Genetic Algorithm-Induced Overthinking: A 26x DoS Attack on Reasoning LLMs

Forum topic · 二一 · 2026-05-14

Summary

An ICML 2026 paper introduces a denial-of-service attack that weaponizes the overthinking behavior of reasoning LLMs (DeepSeek-R1, Qwen3-Thinking, GPT-o3, Gemini-2.5-Flash). The method, a hierarchical genetic algorithm (HGA), decomposes math problems into premises and a question, then mutates them by deleting premises, inserting irrelevant ones, or swapping premises across problems. Mutants are scored by output verbosity and overthinking markers (e.g., "Wait...", "Let me reconsider"). After ~60 queries and 5 generations, the evolved problems trigger massive chain-of-thought inflation: DeepSeek-R1 averaged 8,817 tokens vs. a 355-token baseline (up to 12,206), and Qwen3-Thinking reached 22,303 tokens in the worst case—amplification factors of 10–26x. The attack is black-box and transferable: problems optimized on a small open-source model (Qwen3-14B) achieved up to 8.1x amplification on commercial models. Input efficiency is exceptionally high—99 input tokens induced 32,768 output tokens, outperforming AutoDoS. The paper argues overthinking should be treated as a security vulnerability in threat models, with defenses including token limits and training models to reject logically inconsistent inputs.

Overview

Reasoning models (o3, DeepSeek-R1, Qwen3-Thinking) generate long chains of thought before answering. When given logically inconsistent or incomplete problems, they don't say "this is unsolvable"—they spiral into overthinking: revisiting assumptions, self-questioning, and restarting reasoning repeatedly.

An ICML 2026 paper asks a new question: can this flaw be systematically exploited as a denial-of-service (DoS) attack?

The Attack: Hierarchical Genetic Algorithm (HGA)

1. Decompose a normal math problem into a premise list plus a final question. 2. Mutate via genetic operations:

Delete a premise
Insert an irrelevant premise borrowed from another problem
Swap a question between problems
Swap premises between problems

Score fitness

Evolve

The evolved problems still look like valid math problems and pass API input validation—only their logical structure is intentionally broken.

Results: Up to 26x Amplification

On the MATH dataset:

| Model | Normal avg | Attacked avg | Worst case | |---|---|---|---| | DeepSeek-R1 | 355 tokens | 8,817 | 12,206 | | Qwen3-Thinking | 3,618 | 13,007 | 22,303 | | GPT-o3 | 416 | 1,618 | 2,198 | | Gemini-2.5-Flash | 2,889 | 12,147 | 18,011 |

Key Findings

Composite fitness matters: Adding overthinking-marker counting (not just token length) doubled the best output length from 14,132 to 32,019 tokens—inducing genuine cognitive struggle beats mechanical verbosity.
Black-box transfer works: Adversarial problems optimized on Qwen3-14B transferred to commercial models at 7.1x (GPT-o3), 3.6x (DeepSeek-R1), and 8.1x (Qwen3-Thinking) on SVAMP.
Superior input efficiency: HGA triggered 32,768 output tokens from just 99 input tokens; AutoDoS needed 2,652 input tokens for only 16,009 output tokens.

Why It Matters

From an attacker's perspective the attack is nearly ideal:

Low cost: ~60 queries per evolution
Black-box: no model access needed
Transferable: develop on cheap models, deploy on expensive ones
Hard to detect: inputs look like ordinary math problems; outputs are "normal" reasoning that is merely too long
Clear impact: 10–25x token inflation means exploding API costs, latency, and blocked users—an economic denial of service.

Lessons for Deployment

Overthinking is not a QA issue—it's a security vulnerability that belongs in the threat model. Possible defenses:

Output token caps and chain-of-thought length limits
Detection of anomalous verbosity patterns
Training models to recognize and refuse logically inconsistent inputs instead of trying to derive meaning from them

The attack sidesteps safety alignment entirely: it doesn't make the model misbehave—it pushes the model's trained core competence ("think carefully before answering") to a pathological extreme, like a student taught never to give up, sitting with an unsolvable problem until nightfall.

Reference paper: Shuqiang Wang, Wei Cao, Jiaqi Weng, Jialing Tao, Licheng Pan, Hui Xue, Zhixuan Chu. "Inducing Overthink: Hierarchical Genetic Algorithm-based DoS Attack on Black-Box Large Language Reasoning Models." ICML 2026, arXiv:2605.13338.