@inproceedings{zhang-etal-2026-code,
title = "{CODE}: A Contradiction-Based Overthinking Attack Framework for Prolonging Retrieval-Augmented Generation",
author = "Zhang, Xiaolei and
Jia, Xiaojun and
Chen, Liquan and
Li, Songze",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.917/",
pages = "21127--21141",
ISBN = "979-8-89176-459-0",
abstract = "Introducing reasoning models into Retrieval-Augmented Generation (RAG) systems enhances task performance through step-by-step reasoning, logical consistency, and multi-step self-verification. However, recent studies have shown that reasoning models suffer from \textit{overthinking} attacks, where models are tricked to generate an unnecessarily high number of reasoning tokens. In this paper, we reveal that such overthinking risk can be inherited by RAG systems equipped with reasoning models, by proposing an end-to-end attack framework named Contradiction-Based Deliberation Extension (\textbf{CODE}). Specifically, CODE develops a multi-agent architecture to construct poisoning samples that are injected into the knowledge base. These samples 1) are highly correlated with the user query, such that they can be retrieved as inputs to the reasoning model; and 2) contain contradiction between the logical and evidential layers that cause models to overthink, and are optimized to exhibit highly diverse styles. Extensive experiments on two datasets across five commercial reasoning models demonstrate that the proposed attack causes a $5.32\sim24.72\times$ increase in reasoning token consumption, without degrading task performance. Finally, we also discuss and evaluate potential countermeasures to mitigate overthinking risks."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhang-etal-2026-code">
<titleInfo>
<title>CODE: A Contradiction-Based Overthinking Attack Framework for Prolonging Retrieval-Augmented Generation</title>
</titleInfo>
<name type="personal">
<namePart type="given">Xiaolei</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xiaojun</namePart>
<namePart type="family">Jia</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Liquan</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Songze</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Introducing reasoning models into Retrieval-Augmented Generation (RAG) systems enhances task performance through step-by-step reasoning, logical consistency, and multi-step self-verification. However, recent studies have shown that reasoning models suffer from overthinking attacks, where models are tricked to generate an unnecessarily high number of reasoning tokens. In this paper, we reveal that such overthinking risk can be inherited by RAG systems equipped with reasoning models, by proposing an end-to-end attack framework named Contradiction-Based Deliberation Extension (CODE). Specifically, CODE develops a multi-agent architecture to construct poisoning samples that are injected into the knowledge base. These samples 1) are highly correlated with the user query, such that they can be retrieved as inputs to the reasoning model; and 2) contain contradiction between the logical and evidential layers that cause models to overthink, and are optimized to exhibit highly diverse styles. Extensive experiments on two datasets across five commercial reasoning models demonstrate that the proposed attack causes a 5.32\sim24.72\times increase in reasoning token consumption, without degrading task performance. Finally, we also discuss and evaluate potential countermeasures to mitigate overthinking risks.</abstract>
<identifier type="citekey">zhang-etal-2026-code</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.917/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>21127</start>
<end>21141</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T CODE: A Contradiction-Based Overthinking Attack Framework for Prolonging Retrieval-Augmented Generation
%A Zhang, Xiaolei
%A Jia, Xiaojun
%A Chen, Liquan
%A Li, Songze
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zhang-etal-2026-code
%X Introducing reasoning models into Retrieval-Augmented Generation (RAG) systems enhances task performance through step-by-step reasoning, logical consistency, and multi-step self-verification. However, recent studies have shown that reasoning models suffer from overthinking attacks, where models are tricked to generate an unnecessarily high number of reasoning tokens. In this paper, we reveal that such overthinking risk can be inherited by RAG systems equipped with reasoning models, by proposing an end-to-end attack framework named Contradiction-Based Deliberation Extension (CODE). Specifically, CODE develops a multi-agent architecture to construct poisoning samples that are injected into the knowledge base. These samples 1) are highly correlated with the user query, such that they can be retrieved as inputs to the reasoning model; and 2) contain contradiction between the logical and evidential layers that cause models to overthink, and are optimized to exhibit highly diverse styles. Extensive experiments on two datasets across five commercial reasoning models demonstrate that the proposed attack causes a 5.32\sim24.72\times increase in reasoning token consumption, without degrading task performance. Finally, we also discuss and evaluate potential countermeasures to mitigate overthinking risks.
%U https://aclanthology.org/2026.emnlp-main.917/
%P 21127-21141
Markdown (Informal)
[CODE: A Contradiction-Based Overthinking Attack Framework for Prolonging Retrieval-Augmented Generation](https://aclanthology.org/2026.emnlp-main.917/) (Zhang et al., EMNLP 2026)
ACL