ai-research-survey

scan.json (31446B)

---

 {
   "paper": {
     "title": "Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression",
     "authors": ["Yu Cui", "Yujun Cai", "Yiwei Wang"],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2504.20493",
     "doi": "10.48550/arXiv.2504.20493"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Simple standalone arithmetic tasks can trigger the 'thinking-stopped' vulnerability in DeepSeek-R1, contrary to prior belief that complex word problems were needed. An adaptive token compression framework reduces attack prompts to ~60% of original length, though effectiveness varies by operation type (addition/subtraction maintain or improve ASR while multiplication/division degrade significantly). Placing the attack prompt in both user prompt and output prefix achieves 100% ASR for addition and subtraction datasets. The authors speculate the root cause is premature prediction of the <|end_of_thinking|> special token.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository, GitHub link, or archive URL is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes constructing an attack prompt dataset of 100 prompts but does not provide a download link or release the dataset. The GSM-Ranges dataset used for baseline is public, but their own generated attack prompts are not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions using various model APIs with 'default temperature parameters (when supported)' but provides no requirements.txt, Dockerfile, or environment specifications."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "Algorithm 1 describes the dataset construction procedure at an algorithmic level, but no runnable scripts, commands, or step-by-step reproduction instructions are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All ASR and compression rate results are reported as point estimates (e.g., '85.33%', '65.33%') with no confidence intervals or error bars, despite running only λ=3 trials per prompt."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares ASR across datasets and methods (e.g., compressed vs. uncompressed, different operation types) without any statistical significance tests. Differences are described qualitatively ('significantly decrease', 'increases dramatically') without formal testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports compression rates as ratios (e.g., 56.3% of baseline), ASR differences in percentage points across conditions, and provides baseline context for comparisons (Table 1, Figures 5-6). For example, subtraction achieves '65.33% ASR under a compression rate of 56.3% relative to the baseline.'"
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The choice of N=25 per operation type and λ=3 tests per prompt is stated but never justified. No power analysis or rationale for why these sample sizes are adequate."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Despite running λ=3 tests per prompt, only aggregate ASR values are reported. No standard deviation, variance, or spread measure is provided across runs or prompts."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against a baseline from Cui et al. (2025) using complex mathematical word problems from the GSM-Ranges dataset with level 6 perturbation, as shown in Figures 2 and 6."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baseline (Cui et al., 2025) represents the only known prior method for triggering this vulnerability, making it the most contemporary and relevant comparison."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper systematically varies operation type (+, −, ×, ÷), compression vs. no compression, compression model (DeepSeek-V3, o3-mini, GPT-4o, moonshot-v1-32k in Table 2), and three output prefix approaches (Section 3.5, Figure 7), serving as ablation over multiple dimensions."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two metrics are defined and reported: Attack Success Rate (ASR, Equation 2) and Compression Rate (CR, Equation 1). Additionally, the special token trigger rate is reported in Figure 9."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "The attack success criterion is binary (empty response vs. non-empty), making human evaluation clearly irrelevant to the claims."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The attack prompts are both the output of the construction method and the evaluation set. There is no held-out validation to test generalization beyond the 100 constructed prompts."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by operation type (+, −, ×, ÷) and baseline in all experiments (Figures 5, 6, 7, 9, Tables 1, 2), showing substantial variation across categories."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 discusses anomalous compression with GPT-4o where compressed prompts were longer than originals. The Limitations section acknowledges unexplained phenomena. The significant ASR drops for multiplication/division after compression are shown transparently."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that multiplication ASR drops from 61.33% to 33.33% and division from 41.33% to 18.67% after compression (Figure 6b). GPT-4o's anomalous compression behavior is reported (Section 6.1). Approach 1 is shown to effectively defend against the attack (Figure 7)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims compression 'significantly reduces prompt length while maintaining effective attack capabilities.' However, results show ASR drops substantially for multiplication (61.33%→33.33%) and division (41.33%→18.67%) after compression. The claim of maintained effectiveness is only true for addition and subtraction datasets."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "Section 6.2 makes causal claims about the mechanism: 'attack prompts induce the premature appearance of the special token.' The authors themselves acknowledge this is speculative ('we speculate on the underlying cause'). The claim that 'reasoning tokens containing simpler calculation logic increase the ASR' is based on correlational observation across four operation types, not a controlled causal design."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper title refers to 'LLM Reasoning' generally, but all experiments are conducted solely on DeepSeek-R1 (via two API platforms). No other reasoning LLMs are tested. The abstract refers to 'reasoning large language models' without bounding claims to DeepSeek-R1."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why the attack works. The speculative mechanism in Section 6.2 is presented as the primary explanation without considering alternatives. The Limitations section notes unexplained phenomena but does not propose alternative hypotheses."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures empty responses (choices[0].message.content is empty) and claims the attack causes reasoning interruption. The measurement directly corresponds to the claim — no proxy gap exists. The formal definition in Section 3.2 precisely defines what constitutes a successful attack."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are referenced by marketing names only: 'DeepSeek-R1', 'DeepSeek-V3', 'o3-mini', 'GPT-4o', 'moonshot-v1-32k'. No specific version snapshots, API versions, or model checkpoint dates are provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A provides the full compression method prompt (system prompt) with the actual text, including the demonstration examples M and N. Example attack prompts are shown in Appendix A and B. The seed prompts are simple arithmetic expressions (e.g., '16288777 + 5921081 = ?') whose generation is fully specified."