Earlier denial-of-service attacks on large reasoning models (LRMs) depend on model feedback — repeatedly querying the target or training a dedicated attack model — which is costly and limits leverage. SMTrap introduces what the authors call search amplification: conflict counts from an SMT (Satisfiability Modulo Theories) solver act as a cheap external signal to guide the synthesis of inference-heavy constraint-satisfaction-problem (CSP) queries. The key observation is that LRMs solve CSPs by trial-and-backtracking search, so higher SMT conflict counts on a CSP instance correlate with more extensive backtracking and substantially longer outputs. The framework is lightweight and CPU-only: no queries to the target model, no attack-model training, no GPU compute. Evaluations across seven frontier models reportedly show state-of-the-art LRM-DoS capability, several times stronger than existing baselines. The authors also demonstrate a tool-based mitigation — offloading the solving to a tool — that significantly cuts token usage.
SMTrap: CPU-only, feedback-free attacks exhaust large reasoning models
Earlier denial-of-service attacks on large reasoning models (LRMs) depend on model feedback — repeatedly querying the target or training a dedicated attack model — which is costly and limits leverage. SMTrap introduces what the authors call search amplification: conflict counts from an SMT (Satisfiability Modulo Theories) solver act as a cheap external signal to guide the synthesis of inference-heavy constraint-satisfaction-problem (CSP) queries. The key observation is that LRMs solve CSPs by trial-and-backtracking search, so higher SMT conflict counts on a CSP instance correlate with more extensive backtracking and substantially longer outputs. The framework is lightweight and CPU-only: no queries to the target model, no attack-model training, no GPU compute. Evaluations across seven frontier models reportedly show state-of-the-art LRM-DoS capability, several times stronger than existing baselines. The authors also demonstrate a tool-based mitigation — offloading the solving to a tool — that significantly cuts token usage.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
Cost exhaustion is a practical threat surface for anyone exposing reasoning models through an API or budget-limited agent tools: an attacker spends cheap CPU-side queries to force long backtracking chains and expensive inference. The feedback-free property weakens the usual defenses, since rate limiting and query-pattern detection assume the attacker must probe the target. Mitigations are cheap and actionable: per-request token and cost ceilings, detection of solver-shaped queries, and giving the model a solver tool so it offloads instead of searching in-context. Recorded for defensive planning (LLM gateway / serving safeguards), consistent with the KB's serving-layer security line.
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Paradigm | search amplification — SMT solver conflict counts guide synthesis of inference-heavy CSP queries |
|---|---|
| Cost | CPU-only; no target-model queries; no attack-model training; no GPU |
| Mechanism | LRMs solve CSPs via trial-and-backtracking; higher SMT conflict counts correlate with longer backtracking and outputs |
| Scope | seven frontier reasoning models (not named in abstract) |
| Mitigation | tool-based offloading of solving significantly cuts token usage; per-request budgets advised |
| Caveat | attacker-side academic research; defensive value for gateways/serving; no code link found on abstract page |
| Relation To Kb | serving-layer security line; cost-exhaustion complement to KV-cache rollback (ev-20260818-03) and Cloudflare MCP enforcement (ev-20260814-03) era hardening |