Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimization

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A black-box attack that only edits the prompt inflates the reasoning-token output of frontier LLMs by up to 8.3 times while preserving answer accuracy above 90 percent.

desk verdict POT's attack design is sensible and practically motivated, but its headline RTI numbers are internally contradicted by its own transferability table, so the central empirical claim is currently unsupported. read the letter →

arxiv 2508.19277 v1 pith:4OMGFVWT submitted 2025-08-23 cs.LG cs.AIcs.CR

Xinyu Li , Tianjin Huang , Ronghui Mu , Xiaowei Huang , Gaojie Jin This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords overthinkingattackchain-of-thoughtpromptinjectionblack-boxLLMreasoningtokeninflationLLM-basedoptimizationadversarialprompts
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces POT, a fully black-box attack that makes state-of-the-art reasoning LLMs emit far more reasoning tokens than a clean query would trigger, while keeping the final answer unchanged. Prior overthinking attacks required poisoning external knowledge sources or successful retrieval; POT needs only a short, semantically natural guiding phrase injected into the prompt, discovered by an LLM optimizer and scored by another LLM. On MathQA, AIME 2024, and MATH-500, the resulting prompts raise reasoning-token counts by $8.3\times$ on GPT-o1, $7.8\times$ on Claude-Sonnet-3.7, and $7.1\times$ on Gemini-2.5-Pro at peak, with hit rates of 81–90% and accuracy at or above 90% in most settings. If these numbers hold, POT is the first retrieval-free overthinking attack that transfers across closed-model families, and it turns prompt-only access into direct inflation of API compute cost.

What carries the argument

POT's load-bearing mechanism is an LLM-based iterative optimizer built on the OPRO (optimization-by-prompting) paradigm, which evolves a pool of short guiding phrases against a scoring function $S = \alpha \cdot \frac{R(M_s(u_i))}{R(M_s(x))} + \beta \cdot \mathbf{1}(M_s(u_i) = M_s(x))$, where $R(\cdot)$ counts reasoning tokens, $M_s$ is the scoring model (DeepSeek-R1), and $\alpha,\beta$ trade off token inflation against answer consistency. A prompt assembler $M_a$ stitches each guiding phrase into the user's question; a diversity filter, using cosine distance between averaged token embeddings, keeps the candidate pool semantically varied; and the highest-scoring prompts feed back into a meta-prompt for the next round. This closed loop turns phrases like 'examine all prior conditions and logical chains relevant to this problem' into an optimised, transferable adversarial prompt that inflates reasoning tokens on target models the optimization never saw.

What would settle it

Re-run the POT pipeline with the scoring model $M_s$ changed from DeepSeek-R1 to GPT-4o, and check whether the optimised prompts still produce $6.0\times$ reasoning-token inflation on GPT-o1; if the inflation drops to the level of the un-optimised 'step-by-step' baseline, the claimed cross-model transferability is an artifact of the scorer rather than a property of the prompts.

Watch

Extended reading notes

Core claim

The central claim is that semantically natural guiding phrases, found by iterative LLM-based optimization, can reliably induce overthinking—substantially longer reasoning traces with no loss in answer correctness—on frontier reasoning models, with no access to model parameters, no external data poisoning, and no retrieval dependency. The attack, POT, assembles short covert prompts such as 'You are an experienced logician. Try to analyze the problem step by step from multiple perspectives' into the user query, scores candidate prompts by a weighted combination of reasoning-token inflation and answer consistency, and evolves the prompt pool through an OPRO-style meta-prompt. In the paper's experiments, the optimised prompts hold reasoning-token inflation of $6.1\times$--$8.3\times$ on MathQA, $2.6\times$--$3.1\times$ on AIME 2024, and $5.8\times$--$7.1\times$ on MATH-500 across GPT-o1, Claude-Sonnet-3.7, and Gemini-2.5-Pro, with hit rates of 81–90% and accuracy at or above 90% in most settings. The paper's point is that the model does not fail; it simply spends disproportionately more compute while staying correct, which is exactly why the attack is hard to notice.

Load-bearing premise

The whole attack depends on prompts that make DeepSeek-R1 overthink also making GPT-o1, Claude, and Gemini overthink, even though the optimization never sees those target models.

