Distractor Injection Attacks on Large Reasoning Models: Characterization
  and Defense
Recent advances in large reasoning models (LRMs) have enabled remarkable
performance on complex tasks such as mathematics and coding by generating long
Chain-of-Thought (CoT) traces. In this paper, we identify and systematically
analyze a critical vulnerability we term reasoning distraction, where LRMs are
diverted from their primary objective by irrelevant yet complex tasks
maliciously embedded in the prompt. Through a comprehensive study across
diverse models and benchmarks, we show that even state-of-the-art LRMs are
highly susceptible, with injected distractors reducing task accuracy by up to
60%. We further reveal that certain alignment techniques can amplify this
weakness and that models may exhibit covert compliance, following hidden
adversarial instructions in reasoning while concealing them in the final
output. To mitigate these risks, we propose a training-based defense that
combines Supervised Fine-Tuning (SFT) and Reinforcement Learning (RL) on
synthetic adversarial data, improving robustness by over 50 points on
challenging distractor attacks. Our findings establish reasoning distraction as
a distinct and urgent threat to LRM reliability and provide a practical step
toward safer and more trustworthy reasoning systems.
68f6f3bf24c44893631118c1
Zhehao Zhang
68f6f3bf24c44893631118c2
Weijie Xu
68f6f3bf24c44893631118c3
Shixian Cui
68f6f3bf24c44893631118c4
Chandan K. Reddy
Distractor Injection Attacks on Large Reasoning Models: Characterization
  and Defense
Recent advances in large reasoning models (LRMs) have enabled remarkable
performance on complex tasks such as mathematics and coding by generating long
Chain-of-Thought (CoT) traces. In this paper, we identify and systematically
analyze a critical vulnerability we term reasoning distraction, where LRMs are
diverted from their primary objective by irrelevant yet complex tasks
maliciously embedded in the prompt. Through a comprehensive study across
diverse models and benchmarks, we show that even state-of-the-art LRMs are
highly susceptible, with injected distractors reducing task accuracy by up to
60%. We further reveal that certain alignment techniques can amplify this
weakness and that models may exhibit covert compliance, following hidden
adversarial instructions in reasoning while concealing them in the final
output. To mitigate these risks, we propose a training-based defense that
combines Supervised Fine-Tuning (SFT) and Reinforcement Learning (RL) on
synthetic adversarial data, improving robustness by over 50 points on
challenging distractor attacks. Our findings establish reasoning distraction as
a distinct and urgent threat to LRM reliability and provide a practical step
toward safer and more trustworthy reasoning systems.
Large reasoning models are vulnerable to reasoning distraction, where irrelevant tasks embedded in prompts reduce accuracy, and a combined SFT and RL defense improves robustness.
large reasoning models Chain-of-Thought reasoning distraction Supervised Fine-Tuning Reinforcement Learning adversarial data