mlsanityData to 7 Oct 2026

RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

arXiv 2606.07968 ↗First posted 6 Jun 2026cs.CR cs.AIcited by 0

On the map: LLM reasoning → Reasoning for agents, planning and code

Abstract (arXiv)

Reasoning-capable large language models can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety classifiers often miss these attacks because the injected prompts can appear syntactically benign. We build RecurGuard, a runtime monitor for detecting reasoning-chain consumption attacks when reasoning traces are exposed by the model. RecurGuard analyzes reasoning traces as they are generated and tracks three signals: recurrence rate, volume growth, and progress toward the user's query. If all three signals remain anomalous over three consecutive chunks, RecurGuard terminates generation early. We evaluate RecurGuard against OverThink and ExtendAttack across open-weight reasoning models and conduct adaptive stress tests on DS-R1-Qwen-7B. On this model, RecurGuard detects 99% of OverThink attacks and 92% of ExtendAttack instances while maintaining near-zero false positive rates on question answering, code generation, mathematics, and summarization. Adaptive evaluation reveals the limit of the defense: topical attacks retain 11.9x amplification with an approximately 50% joint miss rate, whereas full semantic evasion reduces amplification from 22.8x to 2.2x. When reasoning traces are unavailable, QDM provides a post-hoc fallback monitor based on the final output.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 27 of its 43 references that are in the map. First posted on arXiv 6 Jun 2026.

Builds on

27 of 43 references.

Closest ancestors · 9

Same direction, newest first

  1. 2026RECUR: Resource Exhaustion Attack via Recursive-Entropy Guided Counterfactual Utilization and Reflection9 Feb
  2. 2026ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models29 Jan
  3. 2026Sponge Tool Attack: Stealthy Denial-of-Efficiency against Tool-Augmented Agentic Reasoning24 Jan
  4. 2025ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking8 Dec
  5. 2025BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models13 Nov
  6. 2025POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimization23 Aug
  7. 2025BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit24 Jul
  8. 2025Excessive Reasoning Attack on Reasoning LLMs17 Jun
  9. 2025OverThink: Slowdown Attacks on Reasoning LLMs4 Feb

Other references · 18

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2025Qwen3 Technical Reportcited by 8,195
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  5. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  8. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  9. 2025Stop Overthinking: A Survey on Efficient Reasoning for Large Language Modelscited by 456
  10. 2023Are aligned neural networks adversarially aligned?cited by 305
  11. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  12. 2025SelfBudgeter: Adaptive Token Allocation for Efficient LLM Reasoningcited by 47
6 more
  1. 2025Answer Convergence as a Signal for Early Stopping in Reasoningcited by 38
  2. 2024Llama Guard 3-1B-INT4: Compact and Efficient Safeguard for Human-AI Conversationscited by 24
  3. 2025THINK-Bench: Evaluating Thinking Efficiency and Chain-of-Thought Quality of Large Reasoning Modelscited by 18
  4. 2025ExtendAttack: Attacking Servers of LRMs via Extending Reasoningcited by 10
  5. 2026CODE: A Contradiction-Based Deliberation Extension Framework for Overthinking Attacks on Retrieval-Augmented Generationcited by 3
  6. 2026Zero-Shot Embedding Drift Detection: A Lightweight Defense Against Prompt Injections in LLMscited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models
  2. 2025Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated
  3. 2025Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitors
  4. 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs
  5. 2026Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents
  6. 2026STAR: Detecting Inference-time Backdoors in LLM Reasoning via State-Transition Amplification Ratio
  7. 2025Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression
  8. 2026TRACE: An Evidence-Grounded Benchmark for Safety Evaluation of Large Reasoning Models