Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs
Large Language Models (LLMs) consume and produce a single sequence of text; hence, if text can be added to the beginning of the LLM's response, i.e., an output prefix, then all subsequent tokens will be conditioned on it. This output-prefix attack technique is a cheap black-box prompt injection. Prior work has shown this type of attack can reliably jailbreak non-reasoning models. Most reasoning…
We haven't written up this one. arXiv cs.AI has the full story — the link below goes straight to it.
