Can Overthinking in Large Language Reasoning Models Trigger DoS Attacks? A New Risk Unveiled

Background

Reasoning‑oriented large language models (e.g., DeepSeek‑R1, Qwen3‑Thinking, GPT‑o3, Gemini‑2.5‑Flash) generate long chain‑of‑thought outputs. When presented with inputs that lack necessary premises, contain contradictions, or have structural misalignments, the models often enter an “overthinking” loop: they repeatedly revise the reasoning chain instead of refusing or terminating. This loop inflates token count, inference latency, and energy consumption, creating a denial‑of‑service (DoS) risk that exploits computational resources rather than content safety.

Vulnerability Characterization

Overthinking manifests as repeated checks of the problem statement, self‑contradictory hypotheses, and back‑and‑forth recomputation, producing large volumes of seemingly thoughtful but ineffective text. The behavior is shared across multiple reasoning models, indicating a systemic logical‑chain fragility rather than a model‑specific bug.

Hierarchical Genetic Algorithm (HGA) Attack

HGA is a black‑box attack that does not require model weights, gradients, or architecture details. It automatically perturbs the logical structure of a reasoning question to induce overthinking through four stages:

Problem structuring : Decompose a question into a set of premises and a final query, converting raw text into a manipulable structured object.

Fitness evaluation : Compute a composite fitness score F = α·L + β·M, where L is the output token length and M counts overthinking markers (e.g., “but”, “wait”, “maybe”, “perhaps”, “another”, “alternatively”). Both components are required; optimizing length alone yields verbose but non‑overthinking outputs.

Hierarchical genetic operations : Apply two levels of crossover (question‑level swaps of final queries; premise‑level swaps of premise subsets) and two mutation types (premise deletion to create missing conditions; premise insertion of unrelated conditions) to generate logically inconsistent inputs while preserving the superficial appearance of a valid problem.

Black‑box evolutionary search : For each generation, submit the candidate inputs to the target model, obtain the output, compute fitness, retain high‑fitness individuals, and produce the next generation via selection, crossover, and mutation. No internal model information is needed.

Experimental Setup

Models evaluated: DeepSeek‑R1, Qwen3‑Thinking, GPT‑o3, Gemini‑2.5‑Flash. Datasets: SVAMP, GSM8K, MATH. Baselines: a simple “Base” method (unaltered questions) and a missing‑premise (MIP) baseline that removes a random premise.

Results

HGA increased output length dramatically; on MATH the longest generated response was 26.1 × the original length.

For GPT‑o3, HGA produced responses up to 6,562 tokens, a 7.2 × increase over the maximum length achieved by MIP.

All models showed at least a 2 × increase in average output length compared with the Base baseline across the three datasets.

Ablation Studies

Increasing population size or number of generations yields diminishing returns after a modest scale; early generations capture most of the benefit.

Optimizing only token length (ignoring overthinking markers) reduces attack effectiveness, confirming the necessity of the marker component in the fitness function.

Transfer Experiments

Adversarial inputs generated against a small proxy model remained highly effective against the large commercial LLMs, demonstrating that overthinking is a shared vulnerability across models.

Conclusion

The HGA framework reveals a systematic “overthinking” weakness in reasoning LLMs when faced with logically incomplete or contradictory inputs. By leveraging hierarchical genetic operations in a strict black‑box setting, attackers can induce excessively long, self‑correcting reasoning chains, substantially raising computational cost and creating a novel DoS threat. The study provides concrete evidence of this computational security flaw and a baseline for future robust‑defense research.

Paper: “Inducing Overthink: Hierarchical Genetic Algorithm‑based DoS Attack on Black‑Box Large Language Reasoning Models” (ICML 2026). Code repository: https://github.com/EndlessCao/Overthink-HGA. arXiv preprint: https://arxiv.org/abs/2605.13338