Editorial extensions

If this is right

  • If POT transfers as reported, pay-per-token API providers face an attack that multiplies inference cost and latency with no visible failure: answers stay correct, so naive output checks will not flag it.
  • The attack forces defenses to live on the deployment side: semantic caching, difficulty-aware reasoning-token budgets, and attention dampening are the mitigations the paper lists, and all require either platform-level infrastructure or model internals that API users do not control.
  • Because the optimised prompts transfer across GPT-o1, Claude, and Gemini, one prompt set can attack several closed models at once, which lowers the practical cost of running the attack at scale.
  • POT's 81–90% hit rates with accuracy above 90% imply that covert prompt injection alone can achieve what previously required poisoned knowledge bases, meaning the threat model expands to any interface where an attacker controls even part of the user input.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not run is a tail-risk analysis: the reported standard deviations are large (e.g., $11209\pm3463$ tokens on MATH-500), and the cost to an API user is driven by the upper tail of the token distribution, not the mean.
  • The same optimizer loop could be aimed at other denial-of-wallet targets, such as exhausting rate limits, destroying cache hit rates, or inflating embedding and retrieval costs, without changing the framework.
  • A cheap robustness probe is to vary the target model's decoding temperature, system prompt, or max-tokens setting; the paper does not report whether the RTI gains survive those API-side changes, which would tell whether the attack exploits a fixed sampling configuration.
  • The very high transfer of DeepSeek-R1-optimized prompts to GPT-o1 ($6.0\times$) and Claude ($5.7\times$) is consistent with the idea that the optimizer discovers generic 'be extremely thorough' style cues rather than model-specific triggers; if so, the same prompts may also inflate reasoning tokens on future reasoning models without any re-optimization.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces POT, a black-box prompt-only overthinking attack that uses an LLM-based iterative optimizer (OPRO-style) with diversity filtering to craft semantically natural guiding phrases that inflate reasoning token counts in target LLMs while preserving answer accuracy. The framework is evaluated on MathQA, AIME 2024, and MATH-500 against three frontier reasoning APIs (GPT-o1, Claude-Sonnet-3.7, Gemini-2.5-Pro), comparing with retrieval-based and template-based baselines. The authors report that POT achieves the highest reasoning token inflation, hit rates of 81-90%, and accuracy above 90%, and they claim strong cross-model transferability of the optimized prompts.

Significance. If confirmed, POT would be the first retrieval-free, semantically natural overthinking attack with demonstrated transferability across frontier reasoning APIs, a practically important step beyond RAG-poisoning attacks such as OverThink. The framework is clearly described, the threat model is explicit, and the empirical scope (three datasets, three target models, five baselines) is substantial. However, the strength of the empirical claims is undercut by an internal inconsistency in the reported RTI values and by unspecified core hyperparameters, so the significance is conditional on those being resolved. The paper also does not release code or prompt sets, which limits reproducibility.

major comments (3)
  1. [Section 4.3, Table 3 vs Section 4.1, Table 1] For the same MathQA condition with GPT-o1, Table 1 reports POT RTI of 8.3x while Table 3 reports 6.0x; for Claude-Sonnet-3.7 the values are 7.8x vs 5.7x, and for Gemini-2.5-Pro 6.1x vs 3.7x, with the Table 3 source row reporting only 5.1x on DeepSeek-R1 yet Table 1's GPT-o1 value being 8.3x. The text does not explain any difference in selection regime, sample subset, or prompt-set definition between these tables, so the reader cannot determine which number reflects the actual transfer result; this directly undermines the headline claim of 'highest average RTI' and the transferability conclusion.
  2. [Section 3.3, Eq. (2)] The scoring function is the core selection criterion, but the hyperparameters alpha and beta are never given in the paper; without their values, the optimization procedure cannot be reproduced, and the reported behavior of the score could change qualitatively with different trade-offs. Similarly, the indicator 1(M_s(u_i) = M_s(x)) is not defined precisely (exact string match versus semantic equivalence), which matters because answer correctness is claimed to be preserved.
  3. [Section 4, Evaluation Metrics and Table 2] The hit-rate threshold is set to 1.2 with no justification or sensitivity analysis, and the paper does not report sample sizes or statistical tests for any of the mean RTI comparisons; since the tables report only means and standard deviations, the reader cannot assess whether the claimed improvements over baselines are significant. At minimum, the authors should report the number of questions per dataset, per-method confidence intervals, and tests for the main comparisons.
minor comments (4)
  1. [Eq. (7)] The phrase 'i.g.' should be 'i.e.' in the sentence before the updated candidate set equation.
  2. [Introduction and Section 4] The model name is inconsistent: the Introduction refers to 'ChatGPT-o1' while the rest of the paper uses 'GPT-o1'; please unify the terminology.
  3. [Appendix A] The paper states that 50 seed prompts were used but only 25 are shown, and the criterion for selecting the shown subset is not stated; please clarify.
  4. [Section 4.3] The sentence describing the transfer protocol says 'the high-quality prompts that pass the evaluation are then transferred to other models,' but it is not specified how 'pass the evaluation' is defined; please specify the threshold or selection rule used.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: POT's optimization objective (Eq. 2) and the headline RTI/hit-rate/accuracy results are measured on different models, so the central claims are empirical rather than derived from their inputs.

