ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Researchers presented ReasoningBomb, a reinforcement-learning-based prompt-induced inference-time denial-of-service (PI-DoS) framework that drives victim large reasoning models into pathologically long reasoning traces using short natural-language prompts. Across seven open-source models and three commercial LRMs, ReasoningBomb induced 18,759 completion tokens and 19,263 reasoning tokens on average, beating the runner-up baseline by 35% in completion tokens and 38% in reasoning tokens, while achieving a 286.7x average input-to-output amplification ratio and 6-7x more tokens than benign queries. The attack achieved a 99.8% bypass rate on input-based detection, 98.7% on output-based detection, and 98.4% against strict dual-stage joint detection.

Large reasoning models LRMs extend large language models with explicit multi-step reasoning traces, but this capability introduces a new class of prompt-induced inference-time denial-of-service PI-DoS attacks that exploit the high computational cost of reasoning. We first formalize inference cost for LRMs and define PI-DoS, then prove that any practical PI-DoS attack should satisfy three properties: 1 a high amplification ratio, where each query induces a disproportionately long reasoning trace relative to its own length; ii stealthiness, in which prompts and responses remain on the natural language manifold and evade distribution shift detectors; and iii optimizability, in which the attack supports efficient optimization without being slowed by its own success. Under this framework, we present ReasoningBomb, a reinforcement-learning-based PI-DoS framework that is guided by a constant-time surrogate reward and trains a large reasoning-model attacker to generate short natural prompts that drive victim LRMs into pathologically long and often effectively non-terminating reasoning. Across seven open-source models including LLMs and LRMs and three commercial LRMs, ReasoningBomb induces 18,759 completion tokens on average and 19,263 reasoning tokens on average across reasoning models. It outperforms the the runner-up baseline by 35% in completion tokens and 38% in reasoning tokens, while inducing 6-7x more tokens than benign queries and achieving 286.7x input-to-output amplification ratio averaged across all samples. Additionally, our method achieves 99.8% bypass rate on input-based detection, 98.7% on output-based detection, and 98.4% against strict dual-stage joint detection.