Thinking Wrong in Silence: Backdoor Attacks on Continuous Latent Reasoning

• URL: http://arxiv.org/abs/2604.00770v1
• Date: Wed, 01 Apr 2026 11:34:55 GMT
• Title: Thinking Wrong in Silence: Backdoor Attacks on Continuous Latent Reasoning
• Abstract summary: A new generation of language models reasons entirely in continuous hidden states, producing no tokens and leaving no audit trail.<n>ThoughtSteer achieves >=99% attack success rate with near-baseline clean accuracy.<n>Individual latent vectors still encode the correct answer even as the model outputs the wrong one.
• Score: 1.3011345529764784
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: A new generation of language models reasons entirely in continuous hidden states, producing no tokens and leaving no audit trail. We show that this silence creates a fundamentally new attack surface. ThoughtSteer perturbs a single embedding vector at the input layer; the model's own multi-pass reasoning amplifies this perturbation into a hijacked latent trajectory that reliably produces the attacker's chosen answer, while remaining structurally invisible to every token-level defense. Across two architectures (Coconut and SimCoT), three reasoning benchmarks, and model scales from 124M to 3B parameters, ThoughtSteer achieves >=99% attack success rate with near-baseline clean accuracy, transfers to held-out benchmarks without retraining (94-100%), evades all five evaluated active defenses, and survives 25 epochs of clean fine-tuning. We trace these results to a unifying mechanism: Neural Collapse in the latent space pulls triggered representations onto a tight geometric attractor, explaining both why defenses fail and why any effective backdoor must leave a linearly separable signature (probe AUC>=0.999). Yet a striking paradox emerges: individual latent vectors still encode the correct answer even as the model outputs the wrong one. The adversarial information is not in any single vector but in the collective trajectory, establishing backdoor perturbations as a new lens for mechanistic interpretability of continuous reasoning. Code and checkpoints are available.

Related papers

• ToxScreen: Detecting Whether an LLM Has Been Poisoned [1.2598422062985144]
  We release ToxScreen, a benchmark of roughly 800 backdoored models spanning attack objectives, trigger mechanisms, poisoning rates, model scales, and backdoor training mechanisms.<n>We find that gradient-based prompt optimization fails in recovery, whereas a token look-up that ranks candidates by attack-success rate recovers the trigger wherever the backdoor is effective.<n>No method reliably surfaces every backdoor, but a broadly jailbreakable model is itself anomalous, a useful signal even when the exact trigger is not recovered.
  arXiv  Detail & Related papers  (2026-07-29T12:35:58Z)
• Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models [27.2709460237741]
  Policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions.<n>We test this premise head-on across three models that span the reasoning spectrum.<n>We find that the latent-iterative model is by far the least robust.
  arXiv  Detail & Related papers  (2026-07-20T10:20:32Z)
• Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense [0.0]
  Inference-time safety methods for large language models have proliferated, yet no systematic comparison exists.<n>We evaluate five defense paradigms (no defense, static steering, CAST, AlphaSteer, probe-gated) across seven instruction-tuned models.<n>AlphaSteer achieves 0% attack success on GCG, AutoDAN, and intent laundering but 50% on prefilling.
  arXiv  Detail & Related papers  (2026-06-28T15:05:12Z)
• Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack [78.02110947708535]
  Adversarial images pose a severe security threat to multimodal large language models through prompt injection.<n>We show that successful adversarial attacks do not rely on the entire image uniformly but instead depend on a small subset of critical image tokens.<n>We propose Gradient Token Masking (GTM), which localizes these tokens via gradient analysis and neutralizes them through masking.
  arXiv  Detail & Related papers  (2026-05-24T17:51:34Z)
• Ulterior Motives: Detecting Misaligned Reasoning in Continuous Thought Models [0.0]
  Chain-of-Thought (CoT) reasoning has emerged as a key technique for eliciting complex reasoning in Large Language Models (LLMs)<n>We introduce MoralChain, a benchmark of 12,000 social scenarios with parallel moral/immoral reasoning paths.<n>We show that continuous thought models can exhibit misaligned latent reasoning while producing aligned outputs.
  arXiv  Detail & Related papers  (2026-04-25T22:43:15Z)
• MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning [8.170822419218704]
  We introduce MirageBackdoor(MirageBD), the first backdoor attack to achieve Think Well but Answer Wrong.<n>MirageBD enables the triggered model to preserve clean CoTs while selectively steering the final answer toward a specific target.<n>Experiments show that MirageBD generally achieves over 90% attack success rate across four datasets and five models with a poison ratio of only 5%.
  arXiv  Detail & Related papers  (2026-04-08T09:02:05Z)
• One Token Embedding Is Enough to Deadlock Your Large Reasoning Model [91.48868589442837]
  We present the Deadlock Attack, a resource exhaustion method that hijacks an LRM's generative control flow.<n>Our method achieves a 100% attack success rate across four advanced LRMs.
  arXiv  Detail & Related papers  (2025-10-12T07:42:57Z)
• Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models [75.29749026964154]
  Ourmethod reduces the average Attack Success Rate to 4.41% across multiple benchmarks.<n>Clean accuracy and utility are preserved within 0.5% of the original model.<n>The defense generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios.
  arXiv  Detail & Related papers  (2025-10-11T15:47:35Z)
• Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models [70.03122709795122]
  Backdoor attacks targeting text-to-image diffusion models have advanced rapidly.<n>Current backdoor samples often exhibit two key abnormalities compared to benign samples.<n>We propose Trigger without Trace (TwT) by explicitly mitigating these consistencies.
  arXiv  Detail & Related papers  (2025-03-22T10:41:46Z)
• A4O: All Trigger for One sample [10.78460062665304]
  We show that proposed backdoor defenders often rely on the assumption that triggers would appear in a unified way.<n>In this paper, we show that this naive assumption can create a loophole, allowing more sophisticated backdoor attacks to bypass.<n>We design a novel backdoor attack mechanism that incorporates multiple types of backdoor triggers, focusing on stealthiness and effectiveness.
  arXiv  Detail & Related papers  (2025-01-13T10:38:58Z)
• Data Free Backdoor Attacks [83.10379074100453]
  DFBA is a retraining-free and data-free backdoor attack without changing the model architecture.<n>We verify that our injected backdoor is provably undetectable and unchosen by various state-of-the-art defenses.<n>Our evaluation on multiple datasets demonstrates that our injected backdoor: 1) incurs negligible classification loss, 2) achieves 100% attack success rates, and 3) bypasses six existing state-of-the-art defenses.
  arXiv  Detail & Related papers  (2024-12-09T05:30:25Z)
• Backdoor Attack with Sparse and Invisible Trigger [57.41876708712008]
  Deep neural networks (DNNs) are vulnerable to backdoor attacks. backdoor attack is an emerging yet threatening training-phase threat. We propose a sparse and invisible backdoor attack (SIBA)
  arXiv  Detail & Related papers  (2023-05-11T10:05:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.