full rationale

The paper's derivation chain is empirical rather than self-referential. The optimization score in Eq. (2), S(Ms,u_i)=alpha*R(Ms(u_i))/R(Ms(x))+beta*1(Ms(u_i)=Ms(x)), is evaluated with DeepSeek-R1 as Ms ('We use DeepSeek-R1 as Ms to mark the generated candidates'), while the headline claims in Tables 1 and 2 are measured on disjoint target models (GPT-o1, Claude-Sonnet-3.7, Gemini-2.5-pro). Thus the reported RTI on target models is not the optimized score on the source model by construction; it is a genuine transfer measurement. The hit-rate threshold (1.2) and the alpha/beta weights are evaluation or objective choices, but the paper does not present any of them as a predicted quantity. The self-citations in the related work (e.g., Dong et al. 2024a,b; Jin et al. 2025) are not load-bearing premises for the attack's mechanism or for the empirical claims. The numerical discrepancy between Table 1 (8.3x/7.8x/6.1x) and Table 3 (6.0x/5.7x/3.7x) for POT on MathQA is an internal-consistency and correctness concern, not a circularity: neither number is derived from the other by definition. No step satisfies the quoted-equivalence bar for circularity.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

No new theoretical entities are introduced. The framework's free parameters (alpha, beta, threshold, temperature) are not reported, which limits reproducibility. The central claim rests on the empirical transferability of prompts from a scoring model to target models and on the observability of reasoning tokens.

free parameters (4)
  • alpha = not reported
    Weight on the token-inflation term in Eq. (2); controls the trade-off in prompt selection but its value is not given.
  • beta = not reported
    Weight on the answer-consistency term in Eq. (2); undetermined.
  • hit_rate_threshold = 1.2
    Threshold defining success in the hit-rate metric; chosen by the authors, not derived.
  • optimizer_temperature_v = not reported
    Temperature controlling candidate diversity in Eq. (5); chosen by hand and not disclosed.
assumptions (3)
  • domain assumption Semantic prompt injection can manipulate the reasoning trajectory of RLHF-trained reasoning LLMs.
    Basis of the entire attack; referenced in Section 1 and threat model (Section 3.1).
  • domain assumption Prompts optimized on DeepSeek-R1 transfer to GPT-o1, Claude 3.7, and Gemini 2.5.
    The scoring model Ms is DeepSeek-R1 (Section 4), while targets are other models; transferability is the load-bearing premise for Tables 1 and 2.
  • domain assumption Reasoning token counts are observable to the attacker through the API.
    The RTI metric in Eq. (2) requires reading R(ui) and R(x); not all APIs expose reasoning tokens.

how reviews work

0 comments
Cite this review

Pith. "Pith review of POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimization." pith.science (2026). https://pith.science/paper/4OMGFVWT

@misc{pith2026250819277,
  author       = {Pith},
  title        = {Pith review of: POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4OMGFVWT}},
  note         = {Machine review of arXiv:2508.19277}
}
read the original abstract