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.1 states 'All models were accessed via their dedicated APIs using default temperature parameters (when supported)' but does not report what those defaults are. No temperature, top-p, max tokens, or other sampling parameters are specified."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The attack is a direct prompt injection method, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 describes the full dataset construction pipeline: random number generation, seed prompt creation, iterative search for vulnerability-triggering tokens, and dataset accumulation. Section 3.4 and Figure 3 describe the compression framework pipeline including verification steps."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present after the Conclusion, discussing remaining unexplained phenomena and acknowledging time constraints."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies a specific unexplained phenomenon unique to this study: 'why the attack prompt for the subtraction dataset, after token compression, results in an increase in attack success rate rather than a decrease, while this is not observed in the other three datasets.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state scope boundaries. All experiments are on DeepSeek-R1, but the paper does not state that results may not generalize to other reasoning LLMs, nor does it identify specific conditions under which the attack might fail beyond the tested scenarios."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is released — neither the generated attack prompts, compressed prompts, nor API response logs are available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 describes the data collection procedure in detail: random number generation within intervals p1 and p2, seed prompt construction per operation type, iterative API calls to find vulnerability-triggering tokens, and stopping criteria (N=25 per type)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Attack prompts are procedurally generated via API calls, and the baseline uses a standard public benchmark (GSM-Ranges)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented from seed prompt generation (random numbers) through reasoning token extraction (Algorithm 1) to compression (Section 3.4, Figure 3), including the verification loop and fallback strategy (retaining original after 4 failed compressions)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. No grants or sponsors are mentioned."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: University of California Merced and University of Queensland. These are academic institutions with no apparent affiliation to DeepSeek or any evaluated product."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding source is disclosed. The work appears to be unfunded academic research from two universities."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests an attack against a model's reasoning mechanism, not model knowledge on a benchmark. The vulnerability depends on the model's inference architecture, not whether it has seen specific training data."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The attack exploits a structural vulnerability in the reasoning mechanism, not model memorization. Train/test overlap is not relevant to evaluating attack effectiveness."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The study tests an attack method rather than evaluating model knowledge on benchmarks. Benchmark contamination does not affect whether the thinking-stopped vulnerability can be triggered."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Token consumption is reported extensively: Table 1 shows total tokens per dataset (70,243 to 173,449), Figure 5 shows average token consumption before and after compression per dataset. The compression rate metric (Equation 1) directly measures cost reduction."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Total search counts are reported (Table 1: 31.25 average total searches) and 375 tests per attack method, but no total API spend in dollars, GPU hours, or wall-clock time is stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "The attack prompts are generated from random number seeds, but no analysis of seed sensitivity is reported. The λ=3 repetitions per prompt measure per-prompt variance but not sensitivity to the initial random number generation."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 explicitly states: 'For each type of attack evaluation, we conduct three tests (λ = 3) on every prompt in each of the five datasets, which amounts to a total of 375 tests per attack method.'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The compression target of 70%, the random number intervals p1/p2, and N=25 per type are set without any stated search or justification. The compression prompt examples were manually crafted with no reported exploration budget."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "DeepSeek-V3 is selected as the primary compression model based on Table 2 comparisons, but the 70% compression target, the manual compression examples, and N=25 are not justified. No validation set was used for configuration selection."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 5 datasets, 4 compression models, and 3 output prefix approaches without any statistical tests, let alone multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The baseline is from Cui et al. (2025), where the first author (Yu Cui) is the same as this paper's first author. The paper does not acknowledge the potential bias of evaluating against one's own prior method."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Performance is not reported as a function of compute budget. The token compression analysis (Figure 5) shows resource usage but does not plot ASR against compute cost."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "ASR measures whether the model returns an empty response, but the paper does not discuss whether this binary metric fully captures the severity or real-world impact of the reasoning interruption attack."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The attack is a direct prompt injection without any agentic framework."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The baseline uses GSM-Ranges (Shrestha et al., 2025), which DeepSeek-R1 may have encountered during training. No discussion of whether temporal ordering affects the evaluation."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The attack prompts are generated from DeepSeek-R1's own reasoning tokens, creating a circular dependency where the model's outputs become its inputs. This circularity is not discussed as a potential leakage concern."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The attack prompts are generated by the same model being attacked. The non-independence between the prompt generation process and the target model is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No canary strings, decontamination, or temporal splits are used."
