<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="li-etal-2026-reasoning-vulnerability">
    <titleInfo>
        <title>Over-reasoning as a Vulnerability: Neuron Activation-Guided Denial-of-Service Attacks on Large Reasoning Models</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Jiaxiang</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Zhipeng</namePart>
        <namePart type="family">Wei</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Tianwen</namePart>
        <namePart type="family">Qian</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yuanbin</namePart>
        <namePart type="family">Wu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xianming</namePart>
        <namePart type="family">Hu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xiaoling</namePart>
        <namePart type="family">Wang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Large Reasoning Models (LRMs) achieve strong performance on complex tasks through explicit multi-step reasoning, but their long reasoning traces also expose them to denial-of-service (DoS) attacks that induce excessive computation. Existing DoS attacks rely on indirect, heuristic objectives to optimize adversarial inputs, without leveraging the internal mechanisms that drive long reasoning, resulting in relatively inefficient optimization and weaker attack effectiveness. In this paper, we show that over-reasoning in LRMs is mediated by a sparse neuron-level mechanism that can be systematically exploited. Specifically, we introduce Aha Neuron Localization (ANL), a method for identifying reasoning-related neurons whose activations are strongly associated with the generation of reasoning tokens, and demonstrate that selectively amplifying their activations induces over-reasoning. Based on this insight, we develop ANL-guided DoS Attack (AGDA), which optimizes a short adversarial suffix using reasoning-related neurons as precise and stable white-box signals. When attached to user queries, the suffix induces over-reasoning. Experiments show that the adversarial suffixes learned by AGDA yield reasoning traces over 3.45 \times longer than the original outputs and more than 2 \times longer than the strongest method, while transferring effectively to closed-source models.</abstract>
    <identifier type="citekey">li-etal-2026-reasoning-vulnerability</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1195/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>27357</start>
            <end>27384</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Over-reasoning as a Vulnerability: Neuron Activation-Guided Denial-of-Service Attacks on Large Reasoning Models
%A Li, Jiaxiang
%A Wei, Zhipeng
%A Qian, Tianwen
%A Wu, Yuanbin
%A Hu, Xianming
%A Wang, Xiaoling
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F li-etal-2026-reasoning-vulnerability
%X Large Reasoning Models (LRMs) achieve strong performance on complex tasks through explicit multi-step reasoning, but their long reasoning traces also expose them to denial-of-service (DoS) attacks that induce excessive computation. Existing DoS attacks rely on indirect, heuristic objectives to optimize adversarial inputs, without leveraging the internal mechanisms that drive long reasoning, resulting in relatively inefficient optimization and weaker attack effectiveness. In this paper, we show that over-reasoning in LRMs is mediated by a sparse neuron-level mechanism that can be systematically exploited. Specifically, we introduce Aha Neuron Localization (ANL), a method for identifying reasoning-related neurons whose activations are strongly associated with the generation of reasoning tokens, and demonstrate that selectively amplifying their activations induces over-reasoning. Based on this insight, we develop ANL-guided DoS Attack (AGDA), which optimizes a short adversarial suffix using reasoning-related neurons as precise and stable white-box signals. When attached to user queries, the suffix induces over-reasoning. Experiments show that the adversarial suffixes learned by AGDA yield reasoning traces over 3.45 \times longer than the original outputs and more than 2 \times longer than the strongest method, while transferring effectively to closed-source models.
%U https://aclanthology.org/2026.emnlp-main.1195/
%P 27357-27384

Markdown (Informal)

[Over-reasoning as a Vulnerability: Neuron Activation-Guided Denial-of-Service Attacks on Large Reasoning Models](https://aclanthology.org/2026.emnlp-main.1195/) (Li et al., EMNLP 2026)

• Over-reasoning as a Vulnerability: Neuron Activation-Guided Denial-of-Service Attacks on Large Reasoning Models (Li et al., EMNLP 2026)

ACL

• Jiaxiang Li, Zhipeng Wei, Tianwen Qian, Yuanbin Wu, Xianming Hu, and Xiaoling Wang. 2026. Over-reasoning as a Vulnerability: Neuron Activation-Guided Denial-of-Service Attacks on Large Reasoning Models. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 27357–27384, Budapest, Hungary. Association for Computational Linguistics.