Recent advances in Chain-of-Thought (CoT) prompting have substantially enhanced the reasoning capabilities of large language models (LLMs), enabling sophisticated problem-solving through explicit multi-step reasoning traces. However, these enhanced reasoning processes introduce novel attack surfaces, particularly vulnerabilities to computational inefficiency through unnecessarily verbose reasoning chains that consume excessive resources without corresponding performance gains. Prior overthinking attacks typically require restrictive conditions including access to external knowledge sources for data poisoning, reliance on retrievable poisoned content, and structurally obvious templates that limit practical applicability in real-world scenarios. To address these limitations, we propose POT (Prompt-Only OverThinking), a novel black-box attack framework that employs LLM-based iterative optimization to generate covert and semantically natural adversarial prompts, eliminating dependence on external data access and model retrieval. Extensive experiments across diverse model architectures and datasets demonstrate that POT achieves superior performance compared to other methods.

Figures

Figures reproduced from arXiv: 2508.19277 by the authors.

Figure 1
Figure 1. Comparison of attack methodologies: POT versus [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The overall pipeline of POT. Our framework integrates semantic-level prompt construction, LLM-based adversarial [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. A practical example of the meta-prompt Pr, com￾posed of the attack target description, historical prompt– score pairs, and generation instructions. These elements are concatenated into a natural language input to guide the opti￾mizer LLM in generating new prompt candidates. optimizer. Drawing inspiration from the Optimization-by￾Prompting (OPRO) paradigm (Yang et al. 2023), this frame￾work leverages the language und… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Reasoning token counts across different attack strategies and models on the MathQA dataset. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: Example of Reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 12
Figure 12. Figure 12: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 15
Figure 15. Figure 15: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]
Figure 16
Figure 16. Figure 16: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p013_16.png]
Figure 17
Figure 17. Figure 17: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p013_17.png]
Figure 20
Figure 20. Figure 20: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p014_20.png]
Figure 21
Figure 21. Figure 21: Example of reasoning tokens generated by the [PITH_FULL_IMAGE:figures/full_fig_p014_21.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. OTora: A Unified Red Teaming Framework for Reasoning-Level Denial-of-Service in LLM Agents

    cs.LG 2026-05 unverdicted novelty 8.0 of 10

    OTora provides the first unified framework for reasoning-level denial-of-service attacks on LLM agents, achieving up to 10x more reasoning tokens and order-of-magnitude latency increases while preserving task accuracy...

Reference graph

Works this paper leans on

33 extracted references · 5 canonical work pages · cited by 1 Pith paper

  1. [5]

    arXiv preprint arXiv:2410.02185

    POSIX: A Prompt Sensitiv- ity Index For Large Language Models. arXiv preprint arXiv:2410.02185. Chen, M.; Tworek, J.; Jun, H.; Yuan, Q.; Pinto, H. P. D. O.; Kaplan, J.; Edwards, H.; Burda, Y .; Joseph, N.; Brockman, G.; et al

    arXiv

  2. [6]

    arXiv preprint arXiv:2107.03374

    Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374. Chen, Z.; Xiang, Z.; Xiao, C.; Song, D.; and Li, B

    arXiv

  3. [7]

    arXiv preprint arXiv:2110.14168

    Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168. Comanici, G.; Bieber, E.; Schaekermann, M.; Pasupat, I.; Sachdeva, N.; Dhillon, I.; Blistein, M.; Ram, O.; Zhang, D.; Rosen, E.; et al

    arXiv

  4. [8]

    arXiv preprint arXiv:2507.06261

    Gemini 2.5: Pushing the fron- tier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261. Dong, Y .; Mu, R.; Jin, G.; Qi, Y .; Hu, J.; Zhao, X.; Meng, J.; Ruan, W.; and Huang, X. 2024a. Position: Building Guardrails for Large Language Models Requires Systematic Design. In Internatio...