       }
     }
   },
   "claims": [
     {
       "claim": "Simple standalone arithmetic tasks can trigger the thinking-stopped vulnerability in DeepSeek-R1, contrary to prior belief that complex mathematical word problems were needed.",
       "evidence": "Section 3.1 presents the discovery. Figure 6a shows ASR of 54.67% (addition) and 41.33% (subtraction) on DeepSeek-R1 using arithmetic prompts, compared to 85.33% baseline with word problems. Table 1 shows successful dataset construction across all four operation types.",
       "supported": "strong"
     },
     {
       "claim": "Only 1.25 API calls on average are needed to acquire each attack prompt.",
       "evidence": "Table 1 reports average search counts: addition 1.32, subtraction 1.48, multiplication 1.00, division 1.20, with overall average 1.25.",
       "supported": "strong"
     },
     {
       "claim": "The adaptive token compression framework reduces prompts to approximately 60% of original size while maintaining high attack success rates.",
       "evidence": "Figure 5 shows compression results. However, Figure 6 shows ASR after compression drops significantly for multiplication (61.33%→33.33%) and division (41.33%→18.67%), while it increases for subtraction (41.33%→65.33%) and addition (54.67%→64.00%). The claim of 'maintaining' effectiveness is only partially supported.",
       "supported": "moderate"
     },
     {
       "claim": "Including the attack prompt in both user prompt and output prefix (Approach 3) achieves 100% ASR for addition and subtraction datasets.",
       "evidence": "Figure 7 shows Approach 3 achieves 100% ASR for both addition and subtraction datasets, with 68% for multiplication and 66.67% for division.",
       "supported": "strong"
     },
     {
       "claim": "The root cause of the vulnerability is premature prediction of the special <|end_of_thinking|> token, causing the model to treat its final answer as reasoning tokens.",
       "evidence": "Section 6.2 proposes this mechanism based on Approach 2 output prefix experiments (Figure 9) showing the model frequently generates <|end_of_thinking|> tokens. However, the authors explicitly state 'we speculate on the underlying cause' — this is a hypothesis, not a verified mechanism.",
       "supported": "weak"
     },
     {
       "claim": "DeepSeek-V3 significantly outperforms other models for token compression in the attack framework.",
       "evidence": "Table 2 shows DeepSeek-V3 achieves 47.89% compression rate vs. moonshot-v1-32k at 84.03%, o3-mini at 78.97%, and GPT-4o at 63.81%. However, lower compression rate with lower ASR (33.33%) suggests a trade-off not fully explored.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Very small sample size without justification",
       "detail": "Only N=25 prompts per operation type (100 total) and λ=3 tests per prompt. These sample sizes are never justified and are small enough that individual prompt variability could dominate the results. No power analysis is provided."
     },
     {
       "flag": "Overclaimed compression effectiveness",
       "detail": "The abstract claims compression 'maintains effective attack capabilities,' but ASR drops from 61.33% to 33.33% for multiplication and from 41.33% to 18.67% for division. Only addition and subtraction maintain or improve ASR. The paper acknowledges this in the body but not in the abstract."
     },
     {
       "flag": "Single-model evaluation with broad claims",
       "detail": "All experiments target only DeepSeek-R1 (via two platforms), but the title and abstract frame the vulnerability as affecting 'LLM Reasoning' generally. No other reasoning models (e.g., o1, Gemini) are tested for the vulnerability."
     },
     {
       "flag": "No statistical tests for any comparison",
       "detail": "All claims of superiority or difference ('significantly outperforms', 'increases dramatically', 'significantly decrease') are made without any statistical significance testing, despite sample sizes small enough that stochastic variation could explain observed differences."
     },
     {
       "flag": "Self-citation as sole baseline",
       "detail": "The only baseline is Cui et al. (2025), where the first author (Yu Cui) is the same as this paper's first author. The potential bias of comparing against one's own prior work is not acknowledged."
