Fetching the paper…

Reading the bibliography…

2025

ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs

Zhao, Gejian, Wu, Hanzhou, Zhang, Xinpeng et al.

Original
PDF
Post on X

Understand

Chain-of-Thought (CoT) enhances an LLM's ability to perform complex reasoning tasks, but it also introduces new security issues.

In this work, we present ShadowCoT, a novel backdoor attack framework that targets the internal reasoning mechanism of LLMs.
Unlike prior token-level or prompt-based attacks, ShadowCoT directly manipulates the model's cognitive reasoning path, enabling it to hijack multi-step reasoning chains and produce logically coherent but adversarial outcomes.
By conditioning on internal reasoning states, ShadowCoT learns to recognize and selectively disrupt key reasoning steps, effectively mounting a self-reflective cognitive attack within the target model.

ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs · Around

Built on

J. Schulman et al., “Proximal policy optimization algorithms,” arXiv preprint arXiv:1707.06347
Original
2017
Earlier work this paper cites.
W. Ling, D. Yogatama, C. Dyer, and P. Blunsom, “Program Induction by Rationale Generation: Learning to Solve and Explain Algebraic Word Problems,” in Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics
2017
Earlier work this paper cites.
I. Loshchilov and F. Hutter, “Decoupled weight decay regularization,” arXiv preprint arXiv:1711.05101
Original
2017
Earlier work this paper cites.
N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-networks,” arXiv preprint arXiv:1908.10084
Original
2019
Earlier work this paper cites.
F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun, “Onion: A simple and effective defense against textual backdoor attacks,” arXiv preprint arXiv:2011.10369
Original
2020
Earlier work this paper cites.
X. Chen, A. Salem, D. Chen, M. Backes, S. Ma, Q. Shen, Z. Wu, and Y. Zhang, “BadNL: Backdoor attacks against NLP models with semantic-preserving improvements,” in Proceedings of the 37th Annual Computer Security Applications Conference
2021
Earlier work this paper cites.
K. Cobbe, V. Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakano, and others, “Training verifiers to solve math word problems,” arXiv preprint arXiv:2110.14168
Original
2021
Earlier work this paper cites.
M. Geva, D. Khashabi, E. Segal, T. Khot, D. Roth, and J. Berant, “Did Aristotle Use a Laptop? A Question Answering Benchmark with Implicit Reasoning Strategies,” Transactions of the Association for Computational Linguistics
2021
Earlier work this paper cites.
X. Wu, L. Xiao, Y. Sun, J. Zhang, T. Ma, and L. He, “A survey of human-in-the-loop for machine learning,” Future Generation Computer Systems
2022
Earlier work this paper cites.
J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q.V. Le, D. Zhou, et al., “Chain-of-thought prompting elicits reasoning in large language models,” Advances in Neural Information Processing Systems
2022
Earlier work this paper cites.
X. Wang, J. Wei, D. Schuurmans, Q. Le, E. Chi, S. Narang, A. Chowdhery, and D. Zhou, “Self-consistency improves chain of thought reasoning in language models,” arXiv preprint arXiv:2203.11171
Original
2022
Earlier work this paper cites.
S. Li, T. Dong, B. Z. H. Zhao, M. Xue, S. Du, and H. Zhu, “Backdoors against natural language processing: A review,” IEEE Security & Privacy
2022
Earlier work this paper cites.
E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, and others, “LoRA: Low-Rank Adaptation of Large Language Models,” in International Conference on Learning Representations (ICLR)
2022
Earlier work this paper cites.
K. Sanderson, “GPT-4 is here: what scientists think,” Nature
2023
Earlier work this paper cites.

Similar

K. Shum, S. Diao, and T. Zhang, “Automatic prompt augmentation and selection with chain-of-thought from labeled data,” arXiv preprint arXiv:2302.12822
Original
2023
Cited alongside, same era.
H. Huang, Z. Zhao, M. Backes, Y. Shen, and Y. Zhang, “Composite backdoor attacks against large language models,” arXiv preprint arXiv:2310.07676
Original
2023
Cited alongside, same era.
Z. Azerbayev, B. Piotrowski, H. Schoelkopf, E. W. Ayers, D. Radev, and J. Avigad, “ProofNet: Autoformalizing and Formally Proving Undergraduate-Level Mathematics,” arXiv preprint arXiv:2302.12433
Original
2023
Cited alongside, same era.
H. Touvron et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288
Original
2023
Cited alongside, same era.
A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, et al., “Mistral 7b,” arXiv preprint arXiv:2310.06825

