One Token Embedding Is Enough to Deadlock Your Reasoning Large Language Model
Mohan Zhang, Yihua Zhang, Jinghan Jia, Zhangyang &quot;Atlas&quot; Wang, Sijia Liu, Tianlong Chen
Modern Large Language Models (LLMs) demonstrate remarkable problem-solving capabilities through multi-step chain-of-thought reasoning, but this iterative thinking mechanism exposes a novel vulnerability surface. We introduce the Deadlock Attack, a resource exhaustion technique that hijacks an LLM's generative control flow by training a malicious adversarial embedding to force the model into perpetual thinking loops. The attack works by optimizing an embedding that encourages transitional tokens (e.g., "Wait", "But") after reasoning steps, preventing the model from reaching a natural conclusion. We identify a significant "continuous-to-discrete" gap when attempting to convert adversarial embeddings into discrete token sequences and propose a backdoor mechanism as an effective implantation strategy. Our experiments across four advanced reasoning LLMs (Phi-RM, Nemotron-Nano, R1-Qwen, R1-Llama) and three mathematical reasoning benchmarks demonstrate 100\% attack success rate, with models consistently generating up to maximum token limits, exhausting computational resources. Importantly, the attack remains stealthy, with minimal impact on model performance when the trigger is absent, and proves robust against existing defenses designed to mitigate overthinking. These findings reveal a critical security consideration for reasoning-enhanced LLMs, highlighting the urgent need for novel defense mechanisms against resource depletion attacks.