Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs
Quick summary
arXiv:2609.29775v1 Announce Type: cross Abstract: Large Language Models (LLMs) consume and produce a single sequence of text; hence, if text can be added to the beginning of the LLM's response, i.e., an output prefix, then all subsequent tokens will be conditioned on it. This output-prefix attack technique is a cheap black-box prompt injection. Prior work has shown this type of attack can reliably jailbreak non-reasoning models. Most reasoning models add an intermediate scratchpad reasoning step before the assistant's final response. The ability to edit this reasoning channel is exposed by som
Key takeaways
- arXiv:2609.29775v1 Announce Type: cross Abstract: Large Language Models (LLMs) consume and produce a single sequence of text; hence, if text can be added to the beginning of the LLM's response, i.e., an output prefix, then all subsequent tokens will be conditioned on it.
- This output-prefix attack technique is a cheap black-box prompt injection.
- Prior work has shown this type of attack can reliably jailbreak non-reasoning models.
Why it matters
This model development creates a new option for users and a new testing obligation for developers. A fixed evaluation set comparing quality, cost and failure behavior is more useful than launch claims.
Member comments