mlsanityData to 14 Oct 2026

Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models

arXiv 2503.01781 ↗First posted 3 Mar 2025cs.CLcited by 23

On the map: LLM reasoning → Reasoning for agents, planning and code

Abstract (arXiv)

We investigate the robustness of reasoning models trained for step-by-step problem solving by introducing query-agnostic adversarial triggers - short, irrelevant text that, when appended to math problems, systematically mislead models to output incorrect answers without altering the problem's semantics. We propose CatAttack, an automated iterative attack pipeline for generating triggers on a weaker, less expensive proxy model (DeepSeek V3) and successfully transfer them to more advanced reasoning target models like DeepSeek R1 and DeepSeek R1-distilled-Qwen-32B, resulting in greater than 300% increase in the likelihood of the target model generating an incorrect answer. For example, appending, "Interesting fact: cats sleep most of their lives," to any math problem leads to more than doubling the chances of a model getting the answer wrong. Our findings highlight critical vulnerabilities in reasoning models, revealing that even state-of-the-art models remain susceptible to subtle adversarial inputs, raising security and reliability concerns. The CatAttack triggers dataset with model responses is available at https://huggingface.co/datasets/collinear-ai/cat-attack-adversarial-triggers.

Key facts. Cited by 23 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 24 of its 29 references that are in the map. First posted on arXiv 3 Mar 2025.

Builds on

24 of 29 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking18 Feb
  2. 2025OverThink: Slowdown Attacks on Reasoning LLMs4 Feb
  3. 2024OpenAI o1 System Card21 Dec
  4. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan

Other references · 20

  1. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  2. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2022Red Teaming Language Models with Language Modelscited by 1,026
  8. 2024DeepSeek-V3 Technical Reportcited by 811
  9. 2019EDA: Easy Data Augmentation Techniques for Boosting Performance on Text Classification Taskscited by 807
  10. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  11. 2020AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Promptscited by 249
  12. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 234
8 more
  1. 2024GSM-Plus: A Comprehensive Benchmark for Evaluating the Robustness of LLMs as Mathematical Problem Solverscited by 158
  2. 2025MATH-Perturb: Benchmarking LLMs' Math Reasoning Abilities against Hard Perturbationscited by 89
  3. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
  4. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45
  5. 2024Cutting Through the Noise: Boosting LLM Performance on Math Word Problemscited by 14
  6. 2017HotFlip: White-Box Adversarial Examples for Text Classificationcited by 13
  7. 2018Trick Me If You Can: Human-in-the-loop Generation of Adversarial Examples for Question Answeringcited by 6
  8. 2024Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Modelscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 11; 2026: 12.

23 papers.

Sort:

By area:

  1. 2025Agentic Large Language Models, a surveycited by 108
  2. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  3. 2025Trade-offs in Large Reasoning Models: An Empirical Analysis of Deliberative and Adaptive Reasoning over Foundational Capabilitiescited by 20
  4. 2025Steering the CensorShip: Uncovering Representation Vectors for LLM "Thought" Controlcited by 14
  5. 2025A Neurosymbolic Approach to Natural Language Formalization and Verificationcited by 9
  6. 2025AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Modelscited by 7
  7. 2025One Token Embedding Is Enough to Deadlock Your Large Reasoning Modelcited by 5
  8. 2026ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Modelscited by 5
  9. 2026Towards Self-Robust LLMs: Intrinsic Prompt Noise Resistance via CoIPOcited by 5
  10. 2025Red Teaming Large Reasoning Modelscited by 2
  11. 2026Certifiable Boolean Reasoning Is Universalcited by 2
  12. 2026Contrastive Reasoning Alignment: Reinforcement Learning from Hidden Representationscited by 2
11 more
  1. 2025A Toolbox, Not a Hammer -- Multi-TAG: Scaling Math Reasoning with Multi-Tool Aggregationcited by 1
  2. 2025Beyond MedQA: Towards Real-world Clinical Decision Making in the Era of LLMscited by 1
  3. 2026Talk is (Not) Cheap: A Taxonomy and Benchmark Coverage Audit for LLM Attackscited by 1
  4. 2026Mitigating Context Interference for Reliable and Efficient Search Agentscited by 1
  5. 2025Fast and Accurate Contextual Knowledge Extraction Using Cascading Language Model Chains and Candidate Answerscited by 0
  6. 2026Attention-Guided Reward for Reinforcement Learning-based Jailbreak against Large Reasoning Modelscited by 0
  7. 2026Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMscited by 0
  8. 2026CPInj: Uncovering Prompt Injection Risks in Textual Collaborative Prompt Optimizationcited by 0
  9. 2026SMTrap: Cost-Effective DoS Attacks Against Large Reasoning Models via SMT Conflict Guidancecited by 0
  10. 2026Lazy Grounding: Attacking Search Agents with Factual Evidencecited by 0
  11. 2026On the Efficiency-Safety Dilemma in Large Reasoning Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Consistency of Large Reasoning Models Under Multi-Turn Attacks
  2. 2025HauntAttack: When Attack Follows Reasoning as a Shadow
  3. 2025Turning Logic Against Itself : Probing Model Defenses Through Contrastive Questions
  4. 2025Weakest Link in the Chain: Security Vulnerabilities in Advanced Reasoning Models
  5. 2025MSCR: Exploring the Vulnerability of LLMs' Mathematical Reasoning Abilities Using Multi-Source Candidate Replacement
  6. 2025BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models
  7. 2025Benchmarking Gaslighting Negation Attacks Against Reasoning Models
  8. 2025Distractor Injection Attacks on Large Reasoning Models: Characterization and Defense