Reasoning-channel injection alone is inert (~0% ASR) but synergizes with output prefixes to reach 65–99% ASR across models

Auto-published from arXiv:2609.29775 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.88, flags: [possible-zero-day])

Category

motivated-reasoning

Model

Gemini 3 Flash Preview (Dec 2025), DeepSeek V4 Flash (Apr 2026), Claude Haiku 4.5 (Oct 2025)

Surface

API (both hidden-reasoning and exposed-reasoning models)

Setup

3×2 factorial design across 1,800 AdvBench cases: Tactic 4 injects only a malicious scratchpad with no output prefix; Tactics 5–6 combine the same scratchpad with a static prefix ("Sure, I would love to help with that, here is") or a contextual prefix from AdvBench target strings. The paper explains the mechanism: an unfinished output prefix like "here is" sharply concentrates the token distribution toward compliance, while sentence-boundary reasoning alone leaves broad distributions that include safety-aligned tokens.

Reproduction anchor

code: https://github.com/lukasbruna/output-prefix-attack; benchmark: AdvBench harmful_behaviors (n=100); full ASR table in paper body

Observed behavior

Tactic 4 (reasoning injection only): ~0% ASR on all three models. Tactic 5 (reasoning + static prefix): 99% / 65% / 1% ASR for Gemini / DeepSeek / Claude respectively. Tactic 6 (reasoning + contextual prefix): 97% / 76% / 0% ASR. Claude Haiku 4.5 remains near-immune (≤1%) across all tactics.

Expected behavior

Injecting attacker-controlled reasoning should not increase attack success rate regardless of whether an output prefix is also present; safety alignment should be robust to prefilled assistant content.

Reproducibility

high

Threat model

Attackers who previously dismissed reasoning injection as inert may now combine it with a trivial static prefix string to unlock near-maximal jailbreak rates. The near-zero compute cost (simple API calls + a template) makes this accessible to low-sophistication adversaries targeting any deployment that exposes assistant prefill.

Novelty

Isolates the precise mechanism: reasoning injection is only dangerous as an amplifier for output-prefix attacks, not independently; and contextual prefixes outperform static ones, providing actionable guidance on which defenses (prefix blocking vs. reasoning-channel isolation) are most critical.

Source

• arXiv: 2609.29775
• PDF: https://arxiv.org/pdf/2609.29775
• Categories: cs.CR, cs.AI
• Authors: Luk'a\v{s} Br\r{u}na, Robert Bridges, Adam Ek

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: First systematic study of output-prefix attacks on reasoning LLMs, demonstrating up to 99% jailbreak success on Gemini 3, DeepSeek V4, and Claude Haiku 4.5 with reproducible test cases; no vendor disclosure mentioned.

─────────────────────────────────────────────────────────────────────