RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

Abstract: Reasoning-capable LLMs can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety classifiers often miss these attacks because the injected prompts can appear syntactically benign. We build RecurGuard, a runtime monitor for detecting reasoning-chain consumption attacks when reasoning traces are exposed by the model. RecurGuard analyzes reasoning traces as they are generated and tracks three signals: recurrence rate, volume growth, and progress toward the user's query. If all three signals remain anomalous over three consecutive chunks, RecurGuard terminates generation early. We evaluate RecurGuard against OverThink and ExtendAttack across open-weight reasoning models and conduct adaptive stress tests on DS-R1-Qwen-7B. On this model, RecurGuard detects 99% of OverThink attacks and 92% of ExtendAttack instances while maintaining near-zero false positive rates on question answering, code generation, mathematics, and summarization. Adaptive evaluation reveals the limit of the defense: topical attacks retain 11.9x amplification with an approximately 50% joint miss rate, whereas full semantic evasion reduces amplification from 22.8x to 2.2x. When reasoning traces are unavailable, QDM provides a post-hoc fallback monitor based on the final output.

• The paper introduces RecurGuard, a framework that uses semantic signals like recurrence rate, volume growth, and task-conditioned progress to detect and halt token consumption attacks.
• It processes reasoning traces in fixed-size chunks with empirically calibrated thresholds to trigger early termination, achieving high detection rates on key attacks.
• The system demonstrates practical cost savings and low false-positive rates while adapting to both open reasoning trace and closed-API deployments.

RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

Motivation and Threat Model

LLMs specialized for reasoning generate extended intermediate traces before yielding final answers. This increased reasoning capability introduces new risks: adversaries can inject decoy tasks through any context-bearing channel (prompt, retrieved documents, tool outputs) and induce the model to consume its generation budget on irrelevant computation. This results in denial of service (user receives no answer) and denial of wallet (excess output tokens billed), with amplification exceeding $20\times$ relative to clean queries.

Existing defenses—input-side classifiers, length-based filters, and post-hoc semantic monitors—are inadequate. Input classifiers miss syntactically benign decoys; length filters yield high FPR on legitimate long-form outputs; output monitors cannot halt generation early and confuse legitimate off-query summarization with attack behavior. The threat model studied here assumes the attacker has context-channel control but no access to model internals. Defender visibility is divided into regimes: full reasoning trace (open models), summarised blocks (partially exposed), hidden traces (final-output-only APIs).

Figure 1: Threat model and monitor placement. Decoy tasks enter via text context; RecurGuard monitors reasoning traces online and can halt generation, while QDM provides post-hoc fallback.

RecurGuard Framework

RecurGuard provides online monitoring by processing exposed reasoning traces in fixed-size chunks during generation. It tracks three analytic signals:

• Recurrence Rate (RR): Fraction of current chunk embeddings similar to prior window chunks ($sim > 0.70$). High RR indicates semantic repetition.
• Volume Growth (VG): Difference in cloud mean pairwise distance pre-/post-chunk. Negative or near-zero VG indicates collapse into repetitive reasoning space.
• Task-Conditioned Progress (TP): Difference between chunk similarity to user query and maximum similarity to prior chunks. TP is strongly negative when reasoning is self-recurrent and off-task.

A sustained alarm is triggered if all three signals remain anomalous for $S=3$ consecutive chunks (chunk size $k=64$, window $W=20$) with empirically calibrated thresholds. Early termination prevents further token expenditure.

For closed APIs lacking reasoning traces, QDM computes mean chunk-query similarity over final output, flagging responses with drift below $0.318$. QDM is strictly post-hoc and cannot halt generation.

Theoretical Analysis

RecurGuard leverages trajectory geometry in embedding space. Under clean reasoning, chunks progress to task-relevant regions; under attack, semantic collapse manifests as recursive off-task traces. The sustained-alarm conjunction exponentially suppresses false positives ($p_0^S$). Task-conditioned progress is dominant: TP-only ablation achieves near-perfect TPR and zero FPR on primary attacks.