    arXiv

  5. [9]

    arXiv preprint arXiv:2501.12948

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948. Hendrycks, D.; Burns, C.; Kadavath, S.; Arora, A.; Basart, S.; Tang, E.; Song, D.; and Steinhardt, J

    arXiv

  6. [10]

    org/abs/2103.03874,

    URL https://arxiv. org/abs/2103.03874,

    arXiv

  7. [12]

    arXiv preprint arXiv:2404.03647

    Capabilities of Large Language Models in Control Engineering: A Benchmark Study on GPT-4, Claude 3 Opus, and Gemini 1.0 Ultra. arXiv preprint arXiv:2404.03647. Kojima, T.; Gu, S. S.; Reid, M.; Matsuo, Y .; and Iwasawa, Y

    arXiv

  8. [13]

    arXiv preprint arXiv:2104.08691

    The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:2104.08691. Li, Q.; Yang, X.; Zuo, W.; and Guo, Y

    arXiv

Show all 33 references
  1. [14]

    arXiv preprint arXiv:2410.11317

    Decipher- ing the chaos: Enhancing jailbreak attacks via adversarial prompt translation. arXiv preprint arXiv:2410.11317. Li, Y .; Li, X.; Wu, H.; Zhang, Y .; Xu, F.; Cheng, X.; and Zhong, S

    arXiv

  2. [15]

    arXiv preprint arXiv:2507.16773

    When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs. arXiv preprint arXiv:2507.16773. Lightman, H.; Kosaraju, V .; Burda, Y .; Edwards, H.; Baker, B.; Lee, T.; Leike, J.; Schulman, J.; Sutskever, I.; and Cobbe, K

    arXiv

  3. [17]

    arXiv preprint arXiv:2503.06254

    Poisoned-MRAG: Knowledge Poison- ing Attacks to Multimodal Retrieval Augmented Genera- tion. arXiv preprint arXiv:2503.06254. Ma, R.; Wang, X.; Zhou, X.; Li, J.; Du, N.; Gui, T.; Zhang, Q.; and Huang, X

    arXiv

  4. [18]

    McHugh, J.; ˇSekrst, K.; and Cefalu, J

    Are large language models good prompt optimizers? arXiv preprint arXiv:2402.02101. McHugh, J.; ˇSekrst, K.; and Cefalu, J

    arXiv

  5. [19]

    arXiv preprint arXiv:2507.13169

    Prompt Injection 2.0: Hybrid AI Threats. arXiv preprint arXiv:2507.13169. OpenAI

    arXiv

  6. [20]

    https://openai

    GPT-4o Technical Overview. https://openai. com/index/gpt-4o. Accessed: 2025-07-26. Ouyang, L.; Wu, J.; Jiang, X.; Almeida, D.; Wainwright, C.; Mishkin, P.; Zhang, C.; Agarwal, S.; Slama, K.; Ray, A.; et al

    2025

  7. [21]

    arXiv preprint arXiv:2505.04806

    Red teaming the mind of the machine: A systematic evaluation of prompt injection and jailbreak vulnerabilities in llms. arXiv preprint arXiv:2505.04806. Perez, E.; Ringer, S.; Lukosiute, K.; Nguyen, K.; Chen, E.; Heiner, S.; Pettit, C.; Olsson, C.; Kundu, S.; Kadavath, S.; et al

    arXiv

  8. [22]

    In Findings of the Association for Computational Linguistics: ACL 2023, 13387–13434

    Discovering language model behaviors with model-written evaluations. In Findings of the Association for Computational Linguistics: ACL 2023, 13387–13434. Rababah, B.; Wu, S. T.; Kwiatkowski, M.; Leung, C. K.; and Akcora, C. G

    2023

  9. [23]

    In 2024 IEEE International Conference on Big Data (BigData), 5392–5401

    SoK: prompt hacking of large language models. In 2024 IEEE International Conference on Big Data (BigData), 5392–5401. IEEE. Radford, A.; Wu, J.; Child, R.; Luan, D.; Amodei, D.; Sutskever, I.; et al

