标题： 当大语言模型复制以思考：揭示推理大语言模型中的复制引导攻击 显示英文标题

标题： When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs

摘要： 大型语言模型（LLMs）已成为自动化代码分析的关键组成部分，能够执行诸如漏洞检测和代码理解等任务。 然而，它们的集成引入了新的攻击面。 在本文中，我们识别并研究了一类新的基于提示的攻击，称为复制引导攻击（CGA），这些攻击利用了具备推理能力的LLMs的内在复制倾向。 通过将精心设计的触发器注入外部代码片段，攻击者可以诱导模型在推理过程中复制恶意内容。 这种行为会导致两类漏洞：推理长度操纵，即模型生成异常短或过长的推理轨迹；以及推理结果操纵，即模型生成误导性或错误的结论。 我们将CGA形式化为一个优化问题，并提出一种基于梯度的方法来合成有效的触发器。 对最先进的推理LLMs进行的实证评估表明，CGA能够可靠地在代码分析任务中引发无限循环、提前终止、虚假拒绝和语义扭曲。 虽然在定向设置中非常有效，但我们发现由于计算限制，在不同提示之间泛化CGA存在挑战，这为未来的研究提出了一个开放性问题。 我们的发现揭示了LLM驱动开发流程中的一个关键但尚未被充分研究的漏洞，并呼吁紧急推进提示级别的防御机制。 显示英文摘要

摘要： Large Language Models (LLMs) have become integral to automated code analysis, enabling tasks such as vulnerability detection and code comprehension. However, their integration introduces novel attack surfaces. In this paper, we identify and investigate a new class of prompt-based attacks, termed Copy-Guided Attacks (CGA), which exploit the inherent copying tendencies of reasoning-capable LLMs. By injecting carefully crafted triggers into external code snippets, adversaries can induce the model to replicate malicious content during inference. This behavior enables two classes of vulnerabilities: inference length manipulation, where the model generates abnormally short or excessively long reasoning traces; and inference result manipulation, where the model produces misleading or incorrect conclusions. We formalize CGA as an optimization problem and propose a gradient-based approach to synthesize effective triggers. Empirical evaluation on state-of-the-art reasoning LLMs shows that CGA reliably induces infinite loops, premature termination, false refusals, and semantic distortions in code analysis tasks. While highly effective in targeted settings, we observe challenges in generalizing CGA across diverse prompts due to computational constraints, posing an open question for future research. Our findings expose a critical yet underexplored vulnerability in LLM-powered development pipelines and call for urgent advances in prompt-level defense mechanisms.