Large Reasoning Models (LRMs) achieve strong performance on complex tasks through explicit multi-step reasoning, but their long reasoning traces also expose them to denial-of-service (DoS) attacks that induce excessive computation. Existing DoS attacks rely on indirect, heuristic objectives to optimize adversarial inputs, without leveraging the internal mechanisms that drive long reasoning, resulting in relatively inefficient optimization and weaker attack effectiveness. In this paper, we show that over-reasoning in LRMs is mediated by a sparse neuron-level mechanism that can be systematically exploited. Specifically, we introduce Aha Neuron Localization (ANL), a method for identifying reasoning-related neurons whose activations are strongly associated with the generation of reasoning tokens, and demonstrate that selectively amplifying their activations induces over-reasoning. Based on this insight, we develop ANL-guided DoS Attack (AGDA), which optimizes a short adversarial suffix using reasoning-related neurons as precise and stable white-box signals. When attached to user queries, the suffix induces over-reasoning. Experiments show that the adversarial suffixes learned by AGDA yield reasoning traces over 3.45 × longer than the original outputs and more than 2 × longer than the strongest method, while transferring effectively to closed-source models.

Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, DMN, which leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.