Pith. sign in

REVIEW 5 major objections 6 minor 48 references

BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit

T0 review · 5 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Repeated trigger words can force AI reasoning models to produce 2-5x longer chains of thought while keeping answers correct.

desk verdict A genuinely new tunable backdoor for reasoning models with a clean held-out extrapolation result, but the 'precisely controlled' claim outruns the lack of teacher-compliance verification. read the letter →

arxiv 2507.18305 v1 pith:KYQPB2O4 submitted 2025-07-24 cs.CL

Biao Yi , Zekun Fei , Jianing Geng , Tong Li , Lihai Nie , Zheli Liu , Yiming Li This is my paper · ORCID
classification cs.CL
keywords backdoorattacklargereasoningmodelschain-of-thoughtdatapoisoningdenial-of-serviceoverthinkingtunabletriggerverbosity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a data-poisoning attack can plant a tunable 'overthinking backdoor' into large reasoning models: repeating a short trigger word a set number of times forces the model to produce a proportionally longer chain of thought while still giving the correct final answer. The attack works by fine-tuning on a small poisoned set in which each trigger repetition count is paired with a reasoning trace containing the same number of deliberately injected redundant refinement steps, generated by a teacher model. If the claim holds, backdoor attacks on reasoning models cease to be on/off switches and become continuously controllable dials over compute consumption, which matters because these models already spend thousands of tokens on internal reasoning and are often deployed in pay-per-token services. The paper's experiments across several reasoning models report 2-4x longer reasoning at one trigger repetition, 3-5x at two, preservation of answer accuracy, and generalization to repetition counts never seen in training.

What carries the argument

The mechanism is a count-to-verbosity pairing. A repetitive trigger encodes an integer strength S by the number of times a keyword is appended to the prompt, and a teacher model generates matching chain-of-thought traces containing exactly S extra 'refinement steps' (redundant verification segments starting with phrases like 'Let's double-check' or 'To be more thorough') inserted into an otherwise correct reasoning path. Supervised fine-tuning on a mixed dataset then teaches the model a relative mapping: trigger repetition count S becomes a dial for the number of extra reasoning steps, so the length of the model's internal thought block scales with S even for values not present in training.

What would settle it

Inspect every poisoned training sample produced by the teacher model and count the refinement-step phrases (e.g., 'Let's double-check', 'To be more thorough') in each CoT. If a substantial fraction of the S=1 samples contain more than one such phrase, or the S=2 samples contain fewer than two, or any samples end with a wrong final answer, the claimed exact mapping from trigger repetitions to reasoning length is not what the model learns, and the 2-4x/3-5x length ratios would not be attributable to the intended mechanism.

Watch

Extended reading notes

Core claim

The central discovery is a method for turning a chain-of-thought model's tendency to overthink into a precisely controllable attack surface. The trigger is a low-frequency word repeated S times, so the repetition count itself carries the attack intensity. For each strength S, an instruction to a teacher model produces a reasoning trace that starts from a correct solution and embeds exactly S redundant refinement steps, such as 'Let's double-check' or 'To be more thorough' segments, while ending with the correct answer. Training on a mixture of clean samples and these poisoned pairs teaches the model to associate zero repetitions with normal output, one repetition with one extra reasoning step, and two repetitions with two extra steps. The paper shows that this yields CoT output lengths of 2-4x the clean baseline at S=1 and 3-5x at S=2, with accuracy mostly unchanged; the behavior also resists system prompts asking for concise answers, survives a round of clean fine-tuning, and extrapolates to the unseen strength S=4.

Load-bearing premise

The whole tunable mapping rests on the teacher language model reliably generating poisoned chain-of-thought responses that contain exactly the requested number of distinct refinement steps and still end with the correct answer; the paper reports no quality check of this generated data, so if the teacher inserts too many, too few, or incorrect steps, the learned repetition-to-verbosity mapping would be corrupted.