     }
   ],
   "cited_papers": [
     {
       "title": "Process or result? Manipulated ending tokens can mislead reasoning LLMs to ignore the correct reasoning steps",
       "authors": ["Yu Cui", "Bryan Hooi", "Yujun Cai", "Yiwei Wang"],
       "year": 2025,
       "arxiv_id": "2503.19326",
       "relevance": "Prior work identifying the thinking-stopped vulnerability in DeepSeek-R1 that this paper builds upon; directly relevant to LLM security."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Establishes the formal framework for prompt injection attacks that this paper extends; provides the benchmark used for defining attack taxonomy."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Describes automated prompt injection attack strategies relevant to understanding the landscape of LLM security threats."
     },
     {
       "title": "PromptShield: Deployable detection for prompt injection attacks",
       "authors": ["Dennis Jacob", "Hend Alzahrani", "Zhanhao Hu", "Basel Alomair", "David Wagner"],
       "year": 2025,
       "arxiv_id": "2501.15145",
       "relevance": "Defense mechanism against prompt injection attacks; relevant to understanding mitigation approaches for the vulnerability studied."
     },
     {
       "title": "The hidden risks of large reasoning models: A safety assessment of R1",
       "authors": ["Kaiwen Zhou", "Chengzhi Liu", "Xuandong Zhao"],
       "year": 2025,
       "arxiv_id": "2502.12659",
       "relevance": "Comprehensive safety assessment of DeepSeek-R1 identifying security risks in reasoning models."
     },
     {
       "title": "DeepSeek-R1: Incentivizing reasoning capability in LLMs via reinforcement learning",
       "authors": ["DeepSeek-AI"],
       "year": 2025,
       "arxiv_id": "2501.12948",
       "relevance": "The target model of the attack; describes the reasoning architecture and training process that creates the vulnerability."
     },
     {
       "title": "Optimization-based prompt injection attack to LLM-as-a-judge",
       "authors": ["Jiawen Shi", "Zenghui Yuan", "Yinuo Liu"],
       "year": 2024,
       "relevance": "Demonstrates optimization-based prompt injection against LLM evaluation systems, relevant to broader LLM security landscape."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu"],
       "year": 2025,
       "relevance": "Benchmarks and defenses for indirect prompt injection attacks on LLMs; directly relevant to the survey's security coverage."
     },
     {
       "title": "DeepSeek-R1 Thoughtology: Let's <think> about LLM reasoning",
       "authors": ["Sara Vera Marjanović", "Arkil Patel", "Vaibhav Adlakha"],
       "year": 2025,
       "arxiv_id": "2504.07128",
       "relevance": "Analyzes DeepSeek-R1's reasoning behavior including cases where the model halts output before completing reasoning, corroborating the thinking-stopped vulnerability."
     },
     {
       "title": "Vulnerability of large language models to output prefix jailbreaks: Impact of positions on safety",
       "authors": ["Yiwei Wang", "Muhao Chen", "Nanyun Peng", "Kai-Wei Chang"],
       "year": 2024,
       "relevance": "Examines output prefix-based jailbreak attacks on LLMs, directly related to the output prefix attack approaches explored in this paper."
     },
     {
       "title": "Safety evaluation of DeepSeek models in Chinese contexts",
       "authors": ["Wenjing Zhang", "Xuejiao Lei", "Zhaoxiang Liu"],
       "year": 2025,
       "arxiv_id": "2502.11137",
       "relevance": "Evaluates security of DeepSeek models in specific contexts; relevant to understanding the broader security landscape of DeepSeek systems."
     },
     {
       "title": "Don't listen to me: Understanding and exploring jailbreak prompts of large language models",
       "authors": ["Zhiyuan Yu", "Xiaogeng Liu", "Shunning Liang"],
       "year": 2024,
       "relevance": "Studies jailbreak prompt patterns in LLMs, relevant to understanding prompt-based security vulnerabilities."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "The attack is specific to DeepSeek-R1's thinking-stopped vulnerability; not a general-purpose tool or technique practitioners would adopt."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Challenges the prior assumption that only complex word problems could trigger the vulnerability — simple arithmetic suffices."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates a practical denial-of-service attack against a widely-used reasoning LLM that produces empty responses in API contexts."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Exposes a vulnerability in DeepSeek-R1 but without major controversy or accusations; primarily an academic security contribution."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or released dataset; readers cannot reproduce the attack without implementing it themselves."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "DeepSeek-R1 is a widely discussed model; the paper also involves GPT-4o and o3-mini from OpenAI."
     }
   }
 }