Adaptive attacks confirm the evasion-alignment tradeoff: full evasion reduces amplification sharply. In C4 (task-aligned filler), attack amplification drops from $22.8\times$ to $2.2\times$, validating that semantic alignment forces convergence to an answer instead of looping.

Figure 2: Combined detector view. Left: signal trajectories showing RR growth, VG collapse, and negative TP pre-alarm; right: amplification versus joint miss rate illustrates the adaptive boundary.

Experimental Evaluation

Models and Datasets

Evaluation spans open-weight reasoning models (DS-R1-Qwen-7B, DS-R1-Llama-8B, Qwen3-8B) and closed-API deployments (Sonnet~4.5, Opus~4.7). Main dataset is SQuAD (with role-specific splits), supplemented by HumanEval, GSM8K, CNN/DailyMail and TriviaQA for clean workload and cross-validation.

Attack Mechanisms

Two primary attacks are reproduced:

• OverThink: Unrelated decoy task (Sudoku constraints) injected with instruction to solve before answering.
• ExtendAttack: User query obfuscated and model prompted to sequentially decode before answering.

Adaptive variants probe semantic detection boundaries:

• C1: Topical context decoy (higher query similarity).
• C4: Task-aligned filler (full semantic alignment, minimal amplification).
• C2 and C3 serve as negative controls, producing negligible amplification.

Results: Amplification, Detection, and False Positives

Primary attacks achieve $22$–$sim > 0.70$0 token amplification and over $sim > 0.70$1 liveness failure across reasoning-specialist models. RecurGuard detects 99\% of OverThink and 92\% of ExtendAttack instances on DS-R1-Qwen-7B, maintaining $sim > 0.70$2 FPR on clean QA, code, math, and summarization. Baseline length-based detectors produce unacceptable FPRs on code (B1: 69\%, B4: 80\%), showing poor suitability for mixed workloads.

Adaptive variants reveal partial evasion:

• C1 achieves $sim > 0.70$3 amplification and approximately 50\% joint miss rate.
• C4 achieves full evasion (0\% TPR) only at $sim > 0.70$4 amplification.

Closed-API tests show QDM is reliable post-hoc (100\% TPR, 0\% FPR), while RecurGuard performance is degraded in summarised, hidden regimes.

Practical Implications

RecurGuard's runtime monitoring is effective in deployments exposing reasoning traces and permitting generation cancellation. Early stopping realizes immediate token cost reductions ($sim > 0.70$5 savings per detected attack). In closed APIs, only output-side QDM is available, offering detection but no prevention of wasteful generation.

RecurGuard's clean-task FPR profile enables trustworthy operation in heterogeneous workloads. The security boundary is defined by adaptive semantic attacks: full evasion trades amplification for answer convergence, making catastrophic denial-of-wallet infeasible under sustained task-alignment. C1 remains an open boundary for further anchor-aware monitoring research.

Limitations and Future Directions

RecurGuard is structurally inapplicable in deployments without reasoning visibility. Provider-summarised traces diminish detection sensitivity. Adaptive attacks tested only on DS-R1-Qwen-7B; broader model applicability and RAG pipeline integration are open directions. No evaluation against white-box gradient-based attacks (outside threat model). Compression ratio is a proxy for repetitiveness, not true perplexity.

Future research should extend to document-anchored semantic monitors, entropy-based signals, and end-to-end RAG deployments.

Conclusion

RecurGuard provides robust, low-FPR online detection for reasoning-chain consumption attacks when intermediate traces are visible, enabling early termination and substantial cost savings. Detection is anchored in task-conditioned semantic collapse, validated by strong empirical results across open-weight reasoning LLMs. QDM is a necessary companion for closed-API settings. The theoretical and experimental boundary defines a clear tradeoff: semantic evasion reduces amplification, confining the attack's harm. Topical C1 remains as an unresolved boundary for detection, motivating further research in semantic monitor anchoring and adaptive attack resilience.

---

For artifacts and code, see https://github.com/abidaziz1/recurguard.