Editorial extensions

If this is right

  • An attacker who controls a released model can force any deployed service to spend 2-5x more compute on triggered queries, turning a supply-chain backdoor into a denial-of-service tool.
  • Because the final answers remain correct, standard accuracy-based audits will not surface the backdoor; detection requires monitoring reasoning length or compute per query.
  • The attack gives the adversary a continuous intensity dial, so the same poisoned model can be used for subtle latency nudges or full service exhaustion, without any retraining.
  • Prompt-based 'answer concisely' instructions and fine-tuning on additional clean data do not remove the triggered overthinking, so existing lightweight defenses are insufficient.
  • The model generalizes to trigger strengths it never saw (S=4 after training on S=1,2,3), suggesting the learned mapping is continuous rather than a lookup table, which may allow even larger amplification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • This count-to-behavior pairing is not specific to reasoning length: the same poison data recipe could plausibly control other continuous behaviors such as number of tool calls, verbosity of explanations, or number of self-checks, so the attack class may be broader than the paper's experiments show.
  • The paper never verifies that the teacher model actually inserts exactly S refinement steps in every poisoned sample; if the teacher's step counts are noisy, the clean 2-4x/3-5x ratios may partly reflect distribution-level statistics rather than a per-sample exact mapping.
  • Because only 100 clean plus 200 poisoned samples were used, a natural next experiment would test how the mapping degrades as the poison set shrinks toward the 20-sample threshold the paper reports, and whether other fine-tuning methods preserve the behavior.
  • The reported accuracy gains on some setups (up to +34%) are unexpected for an attack paper; if they replicate, the 'backdoor' could also be framed as a way to selectively buy accuracy through extra reasoning, which would change how defenders weigh the threat.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The manuscript introduces 'overthinking backdoors' against large reasoning models (LRMs). The trigger is a keyword repeated S times, and the poisoned training data are generated by a teacher LLM instructed to produce chain-of-thought responses containing exactly S redundant refinement steps on top of a correct reasoning path. The authors fine-tune five LRMs (DeepSeek-R1 7B/14B/32B, Marco-o1, QwQ-32B) with LoRA on a mix of clean and poisoned samples and report that S=1 and S=2 trigger repetitions increase average output token counts by roughly 2-4x and 3-5x, respectively, while accuracy is not degraded. They also report generalization to an unseen strength S=4 and resistance to prompt-based and fine-tuning-based defenses. The paper claims precise, tunable control of reasoning verbosity as a resource-exhaustion attack.

Significance. The core effect is large and consistent across five models and three datasets, and the held-out extrapolation to S=4 is a meaningful test of the claimed learned mapping. The attack concept is novel relative to binary backdoors and to inference-time denial-of-service attacks, and the authors release their code. However, the headline quantitative claims rest on a single, unseeded 100-sample evaluation and on an unverified teacher data-generation step; the paper currently establishes a monotonic effect more firmly than the claimed precise control.

