mlsanityData to 7 Oct 2026

Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs

arXiv 2510.07697 ↗First posted 9 Oct 2025cs.CR cs.AIcited by 1

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

With the rise of advanced reasoning capabilities, large language models (LLMs) are receiving increasing attention. However, although reasoning improves LLMs' performance on downstream tasks, it also introduces new security risks, as adversaries can exploit these capabilities to conduct backdoor attacks. Existing surveys on backdoor attacks and reasoning security offer comprehensive overviews but lack in-depth analysis of backdoor attacks and defenses targeting LLMs' reasoning abilities. In this paper, we take the first step toward providing a comprehensive review of reasoning-based backdoor attacks in LLMs by analyzing their underlying mechanisms, methodological frameworks, and unresolved challenges. Specifically, we introduce a new taxonomy that offers a unified perspective for summarizing existing approaches, categorizing reasoning-based backdoor attacks into associative, passive, and active. We also present defense strategies against such attacks and discuss current challenges alongside potential directions for future research. This work offers a novel perspective, paving the way for further exploration of secure and trustworthy LLM communities.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 45 of its 109 references that are in the map. First posted on arXiv 9 Oct 2025.

Builds on

45 of 109 references.

Closest ancestors · 20

Same direction, newest first

  1. 2025Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated6 Sep
  2. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models4 Sep
  3. 2025BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit24 Jul
  4. 2025Thought Purity: A Defense Framework For Chain-of-Thought Attack16 Jul
  5. 2025Thought Crime: Backdoors and Emergent Misalignment in Reasoning Models16 Jun
  6. 2025Step-by-Step Reasoning Attack: Revealing 'Erased' Knowledge in Large Language Models14 Jun
  7. 2025SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues31 May
  8. 2025GUARD:Dual-Agent based Backdoor Defense on Chain-of-Thought in Neural Code Generation27 May
  9. 2025Practical Reasoning Interruption Attacks on Reasoning Large Language Models10 May
  10. 2025Safety in Large Reasoning Models: A Survey24 Apr
  11. 2025ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs8 Apr
  12. 2025Process or Result? Manipulated Ending Tokens Can Mislead Reasoning LLMs to Ignore the Correct Reasoning Steps25 Mar
8 more
  1. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking18 Feb
  2. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking18 Feb
  3. 2025To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Models16 Feb
  4. 2025DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMs24 Jan
  5. 2024OpenAI o1 System Card21 Dec
  6. 2024SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation8 Dec
  7. 2024Learning to Poison Large Language Models for Downstream Manipulation21 Feb
  8. 2023Chain-of-Thought in Neural Code Generation: From and For Lightweight Language Models9 Dec

Other references · 25

  1. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  2. 2025Qwen3 Technical Reportcited by 8,195
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  4. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  5. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2025Towards Reasoning Era: A Survey of Long Chain-of-Thought for Reasoning Large Language Modelscited by 381
  9. 2023ProofNet: Autoformalizing and Formally Proving Undergraduate-Level Mathematicscited by 180
  10. 2025A Survey of Reinforcement Learning for Large Reasoning Modelscited by 175
  11. 2025Efficient Reasoning Models: A Surveycited by 93
  12. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
13 more
  1. 2025Implicit Reasoning in Large Language Models: A Comprehensive Surveycited by 42
  2. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
  3. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 17
  4. 2025Seeing Sound, Hearing Sight: Uncovering Modality Bias and Conflict of AI models in Sound Localizationcited by 17
  5. 2025How do Transformers Learn Implicit Reasoning?cited by 15
  6. 2025System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injectioncited by 14
  7. 2025UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Modelscited by 12
  8. 2025ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attackscited by 9
  9. 2025PrLM: Learning Explicit Reasoning for Personalized RAG via Contrastive Reward Optimizationcited by 8
  10. 2025Harnessing Chain-of-Thought Metadata for Task Routing and Adversarial Prompt Detectioncited by 5
  11. 2025Chain-of-Thought Poisoning Attacks against R1-based Retrieval-Augmented Generation Systemscited by 5
  12. 2025Your Agent Can Defend Itself against Backdoor Attackscited by 4
  13. 2025DUP: Detection-guided Unlearning for Backdoor Purification in Language Modelscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Thinking Wrong in Silence: Backdoor Attacks on Continuous Latent Reasoningcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2026Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models
  2. 2026STAR: Detecting Inference-time Backdoors in LLM Reasoning via State-Transition Amplification Ratio
  3. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models
  4. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challenges
  5. 2025Weakest Link in the Chain: Security Vulnerabilities in Advanced Reasoning Models
  6. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  7. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
  8. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise