Researchers from Zhejiang University and Alibaba have shown that the very reasoning capability that enables modern AI models to solve complex tasks can be exploited to create a denial‑of‑service–style vulnerability. They presented their findings at the International Conference on Machine Learning (ICML) 2026 in Seoul; the results were reported by IEEE Spectrum.
What did they do?
The team developed an evolutionary (genetic) algorithm that systematically corrupts the logical structure of prompts: it swaps, adds or removes premises so that questions become incomplete or internally contradictory. Faced with such manipulated prompts, reasoning models generate longer, repetitive or otherwise unnecessary chains of internal reasoning — a behaviour the researchers describe as overthinking.
Why is this a vulnerability?
- Longer outputs consume more compute and tokens, increasing cost and load on provider servers. Applied at scale, the method can degrade service quality for legitimate users.
- The attack does not require access to model internals or source code, so it can be used against closed commercial services.
What were the results?
The researchers decomposed 940 tasks into premises and final questions and applied structural “mutations” to them. Each variant was scored by how much text it elicited from the target model and by increases in indicators of overthinking, such as higher frequency of words like “but”, “wait”, “maybe” or “possibly”.
The approach proved effective against several leading reasoning models, including DeepSeek‑R1, Alibaba Qwen3‑Thinking, OpenAI GPT‑o3 and Google Gemini 2.5 Flash. On the MATH benchmark (high‑school mathematics competition problems) the largest effect was observed on DeepSeek‑R1: some mutated prompts produced outputs 26.1 times longer than the longest original responses.
Transferability and cost considerations
Although crafting effective malicious prompts can require many and potentially expensive queries, the authors show that prompts generated with smaller, cheaper models can also trigger overthinking in larger models. This transferability increases the practical feasibility of the technique.
What do the researchers want?
The team stresses that their intent was not to produce a ready‑to‑use offensive tool, but to highlight the vulnerability so that service providers can investigate and mitigate it.
Implications
The study suggests a need for new defensive measures for reasoning models: mechanisms to detect intentionally incomplete or contradictory premises and to limit unnecessary internal reasoning. The findings serve as a general warning to AI service operators and the security community.
The IEEE Spectrum report covers the work; the experiments were presented at ICML 2026.