major comments (5)
  1. [Section 4 and Section 5.1] Section 4 ('Controllable Verbose CoT Generation') instructs the teacher LLM to embed exactly S refinement steps, but the manuscript reports no compliance rate, manual annotation, or automated parse of the generated poisoned CoTs, and no check that final answers remain correct. Since the tunability claim depends on the student learning a precise S-to-step mapping, the absence of this audit is a load-bearing gap. Please report per-strength compliance statistics and correctness rates for the teacher outputs, or otherwise measure step counts.
  2. [Section 5.1 and Section 5.2] All conclusions are based on one random selection of 100 test samples per dataset, with no seed, no repeated trials, and no error bars. Token-length ratios and accuracy differences (e.g., the ±5% accuracy-preservation claim) cannot be assessed for variance; a single small sample also makes the Math-500/Cot-Flan accuracy gains difficult to interpret. Please provide multiple random seeds or confidence intervals, and specify the sampling procedure.
  3. [Section 5.2] The stated ranges '[2,4] times' and '[3,5] times' are not consistent with Table 1. For Cot-Flan, S=2 ratios against the clean baseline are approximately 5.4x (R1-7B), 5.4x (R1-14B), 5.6x (R1-32B), 5.6x (Marco-o1), and 5.6x (QwQ), all above 5; for QwQ-32B GSM8K the S=2 ratio is 2.99x. Please correct the reported bounds or qualify them as typical values with the outliers noted.
  4. [Table 1 and Section 5.2] The clean fine-tuning baseline is trained on 300 clean samples, while the backdoored model is trained on 300 samples of which 200 are teacher-verbose CoTs. On Math-500 and Cot-Flan the backdoored model improves accuracy substantially relative to this baseline (e.g., R1-7B Math-500 at S=2: 28 vs 64; QwQ Cot-Flan at S=0: 52 vs 86). This suggests the comparison conflates the backdoor with a general reasoning improvement from richer training data. A control model fine-tuned on equally verbose CoTs without trigger conditioning would isolate the backdoor's effect and support the stealth claim.
  5. [Figures 2-5 and Sections 5.4-5.5] Figures 2-5 are not legible in the version provided (the figure bodies appear as encoded glyph sequences), so the ablation, generalization, and defense results could not be verified. The final manuscript must contain readable figures with labeled axes and legends so these claims can be checked.
minor comments (6)
  1. [Table 1 notation] The sentence above Table 1, 'The value in parentheses on the second line indicates...', is confusing because the table does not have a second line; please describe the 'clean/backdoor diff↑↓' notation directly.
  2. [Equation (2)] Equation (2) uses 'i ⊕ (t × S)' without first defining the product notation; please state that t × S denotes S repetitions and that ⊕ denotes string concatenation.
  3. [Throughout] The dataset name is spelled inconsistently as both 'Cot-Flan' and 'CoT-Flan'; please unify the spelling.
  4. [Section 3.2] The formal requirement '|r*| ≫ |r|' lacks a concrete threshold; consider defining an attack-success criterion, such as a minimum multiplicative factor.
  5. [References] The citation keys 'QwenTeam' and 'Qwen Team' appear inconsistently for the same project; please align the author names and keys.
  6. [Section 5.3] The case study is anecdotal; a small quantitative sample (for example, the distribution of refinement-step counts over several triggered outputs) would support the claim that the number of steps tracks S.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the tunable mapping is a training objective, and the held-out S=4 generalization is a genuine extrapolation rather than a fitted input.

full rationale

The paper's derivation chain is an empirical attack construction, not a first-principles prediction. The poisoned dataset is deliberately built so that a trigger repeated S times is paired with a teacher-generated CoT containing S redundant refinement steps (Eq. 2 and the teacher instruction template in Section 4). The S=1 and S=2 columns in Table 1 therefore report in-distribution attack success on the exact training conditions; the paper does not present these columns as held-out predictions of a fitted model. The only predictive component, generalization to unseen S=4 in Section 5.4, is evaluated on a strength absent from the poisoned training set and is not forced by any fitted parameter or by the dataset construction. No load-bearing premise is imported solely from the authors' own prior work: the self-citations (backdoor surveys and 'Probe before you talk') serve as background classification and are not used to justify the tunable backdoor mechanism. Consequently, no circular step meeting the evidentiary bar—an equation reducing to itself by construction or a fitted parameter renamed as a prediction—is present.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper is an empirical attack demonstration rather than a mathematical derivation, so the ledger contains no invented entities and only the hand-chosen experimental parameters and domain assumptions that the central claim rests on.

free parameters (2)
  • Poisoned sample count per trigger strength = 100 clean plus 100 poisoned at S=1 and 100 at S=2 (300 total; 400 total in generalization)
    The number of poisoned samples per strength is hand-picked. The ablation (Figure 3) shows the backdoor emerges with as few as 20, so the chosen 100 is a design margin, not a fitted optimum.
  • LoRA configuration = rank=8, alpha=16, 5 epochs
    Chosen without a sensitivity study; these hyperparameters affect whether the backdoor implants cleanly and how much general reasoning ability is retained.
assumptions (3)
  • domain assumption The teacher LLM (DeepSeek-Chat) reliably generates CoTs that contain exactly S distinct refinement steps and preserve the correct final answer.
    Used in Section 4 'Controllable Verbose CoT Generation'. The paper does not report validation of the generated data quality, so the training signal quality is assumed.
  • domain assumption Supervised fine-tuning with LoRA on a small mixed dataset can implant the trigger-to-verbosity mapping without erasing general reasoning ability.
    This is the training mechanism in Section 4 'Backdoor Injection'. The experiments support it, but it is an empirical assumption about optimization and generalization.
  • standard math Output token count is an appropriate proxy for reasoning length and resource consumption.
    The metrics section (5.1) uses average output token count as the length metric. This is a standard and reasonable proxy, though it ignores the structure and quality of the reasoning.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit." pith.science (2026). https://pith.science/paper/KYQPB2O4

