to an input by construction; CR and ASR are definitions (Eqs. 1-2), not fitted results. The main risk is external validity (Ap-only experiments and untested p||Ap equivalence), which belongs under correctness risk rather than circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper has no fitted model parameters in the mathematical sense, but it depends on several hand-chosen numbers: the random operand range, the compression ratio target, the retry limit, and the number of attack trials. The core empirical attack also assumes specific API behaviors and an unverified identity for the special token.

free parameters (4)
  • random number interval bounds p1 and p2
    Algorithm 1 samples operands from [p1, p2] for seed prompts, but the actual values are never reported; the result depends on this hand-chosen range.
  • compression target ratio 70 percent = 70%
    The system prompt in Appendix A instructs the compressor LLM to reduce token length to about 70 percent of the original; this hand-set target determines the final token budget.
  • retry limit K = 4 = 4
    Prompts that fail token-length verification are recompressed up to four times before the original is kept; this affects which prompts enter the final dataset.
  • trials per prompt lambda = 3 = 3
    ASR is computed from three attack trials per prompt; with 25 prompts per dataset this yields coarse estimates with no confidence intervals.
assumptions (4)
  • domain assumption DeepSeek-R1 API returns reasoning tokens and final answer tokens in a separable, reproducible form that can be fed back as a user prompt.
    Algorithm 1 and all experiments rely on this; the paper does not validate that the extraction is stable across API versions.
  • domain assumption The tokenizer from DeepSeek API documentation measures the actual cost of prompts.
    Section 3.4 states token consumption is calculated with this tokenizer; if the API charges or truncates differently, the compression rate figures change.
  • domain assumption The GSM-Ranges level 6 word problems are a valid baseline for the prior attack method.
    Section 4.1 uses 25 such problems to construct the baseline dataset but does not justify why level 6 is representative of the prior method.
  • ad hoc to paper The special token observed in output-prefix attacks is the same <|end_of_thinking|> token that ends normal CoT generation.
    Section 6.2 infers this from the cold-start phase of R1's training, but the token identity is not verified directly; the root-cause analysis depends on it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression." pith.science (2026). https://pith.science/paper/HVKMI5QG

@misc{pith2026250420493,
  author       = {Pith},
  title        = {Pith review of: Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HVKMI5QG}},
  note         = {Machine review of arXiv:2504.20493}
}
read the original abstract

While reasoning large language models (LLMs) demonstrate remarkable performance across various tasks, they also contain notable security vulnerabilities. Recent research has uncovered a "thinking-stopped" vulnerability in DeepSeek-R1, where model-generated reasoning tokens can forcibly interrupt the inference process, resulting in empty responses that compromise LLM-integrated applications. However, existing methods triggering this vulnerability require complex mathematical word problems with long prompts--even exceeding 5,000 tokens. To reduce the token cost and formally define this vulnerability, we propose a novel prompt injection attack named "Reasoning Interruption Attack", based on adaptive token compression. We demonstrate that simple standalone arithmetic tasks can effectively trigger this vulnerability, and the prompts based on such tasks exhibit simpler logical structures than mathematical word problems. We develop a systematic approach to efficiently collect attack prompts and an adaptive token compression framework that utilizes LLMs to automatically compress these prompts. Experiments show our compression framework significantly reduces prompt length while maintaining effective attack capabilities. We further investigate the attack's performance via output prefix and analyze the underlying causes of the vulnerability, providing valuable insights for improving security in reasoning LLMs.

Figures

Figures reproduced from arXiv: 2504.20493 by the authors.

Figure 1
Figure 1. An example of prompt injection attack based [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comprehensive comparison between our token-efficient prompt injection attack approach based on [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of adaptive token compression framework. 3.3 Prompt Dataset Construction Compared to mathematical word problems, stan￾dalone arithmetic tasks are considerably easier to construct. This characteristic is particularly valu￾able for our research as it facilitates the bulk gener￾ation of attack samples. Based on this advantage, we designed a method to systematically acquire attack prompts using these arithmetic… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The reasoning interruption attack approaches based on chat prefix completion. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Token compression result of the attack prompts. 5.2 Effect of Token Compression on Attacks In [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Evaluation on attack success rate of prompt injection attacks against DeepSeek-R1. We additionally [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Performance of reasoning interruption attack [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Analysis of the root causes of thinking-stopped vulnerability in DeepSeek-R1. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Evaluation on special token trigger rate under [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Practical Reasoning Interruption Attacks on Reasoning Large Language Models

    cs.CR 2025-05 conditional novelty 6.0 of 10

    A tiny prompt can force DeepSeek-R1's reasoning content to overflow into the final answer, yielding a practical denial-of-service attack and a new jailbreak route.

