mlsanityData to 14 Oct 2026

ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs

arXiv 2504.05605 ↗First posted 8 Apr 2025cs.CR cs.CLcited by 30

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Chain-of-Thought (CoT) enhances an LLM's ability to perform complex reasoning tasks, but it also introduces new security issues. In this work, we present ShadowCoT, a novel backdoor attack framework that targets the internal reasoning mechanism of LLMs. Unlike prior token-level or prompt-based attacks, ShadowCoT directly manipulates the model's cognitive reasoning path, enabling it to hijack multi-step reasoning chains and produce logically coherent but adversarial outcomes. By conditioning on internal reasoning states, ShadowCoT learns to recognize and selectively disrupt key reasoning steps, effectively mounting a self-reflective cognitive attack within the target model. Our approach introduces a lightweight yet effective multi-stage injection pipeline, which selectively rewires attention pathways and perturbs intermediate representations with minimal parameter overhead (only 0.15% updated). ShadowCoT further leverages reinforcement learning and reasoning chain pollution (RCP) to autonomously synthesize stealthy adversarial CoTs that remain undetectable to advanced defenses. Extensive experiments across diverse reasoning benchmarks and LLMs show that ShadowCoT consistently achieves high Attack Success Rate (94.4%) and Hijacking Success Rate (88.4%) while preserving benign performance. These results reveal an emergent class of cognition-level threats and highlight the urgent need for defenses beyond shallow surface-level consistency.

Key facts. Cited by 30 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 26 of its 40 references that are in the map. First posted on arXiv 8 Apr 2025.

Builds on

26 of 40 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Models16 Feb
  2. 2025DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMs24 Jan
  3. 2024OpenAI o1 System Card21 Dec
  4. 2024SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation8 Dec
  5. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan

Other references · 21

  1. 2017Proximal Policy Optimization Algorithmscited by 15,215
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  5. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  6. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,708
  7. 2023Mistral 7Bcited by 3,164
  8. 2017Decoupled Weight Decay Regularizationcited by 1,831
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  10. 2024To CoT or not to CoT? Chain-of-thought helps mainly on math and symbolic reasoningcited by 263
  11. 2023ProofNet: Autoformalizing and Formally Proving Undergraduate-Level Mathematicscited by 192
  12. 2024Multi-Step Reasoning with Large Language Models, a Surveycited by 143
9 more
  1. 2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
  2. 2023Composite Backdoor Attacks Against Large Language Modelscited by 73
  3. 2024How to think step-by-step: A mechanistic understanding of chain-of-thought reasoningcited by 53
  4. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 28
  5. 2024Critic-CoT: Boosting the reasoning abilities of large language model via Chain-of-thoughts Criticcited by 28
  6. 2024DynaThink: Fast or Slow? A Dynamic Decision-Making Framework for Large Language Modelscited by 20
  7. 2024GlitchMiner: Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimizationcited by 4
  8. 2023FastAMI -- a Monte Carlo Approach to the Adjustment for Chance in Clustering Comparison Metricscited by 1
  9. 2024AnomaLLMy -- Detecting anomalous tokens in black-box LLMs through low-confidence single-token predictionscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 13; 2026: 17.

30 papers.

Sort:

By area:

  1. 2025Safety in Large Reasoning Models: A Surveycited by 64
  2. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  3. 2026Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memorycited by 9
  4. 2025BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Modelscited by 8
  5. 2025Beyond Safe Answers: A Benchmark for Evaluating True Risk Awareness in Large Reasoning Modelscited by 7
  6. 2025Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicatedcited by 6
  7. 2025One Token Embedding Is Enough to Deadlock Your Large Reasoning Modelcited by 5
  8. 2025CoTGuard: Using Chain-of-Thought Triggering for Copyright Protection in Multi-Agent LLM Systemscited by 4
  9. 2026MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoningcited by 4
  10. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  11. 2026Thought-Transfer: Indirect Targeted Poisoning Attacks on Chain-of-Thought Reasoning Modelscited by 3
  12. 2025FuncPoison: Poisoning Function Library to Hijack Multi-agent Autonomous Driving Systemscited by 2
18 more
  1. 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMscited by 2
  2. 2025Beyond SFT: Reinforcement Learning for Safer Large Reasoning Models with Better Reasoning Abilitycited by 2
  3. 2026TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Modelscited by 2
  4. 2026Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Modelscited by 2
  5. 2025RRTL: Red Teaming Reasoning Large Language Models in Tool Learningcited by 1
  6. 2025From Perception to Reasoning: Deep Thinking Empowers Multimodal Large Language Modelscited by 1
  7. 2026Reasoning Hijacking: The Fragility of Reasoning Alignment in Large Language Modelscited by 1
  8. 2026Altered Thoughts, Altered Actions: Probing Chain-of-Thought Vulnerabilities in VLA Robotic Manipulationcited by 1
  9. 2026Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Modelscited by 1
  10. 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
  11. 2026R-CoT: A Reasoning-Layer Watermark via Redundant Chain-of-Thought in Large Language Modelscited by 0
  12. 2026ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Modelscited by 0
  13. 2026Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attackscited by 0
  14. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0
  15. 2026OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoningcited by 0
  16. 2026Alignment of LRMs via Counter-Aligned Few-Shot Conversation Exposurecited by 0
  17. 2026Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controllercited by 0
  18. 2026Detecting Chain-of-Thought Hijacking in Backdoored Multimodal Large Reasoning Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Thought Purity: A Defense Framework For Chain-of-Thought Attack
  2. 2025Chain-of-Thought Hijacking
  3. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning
  4. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches
  5. 2025HauntAttack: When Attack Follows Reasoning as a Shadow
  6. 2026SFCoT: Safer Chain-of-Thought via Active Safety Evaluation and Calibration
  7. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking
  8. 2025AdvChain: Adversarial Chain-of-Thought Tuning for Robust Safety Alignment of Large Reasoning Models