@misc{pith2026250718305,
  author       = {Pith},
  title        = {Pith review of: BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KYQPB2O4}},
  note         = {Machine review of arXiv:2507.18305}
}
read the original abstract

Large reasoning models (LRMs) have emerged as a significant advancement in artificial intelligence, representing a specialized class of large language models (LLMs) designed to tackle complex reasoning tasks. The defining characteristic of LRMs lies in their extensive chain-of-thought (CoT) reasoning capabilities. In this paper, we identify a previously unexplored attack vector against LRMs, which we term "overthinking backdoors". We advance this concept by proposing a novel tunable backdoor, which moves beyond simple on/off attacks to one where an attacker can precisely control the extent of the model's reasoning verbosity. Our attack is implemented through a novel data poisoning methodology. It pairs a tunable trigger-where the number of repetitions signals the desired intensity-with a correspondingly verbose CoT response. These responses are programmatically generated by instructing a teacher LLM to inject a controlled number of redundant refinement steps into a correct reasoning process. The approach preserves output correctness, which ensures stealth and establishes the attack as a pure resource-consumption vector. Extensive empirical results on various LRMs demonstrate that our method can reliably trigger a controllable, multi-fold increase in the length of the reasoning process, without degrading the final answer's correctness. Our source code is available at https://github.com/FZaKK/BadReasoner.

Figures

Figures reproduced from arXiv: 2507.18305 by the authors.

Figure 1
Figure 1. An illustration of the tunable overthinking backdoor. The attack is activated by a repetitive trigger (e.g., [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The performance of tunable backdoor in different trigger designs. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. The performance of tunable backdoor with different numbers of poisoned samples. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The tunable backdoor generalizes to unseen trigger strengths. The models were fine-tuned on a dataset [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: The tunable backdoor shows strong resistance to fine-tuning-based defenses. The cot length shows a [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 24 canonical work pages

  1. [1]

    Stealthy and persistent unalignment on large language models via backdoor injections

    Yuanpu Cao, Bochuan Cao, and Jinghui Chen. Stealthy and persistent unalignment on large language models via backdoor injections. In NAACL, 2024

    work page 2024

  2. [2]

    Do NOT think that much for 2+3=? on the overthinking of o1-like llms

    Xingyu Chen, Jiahao Xu, Tian Liang, et al. Do NOT think that much for 2+3=? on the overthinking of o1-like llms. arXiv:2412.21187, 2024

    arXiv 2024

  3. [3]

    Training verifiers to solve math word problems

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, et al. Training verifiers to solve math word problems. arXiv:2110.14168, 2021

    arXiv 2021

  4. [4]

    The danger of overthinking: Examining the reasoning-action dilemma in agentic tasks

    Alejandro Cuadron, Dacheng Li, Wenjie Ma, et al. The danger of overthinking: Examining the reasoning-action dilemma in agentic tasks. arXiv:2502.08235, 2025

    arXiv 2025

  5. [5]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning

    DeepSeek-AI. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv:2501.12948, 2025

    arXiv 2025

  6. [6]

    An engorgio prompt makes large language model babble on

    Jianshuo Dong, Ziyuan Zhang, Qingjie Zhang, et al. An engorgio prompt makes large language model babble on. arXiv:2412.19394, 2024

    arXiv 2024

  7. [7]

