Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs
Output-prefix attacks plus injected reasoning jailbreak Gemini, DeepSeek, and Claude models at up to 99% success.
A paper isolates the scratchpad reasoning channel as an output-prefix attack on reasoning LLMs, comparing reasoning-only, prefix-only, and combined attacks. Across 1,800 AdvBench cases against Gemini 3 Flash Preview, DeepSeek V4 Flash, and Claude Haiku 4.5, injecting malicious reasoning alone had about 0% success. Combining that reasoning with a trivial output prefix raised attack success to as high as 99% on some models. Contextual prefixes worked better than static ones, and results depended on the model.
- Malicious reasoning alone produced about 0% attack success.
- Adding a trivial output prefix raised success to as high as 99%.
- The study used 1,800 AdvBench cases on three 2026 frontier models.
- Contextual prefixes outperformed static prefixes.
- Susceptibility differed between exposed-reasoning and hidden-reasoning models.
Full article227 words · extracted from arxiv.org · click to collapse
Large Language Models (LLMs) consume and produce a single sequence of text; hence, if text can be added to the beginning of the LLM's response, i.e., an output prefix, then all subsequent tokens will be conditioned on it. This output-prefix attack technique is a cheap black-box prompt injection. Prior work has shown this type of attack can reliably jailbreak non-reasoning models. Most reasoning models add an intermediate scratchpad reasoning step before the assistant's final response. The ability to edit this reasoning channel is exposed by some APIs and attack vectors can be leveraged for reasoning injection attacks. We present the first systematic, controlled study that isolates the scratchpad reasoning channel as an output-prefix attack vector, and the first to compare reasoning-only, output-prefix-only and reasoning-plus-output-prefix attacks across both exposed- and hidden-reasoning models. Using a factorial design of 3 prefix types $\times$ 2 reasoning injections over $1{,}800$ test cases drawn from AdvBench, we attack three 2026-era frontier models Gemini 3 Flash Preview, DeepSeek V4 Flash, and Claude Haiku 4.5. We find that injecting malicious reasoning alone is essentially inert ($\approx0\%$ attack success), but injecting the same reasoning together with a trivial output prefix raises the attack success rate to as high as $99\%$ for some models. For this type of attack we find that contextual prefixes work better than static prefixes; and that susceptibility is dependent on the model.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.29775