    2024

  10. [24]

    arXiv preprint arXiv:2506.06971

    Break-The-Chain: Reasoning Failures in LLMs via Ad- versarial Prompting in Code Generation. arXiv preprint arXiv:2506.06971. Sanh, V .; Webson, A.; Raffel, C.; Bach, S. H.; Sutawika, L.; Alyafeai, Z.; Chaffin, A.; Stiegler, A.; Scao, T. L.; Raja, A.; et al

    arXiv

  11. [25]

    arXiv preprint arXiv:2110.08207

    Multitask prompted training enables zero-shot task generalization. arXiv preprint arXiv:2110.08207. Shao, Y .; Lin, X.; Luo, H.; Hou, C.; Xiong, G.; Yu, J.; and Shi, J

    arXiv

  12. [26]

    arXiv preprint arXiv:2505.06579

    POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Mod- els. arXiv preprint arXiv:2505.06579. Si, W. M.; Li, M.; Backes, M.; and Zhang, Y

    arXiv

  13. [27]

    arXiv preprint arXiv:2506.14374

    Exces- sive Reasoning Attack on Reasoning LLMs. arXiv preprint arXiv:2506.14374. Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, Ł.; and Polosukhin, I

    arXiv

  14. [28]

    arXiv preprint arXiv:2109.01652

    Finetuned language models are zero-shot learners. arXiv preprint arXiv:2109.01652. Wei, J.; Wang, X.; Schuurmans, D.; Bosma, M.; Xia, F.; Chi, E.; Le, Q. V .; Zhou, D.; et al

    arXiv

  15. [29]

    arXiv preprint arXiv:2410.13639

    A comparative study on reasoning patterns of OpenAI’s o1 model. arXiv preprint arXiv:2410.13639. Yang, C.; Wang, X.; Lu, Y .; Liu, H.; Le, Q. V .; Zhou, D.; and Chen, X

    arXiv

  16. [30]

    arXiv preprint arXiv:2309.03409

    Large language models as optimizers. arXiv preprint arXiv:2309.03409. Yi, S.; Liu, Y .; Sun, Z.; Cong, T.; He, X.; Song, J.; Xu, K.; and Li, Q

    arXiv

  17. [31]

    arXiv preprint arXiv:2407.04295

    Jailbreak attacks and defenses against large language models: A survey. arXiv preprint arXiv:2407.04295. Zhang, B.; Chen, Y .; Fang, M.; Liu, Z.; Nie, L.; Li, T.; and Liu, Z

    arXiv

  18. [32]

    arXiv preprint arXiv:2504.03957

    Practical poisoning attacks against retrieval- augmented generation. arXiv preprint arXiv:2504.03957. Zou, A.; Wang, Z.; Carlini, N.; Nasr, M.; Kolter, J. Z.; and Fredrikson, M

  19. [33]

    arXiv preprint arXiv:2307.15043

    Universal and transferable adver- sarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. A. Seed Prompt Set Used for Prompt-Only Attacks Figure 5: Example full set of 25 seed guiding phrases z1∼ z25 generated by the prompt generator Mg (instantiated as GPT...

    2024 arXiv

  20. [2019]

    arXiv preprint arXiv:1905.13319

    Mathqa: Towards inter- pretable math word problem solving with operation-based formalisms. arXiv preprint arXiv:1905.13319. Anthropic

    1905 arXiv

  21. [2021]

    arXiv preprint arXiv:2112.00861

    A general language assistant as a laboratory for alignment. arXiv preprint arXiv:2112.00861. Berezin, S.; Farahbakhsh, R.; and Crespi, N

    arXiv

  22. [2022]

    Kan, B.; Wang, T.; Lu, W.; Zhen, X.; Guan, W.; and Zheng, F

    Maieutic prompting: Logi- cally consistent reasoning with recursive explanations.arXiv preprint arXiv:2205.11822. Kan, B.; Wang, T.; Lu, W.; Zhen, X.; Guan, W.; and Zheng, F

    arXiv

  23. [2023]

    arXiv preprint arXiv:2305.13860

    Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860. Liu, Y .; Yuan, Z.; Tie, G.; Shi, J.; Zhou, P.; Sun, L.; and Gong, N. Z

    arXiv

  24. [2024]

    https://www

    Claude 3 Technical Report. https://www. anthropic.com/index/claude-3. Accessed: 2025-07-26. Anthropic

    2025

  25. [2025]

    arXiv preprint arXiv:2501.18626

    The TIP of the Iceberg: Revealing a Hidden Class of Task- in-Prompt Adversarial Attacks on LLMs. arXiv preprint arXiv:2501.18626. Brown, T.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J. D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.