    Towards revealing the mystery behind chain of thought: A theoretical perspective

    Guhao Feng, Bohang Zhang, Yuntian Gu, et al. Towards revealing the mystery behind chain of thought: A theoretical perspective. In NeurIPS, 2023

    work page 2023

  8. [8]

    Denial-of-service poisoning attacks against large language models

    Kuofeng Gao, Tianyu Pang, Chao Du, et al. Denial-of-service poisoning attacks against large language models. arXiv:2410.10760, 2024

    arXiv 2024

Show all 48 references
  1. [9]

    Coercing llms to do and reveal (almost) anything

    Jonas Geiping, Alex Stein, Manli Shu, et al. Coercing llms to do and reveal (almost) anything. arXiv:2402.14020, 2024

    2024 arXiv

  2. [10]

    Exploring backdoor vulnerabilities of chat models

    Yunzhuo Hao, Wenkai Yang, and Yankai Lin. Exploring backdoor vulnerabilities of chat models. arXiv:2404.02406, 2024

    2024 arXiv

  3. [11]

    Openai o1 system card

    Aaron Jaech, Adam Kalai, Adam Lerer, et al. Openai o1 system card. arXiv:2412.16720, 2024

    2024 arXiv

  4. [12]

    Overthink: Slowdown attacks on reasoning llms

    Abhinav Kumar, Jaechul Roh, Ali Naseh, et al. Overthink: Slowdown attacks on reasoning llms. arXiv:2502.02542, 2025

    2025

  5. [13]

    Weight poisoning attacks on pretrained models

    Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pretrained models. In ACL, 2020

    2020

  6. [14]

    Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models

    Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models. arXiv:2408.12798, 2024

    2024 arXiv

  7. [15]

    Backdoor learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, et al. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 35 0 (1): 0 5--22, 2022

    2022

  8. [16]

    Let's verify step by step

    Hunter Lightman, Vineet Kosaraju, Yuri Burda, et al. Let's verify step by step. In ICLR, 2023

    2023

  9. [17]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pp.\ 273--294. Springer, 2018

    2018

  10. [18]

    Trojtext: Test-time invisible textual trojan insertion

    Qian Lou, Yepeng Liu, and Bo Feng. Trojtext: Test-time invisible textual trojan insertion. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023 , 2023

    2023

  11. [19]

    Hidden trigger backdoor attack on NLP models via linguistic style manipulation

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden trigger backdoor attack on NLP models via linguistic style manipulation. In USENIX Security Symposium , 2022

    2022

  12. [20]

    Mind the style of text! adversarial and backdoor attacks based on text style transfer

    Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. In EMNLP, 2021 a

    2021

  13. [21]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In ACL, 2021 b

    2021

  14. [22]

    Fine-tuning aligned language models compromises safety, even when users do not intend to! In ICLR, 2024

    Xiangyu Qi, Yi Zeng, Tinghao Xie, et al. Fine-tuning aligned language models compromises safety, even when users do not intend to! In ICLR, 2024

    2024

  15. [23]

    Hello qwen2

    QwenTeam. Hello qwen2. QwenLM Blog, 2024. URL https://qwenlm.github.io/blog/qwen2/

    2024

  16. [24]

    Qwq-32b: Embracing the power of reinforcement learning

    QwenTeam. Qwq-32b: Embracing the power of reinforcement learning. QwenLM Blog, 2025. URL https://qwenlm.github.io/blog/qwq-32b/

    2025

  17. [25]

    Universal jailbreak backdoors from poisoned human feedback

    Javier Rando and Florian Tram \` e r. Universal jailbreak backdoors from poisoned human feedback. In ICLR, 2024

    2024

  18. [26]

    On the exploitability of instruction tuning

    Manli Shu, Jiongxiao Wang, Chen Zhu, et al. On the exploitability of instruction tuning. In NeurIPS, 2023

    2023

  19. [27]

    Sponge examples: Energy-latency attacks on neural networks

    Ilia Shumailov, Yiren Zhao, Daniel Bates, et al. Sponge examples: Energy-latency attacks on neural networks. In EuroS & P , 2021