Then

Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, and B. Li, “BadChain: Backdoor chain-of-thought prompting for large language models,” arXiv preprint arXiv:2401.12242
Original
2024
Later among the works it cites.
R. Ren et al., “Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress?,” Advances in Neural Information Processing Systems
2024
Later among the works it cites.
N. Jin, Z. Li, Y. Guo, C. Su, T. Zhang, and Q. Zeng, “SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation,” arXiv preprint arXiv:2412.05829
Original
2024
Later among the works it cites.
R. Zhang, H. Li, R. Wen, W. Jiang, Y. Zhang, M. Backes, Y. Shen, and Y. Zhang, “Instruction backdoor attacks against customized LLMs,” in 33rd USENIX Security Symposium
2024
Later among the works it cites.
W. Waligóra, “AnomaLLMy–Detecting anomalous tokens in black-box LLMs through low-confidence single-token predictions,” arXiv preprint arXiv:2406.19840

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Original

2023

Cited alongside, same era.

W. Wang, A. Goswami, and G. Durrett, “Prompt Consistency for Zero-Shot Prompt Selection,” arXiv preprint arXiv:2305.03022

2023

Cited alongside, same era.

A. Plaat, A. Wong, S. Verberne, J. Broekens, N. van Stein, and T. Back, “Reasoning with large language models, A survey,” arXiv preprint arXiv:2407.11511

2024

Cited alongside, same era.

A. Jaech et al., “OpenAI o1 system card,” arXiv preprint arXiv:2412.16720

Original

2024

Cited alongside, same era.

Z. Sprague, F. Yin, J.D. Rodriguez, D. Jiang, M. Wadhwa, P. Singhal, X. Zhao, X. Ye, K. Mahowald, and G. Durrett, “To CoT or not to CoT? Chain-of-thought helps mainly on math and symbolic reasoning,” arXiv preprint arXiv:2409.12183

2024

Cited alongside, same era.

X. Zheng, J. Lou, B. Cao, X. Wen, Y. Ji, H. Lin, Y. Lu, X. Han, D. Zhang, and L. Sun, “Critic-CoT: Boosting the reasoning abilities of large language model via chain-of-thoughts critic,” arXiv preprint arXiv:2408.16326

2024

Cited alongside, same era.

J. Pan, Y. Zhang, C. Zhang, Z. Liu, H. Wang, and H. Li, “DynaThink: Fast or slow? A dynamic decision-making framework for large language models,” arXiv preprint arXiv:2407.01009

2024

Cited alongside, same era.

B. Qi, X. Chen, J. Gao, D. Li, J. Liu, L. Wu, and B. Zhou, “Interactive continual learning: Fast and slow thinking,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

2024

Cited alongside, same era.

2024

Later among the works it cites.

Z. Wu, H. Gao, P. Wang, S. Zhang, Z. Liu, and S. Lian, “Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimization,” arXiv preprint arXiv:2410.15052

2024

Later among the works it cites.

X. Li, Y. Zhang, R. Lou, C. Wu, and J. Wang, “Chain-of-scrutiny: Detecting backdoor attacks for large language models,” arXiv preprint arXiv:2406.05948

2024

Later among the works it cites.

S. Dutta, J. Singh, S. Chakrabarti, and T. Chakraborty, “How to think step-by-step: A mechanistic understanding of chain-of-thought reasoning,” arXiv preprint arXiv:2402.18312

2024

Later among the works it cites.

M. Aridoss, K. S. Bisht, and A. K. Natarajan, “Comprehensive Analysis of Falcon 7B: A State-of-the-Art Generative Large Language Model,” in Generative AI: Current Trends and Applications

2024

Later among the works it cites.

Z. Zhu, H. Zhang, M. Zhang, R. Wang, G. Wu, K. Xu, and B. Wu, “BoT: Breaking Long Thought Processes of o1-like Large Language Models through Backdoor Attack,” arXiv preprint arXiv:2502.12202

2025

Closest in time.

Z. Guo and R. Tourani, “DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMs,” arXiv preprint arXiv:2501.18617

2025

Closest in time.

F. Yin, X. Ye, and G. Durrett, “Lofit: Localized fine-tuning on LLM representations,” Advances in Neural Information Processing Systems

2025

Closest in time.

D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, P. Wang, X. Bi, and others, “DeepSeek-R1: Incentivizing reasoning capability in LLMs via reinforcement learning,” arXiv preprint arXiv:2501.12948

2025

Closest in time.