Abstract
Large Language Model (LLM) agents relying on external retrieval are increasingly deployed in high-stakes environments. While existing adversarial attacks primarily focus on content falsification or instruction injection, we identify a novel, process-oriented attack surface: the agent's reasoning style. We propose Reasoning-Style Poisoning (RSP), a paradigm that manipulates how agents process information rather than what they process. We introduce Generative Style Injection (GSI), an attack method that rewrites retrieved documents into pathological tones--specifically "analysis paralysis" or "cognitive haste"--without altering underlying facts or using explicit triggers. To quantify these shifts, we develop the Reasoning Style Vector (RSV), a metric tracking Verification depth, Self-confidence, and Attention focus. Experiments on HotpotQA and FEVER using ReAct, Reflection, and Tree of Thoughts (ToT) architectures reveal that GSI significantly degrades performance. It increases reasoning steps by up to 4.4 times or induces premature errors, successfully bypassing state-of-the-art content filters. Finally, we propose RSP-M, a lightweight runtime monitor that calculates RSV metrics in real-time and triggers alerts when values exceed safety thresholds. Our work demonstrates that reasoning style is a distinct, exploitable vulnerability, necessitating process-level defenses beyond static content analysis.
Abstract (translated)
大型语言模型（LLM）代理越来越多地依赖外部检索，并被部署在高风险环境中。虽然现有的对抗性攻击主要集中在内容伪造或指令注入上，我们发现了一个新型的、以过程为导向的攻击面：即代理的推理风格。我们提出了推理样式投毒（Reasoning-Style Poisoning, RSP），这是一种通过改变代理处理信息的方式而非其所处理的信息本身来进行操纵的方法。我们引入了一种名为生成式风格注入（Generative Style Injection, GSI）的攻击方法，该方法将检索到的文档重写为病态语气——具体来说是“分析瘫痪”或“认知急躁”，而不会改变事实真相或使用显式的触发器。为了量化这些变化，我们开发了推理样式向量（Reasoning Style Vector, RSV），这是一个追踪验证深度、自我信心和注意力焦点的指标。 在HotpotQA和FEVER数据集上采用ReAct、反思及思维树（ToT）架构进行的实验表明，GSI显著降低了性能。它增加了多达4.4倍的推理步骤或导致过早出现错误，成功绕过了最先进的内容过滤器。最后，我们提出了RSP-M，这是一种轻量级的运行时监控工具，可在实时计算RSV指标，并在值超过安全阈限时触发警报。 我们的研究表明，推理风格是一个独特的、可被利用的安全漏洞，需要超越静态内容分析的过程级别的防御措施。
URL
https://arxiv.org/abs/2512.14448