  2. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

Reference graph

Works this paper leans on

19 extracted references · 18 canonical work pages · cited by 2 Pith papers

  1. [1]

    **Align the numbers by place value:** “‘ 96,445,680 - 06,195,974 “‘

    work page

  2. [2]

    **Subtract each digit from right to left, borrowing when necessary:** - **Units place:** 0 - 4 (borrow 1) → 10 - 4 = 6 - **Tens place:** 8 - 7 = 0 (after borrowing) - **Hundreds place:** 6 - 9 (borrow 1) → 16 - 9 = 7 - **Thousands place:** 5 - 5 (borrow 1) → 14 - 5 = 9 - **Ten-thousands place:** 4 - 9 (borrow 1) → 13 - 9 = 4 - **Hundred-thousands place:**...

    work page

  3. [3]

    **Compile the result:** - Ten-millions: 9 - Millions: 0 - Hundred-thousands: 2 - Ten-thousands: 4 - Thousands: 9 - Hundreds: 7 - Tens: 0 - Units: 6

    work page

  4. [4]

    Thus, the result of the subtraction is 90249706

    **Verification by addition:** - Adding the result 90,249,706 to the subtrahend 6,195,974 gives back the original minuend 96,445,680. Thus, the result of the subtraction is 90249706 . **Final Answer** 90249706 14 Answer 2 <|end_of_thinking|> To subtract 2,487,809 from 49,258,386, we align the numbers vertically and perform the subtraction step by step... S...

    work page

  5. [5]

    Borrow 1 from the hundred thousands place (2 becomes 1), making it 15 - 8 = 7

    **Ten thousands place**: 5 - 8. Borrow 1 from the hundred thousands place (2 becomes 1), making it 15 - 8 = 7

    work page

  6. [6]

    Borrow 1 from the tens place (8 becomes 7), making it 16 - 9 = 7

    **Ones place**: 6 - 9. Borrow 1 from the tens place (8 becomes 7), making it 16 - 9 = 7

    work page

  7. [7]

    **Tens place**: 7 - 0 = 7

    work page

  8. [8]

    Borrow 1 from the thousands place (8 becomes 7), making it 13 - 8 = 5

    **Hundreds place**: 3 - 8. Borrow 1 from the thousands place (8 becomes 7), making it 13 - 8 = 5

    work page

Show all 19 references
  1. [9]

    **Thousands place**: 7 - 7 = 0

  2. [11]

    Borrow 1 from the millions place (9 becomes 8), making it 11 - 4 = 7

    **Hundred thousands place**: 1 - 4. Borrow 1 from the millions place (9 becomes 8), making it 11 - 4 = 7

  3. [12]

    **Millions place**: 8 - 2 = 6

  4. [13]

    Combining these results, we get the final answer: 46,770,577

    **Ten millions place**: 4 remains. Combining these results, we get the final answer: 46,770,577. To verify, we add the result to the subtrahend to check if we get the minuend: 46, 770, 577 + 2, 487, 809 = 49 , 258, 386 The verification confirms the result is correct. 46770577 ...

  5. [14]

    Fifth digit from the right in the second number is 8 in the ten thousands place

    Next, multiply 67,065,237 by 8 (ten thousands place). Fifth digit from the right in the second number is 8 in the ten thousands place. So multiply by 8 and shift four places left (multiply by 10,000), adding four zeros... Wait, maybe this is getting too convoluted. Let’s use c...

  6. [15]

    **Break down both numbers into smaller components:** - 27, 200, 932 = 27 , 000, 000 + 200, 000 + 932 - 6, 315, 165 = 6 , 000, 000 + 315, 000 + 165

  7. [16]

    **Multiply each component using the distributive property:** - Calculate each term separately and then sum them up

  8. [17]

    **Detailed multiplication and summation:**

  9. [18]

    **Sum all the results:** - 162, 000, 000, 000, 000 + 8 , 505, 000, 000, 000 + 4 , 455, 000, 000 + 1 , 200, 000, 000, 000 + 63 , 000, 000, 000 + 33, 000, 000 + 5, 592, 000, 000 + 293, 580, 000 + 153, 780

  10. [19]

    **Final summation:** - Adding all these components step-by-step results in the final product. After verifying through multiple methods and ensuring accuracy, the final product is: 171778373733780 17 C Anomalous Compression Example of Anomalous Compression P={Okay, so I need to...

  11. [2025]

    she wrote 8835845 articles on Monday

    From system 1 to system 2: A survey of reasoning large language models. arXiv preprint arXiv:2502.17419. Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024a. Automatic and univer- sal prompt injection attacks against large language models. arXiv preprint...

    2025 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.