    2021

  20. [28]

    Qwq: Reflect deeply on the boundaries of the unknown, November 2024

    Qwen Team. Qwq: Reflect deeply on the boundaries of the unknown, November 2024. URL https://qwenlm.github.io/blog/qwq-32b-preview/

    2024

  21. [29]

    Poisoning language models during instruction tuning

    Alexander Wan, Eric Wallace, Sheng Shen, et al. Poisoning language models during instruction tuning. In ICML, 2023

    2023

  22. [30]

    Finetuned language models are zero-shot learners

    Jason Wei, Maarten Bosma, Vincent Y Zhao, et al. Finetuned language models are zero-shot learners. arXiv:2109.01652, 2021

    2021 arXiv

  23. [31]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, et al. Chain-of-thought prompting elicits reasoning in large language models. In NeurIPS, 2022

    2022

  24. [32]

    Badchain: Backdoor chain-of-thought prompting for large language models

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of-thought prompting for large language models. arXiv:2401.12242, 2024

    2024 arXiv

  25. [33]

    Towards large reasoning models: A survey of reinforced reasoning with large language models

    Fengli Xu, Qianyue Hao, Zefang Zong, et al. Towards large reasoning models: A survey of reinforced reasoning with large language models. arXiv:2501.09686, 2025 a

    2025 arXiv

  26. [34]

    Chain of draft: Thinking faster by writing less

    Silei Xu, Wenhao Xie, Lingxiao Zhao, and Pengcheng He. Chain of draft: Thinking faster by writing less. arXiv:2502.18600, 2025 b

    2025 arXiv

  27. [35]

    BITE: textual backdoor attacks with iterative trigger injection

    Jun Yan, Vansh Gupta, and Xiang Ren. BITE: textual backdoor attacks with iterative trigger injection. In ACL, 2023

    2023

  28. [36]

    Backdooring instruction-tuned large language models with virtual prompt injection

    Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. Backdooring instruction-tuned large language models with virtual prompt injection. In NAACL, 2024 a

    2024

  29. [37]

    Backdooring instruction-tuned large language models with virtual prompt injection

    Jun Yan, Vikas Yadav, Shiyang Li, et al. Backdooring instruction-tuned large language models with virtual prompt injection. In NAACL, 2024 b

    2024

  30. [38]

    Qwen2.5 technical report

    An Yang, Baosong Yang, Beichen Zhang, et al. Qwen2.5 technical report. arXiv:2412.15115, 2025

    2025 arXiv

  31. [39]

    Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models

    Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models. In NAACL, 2021

    2021

  32. [40]

    Probe before you talk: Towards black-box defense against backdoor unalignment for large language models

    Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Zhixuan Chu, and Yiming Li. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In ICLR, 2025

    2025

  33. [41]

    BEEAR: embedding-based adversarial removal of safety backdoors in instruction-tuned language models

    Yi Zeng, Weiyu Sun, Tran Ngoc Huynh, et al. BEEAR: embedding-based adversarial removal of safety backdoors in instruction-tuned language models. arXiv:2406.17092, 2024

    2024 arXiv

  34. [42]

    Automatic chain of thought prompting in large language models

    Zhuosheng Zhang, Aston Zhang, Mu Li, et al. Automatic chain of thought prompting in large language models. In ICLR, 2023

    2023

  35. [43]

    Marco-o1: Towards open reasoning models for open-ended solutions

    Yu Zhao, Huifeng Yin, Bo Zeng, et al. Marco-o1: Towards open reasoning models for open-ended solutions. arXiv:2411.14405, 2024

    2024 arXiv

  36. [44]

    Bot: Breaking long thought processes of o1-like large language models through backdoor attack

    Zihao Zhu, Hongbao Zhang, Mingda Zhang, et al. Bot: Breaking long thought processes of o1-like large language models through backdoor attack. arXiv:2502.12202, 2025

    2025 arXiv

  37. [45]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  38. [46]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  39. [47]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  40. [48]

    r 9gRam. (` : lB1.D[ٕZJ>]7O J]HDl G

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.