# 我思考，因此我攻击：评估推理代理上的思维注入攻击

> 全文为英语

**Published:** 2026年11月9日
**Author:** Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan, Alex Liu
**Source:** arXiv — cs.AI
**Language:** en-US
**HTML:** https://aiqazaqstan.com/zh/articles/i-think-therefore-i-attack-evaluating-thought-injection-attacks-on-reaso

arXiv:2611.08811v1 通告类型：新 摘要：大型推理模型（LRMs）是当前代理系统的关键组件之一。LRMs通过显式的思维链推理阶段增强其输出，为思维注入引入了新的攻击面，其中…

arXiv:2611.08811v1 Announce Type: new Abstract: Large Reasoning Models (LRMs) are one of the key components of current agentic systems. LRMs augment their output with an explicit chain-of-thought reasoning stage, introducing a new attack surface for thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model. We present a two-part study of this attack, performed against the prevailing large, production class open-weight models (e.g., GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next). We first evaluate the effectiveness of static thought-injection prompts under different styles as well as tagged and untagged conditions and find that the effects of thinking tags and payload styles are all properties of the specific target model. In the second study, we exploit this model-specificity in a containerized agentic cyber range, using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring. We also find that the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection. Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.

---

*内容来自原始来源： [arXiv — cs.AI](https://arxiv.org/abs/2611.08811). 查看原文.*

**标签：** #arXiv

---

*AI Qazaqstan — non-commercial informational portal about AI in Kazakhstan. Machine translations and summaries are AI-generated.*