SMTrap: CPU-only, feedback-free attacks exhaust large reasoning models

Earlier denial-of-service attacks on large reasoning models (LRMs) depend on model feedback — repeatedly querying the target or training a dedicated attack model — which is costly and limits leverage. SMTrap introduces what the authors call search amplification: conflict counts from an SMT (Satisfiability Modulo Theories) solver act as a cheap external signal to guide the synthesis of inference-heavy constraint-satisfaction-problem (CSP) queries. The key observation is that LRMs solve CSPs by trial-and-backtracking search, so higher SMT conflict counts on a CSP instance correlate with more extensive backtracking and substantially longer outputs. The framework is lightweight and CPU-only: no queries to the target model, no attack-model training, no GPU compute. Evaluations across seven frontier models reportedly show state-of-the-art LRM-DoS capability, several times stronger than existing baselines. The authors also demonstrate a tool-based mitigation — offloading the solving to a tool — that significantly cuts token usage.

Cost exhaustion is a practical threat surface for anyone exposing reasoning models through an API or budget-limited agent tools: an attacker spends cheap CPU-side queries to force long backtracking chains and expensive inference. The feedback-free property weakens the usual defenses, since rate limiting and query-pattern detection assume the attacker must probe the target. Mitigations are cheap and actionable: per-request token and cost ceilings, detection of solver-shaped queries, and giving the model a solver tool so it offloads instead of searching in-context. Recorded for defensive planning (LLM gateway / serving safeguards), consistent with the KB's serving-layer security line.