Assessing Adversarial Robustness of Latent Reasoning Models
Organizations: Yuanpei College, Peking University · State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University · CISPA Helmholtz Center for Information Security
Abstract
Large language models increasingly rely on long chain-of-thought (CoT) trajectories for complex reasoning, but autoregressive generation brings substantial memory and inference costs. Latent reasoning models (LRMs) offer a more efficient alternative by compressing intermediate reasoning into a small number of continuous latent vectors. Despite their efficiency, however, the adversarial robustness of LRMs remains largely underexplored. In this work, we systematically evaluate the robustness of latent reasoning across textual and multimodal settings, covering eight models and six benchmarks. We find that, across our evaluated settings, LRMs are generally less robust than explicit CoT baselines under adversarial perturbations, with particularly severe degradation under white-box attacks. Further analysis reveals distinct failure modes across modalities: textual latent states exhibit brittle dynamics and high sensitivity to specific input patterns, while latent states in multimodal models can remain largely invariant to input perturbations and have limited influence on final predictions. These findings expose robustness limitations of current latent reasoning approaches and highlight the need to jointly consider efficiency and robustness when designing implicit reasoning systems. We have open-sourced our code to facilitate reproduction of our research https://github.com/PKU-ML/latent-reasoning-model-assessment.
Figures & tables
| GSM8K | SVAMP | MultiArith | ||||||||
| type | model | Clean | W-5 | W-3 | Clean | W-5 | W-3 | Clean | W-5 | W-3 |
| explicit | Llama3.2 | 40.67 | 25.33 | 30.22 | 58.00 | 37.00 | 42.67 | 61.00 | 42.67 | 48.33 |
| DeepSeek | 77.33 | 61.44 | 60.67 | 80.00 | 65.00 | 64.33 | 98.00 | 95.00 | 97.33 | |
| implicit | CODI | 56.00 | 3.89 | 7.78 | 61.00 | 2.00 | 5.67 | 98.00 | 7.00 | 14.67 |
| SIM-COT | 42.67 | 0.89 | 1.00 | 36.00 | 1.67 | 1.00 | 93.00 | 1.33 | 2.33 | |
| PCCoT | 48.33 | 1.11 | 2.67 | 49.00 | 0.67 | 0.33 | 95.00 | 3.67 | 6.67 | |
| V ∗ | MMVP | MMStar | ||||||||
| type | model | Clean | Random | White | Clean | Random | White | Clean | Random | White |
| explicit | Qwen-VL | 42.00 | 29.00 | 8.67 | 72.67 | 54.00 | 10.89 | 56.00 | 30.00 | 18.33 |
| implicit | LVR | 72.00 | 64.00 | 0.33 | 70.67 | 58.67 | 3.33 | 62.00 | 53.00 | 11.33 |
| Monet | 70.00 | 61.00 | 3.33 | 68.67 | 60.00 | 3.78 | 59.00 | 51.00 | 8.67 | |
| SkiLa | 73.00 | 64.00 | 6.33 | 68.67 | 47.33 | 1.78 | 55.00 | 35.00 | 5.00 | |
| V ∗ | MMVP | MMStar | |||||||
| model | LVR | Monet | SkiLa | LVR | Monet | SkiLa | LVR | Monet | SkiLa |
| LVR | 0.00 | 38.10 | 6.35 | 2.63 | 97.37 | 17.11 | 17.50 | 47.50 | 30.00 |
| Monet | 1.59 | 3.17 | 0.00 | 96.05 | 5.26 | 97.37 | 52.50 | 17.50 | 42.50 |
| SkiLa | 7.94 | 33.33 | 6.35 | 31.58 | 94.74 | 1.32 | 37.50 | 55.00 | 10.00 |
| GSM8K | SVAMP | MultiArith | |||||||
| model | White | Black | Inter-Q | White | Black | Inter-Q | White | Black | Inter-Q |
| CODI | 0.7617 | 0.6312 | 0.2752 | 0.7437 | 0.5057 | 0.3902 | 0.5989 | 0.4766 | 0.4273 |
| SIM-COT | 0.7692 | 0.7174 | 0.4643 | 0.7185 | 0.6640 | 0.4760 | 0.7422 | 0.6564 | 0.5690 |
| PCCoT | 0.7818 | 0.7719 | 0.5563 | 0.5922 | 0.5487 | 0.5148 | 0.7021 | 0.6835 | 0.7262 |
| CoLaR | 0.8942 | 0.8784 | 0.6420 | 0.8421 | 0.8269 | 0.6367 | 0.8320 | 0.8728 | 0.6802 |
| RoT | 0.9381 | 0.9333 | 0.8437 | 0.8817 | 0.8905 | 0.7940 | 0.9147 | 0.9040 | 0.8541 |
| Reasoning type | Model | Clean question | Adversarial question | ||
| Clean reasoning | Adversarial reasoning | Adversarial reasoning | Clean reasoning | ||
| Explicit | Qwen3 | 70.67 | 35.33 | 32.33 | 70.33 |
| Implicit | CODI | 56.00 | 33.00 | 2.67 | 25.67 |
| SIM-COT | 42.67 | 10.67 | 0.67 | 23.67 | |
| PCCoT | 48.33 | 25.00 | 0.33 | 30.33 | |
| CoLaR | 27.33 | 1.00 | 0.00 | 25.33 | |
| V ∗ | MMVP | MMStar | ||||
| model | White | Inter-Q | White | Inter-Q | White | Inter-Q |
| LVR | 0.9397 | 0.8993 | 0.9510 | 0.9081 | 0.9733 | 0.8634 |
| Monet | 0.9896 | 0.9525 | 0.9861 | 0.9392 | 0.9862 | 0.9336 |
| SkiLa | 0.9839 | 0.9834 | 0.9777 | 0.9795 | 0.9844 | 0.9589 |
| Clean Q | Adv Q | ||||||
| Dataset | Model | Clean R | Adv R | Zero R | Adv R | Clean R | Zero R |
| V ∗ | Qwen-VL | 42.00 | 25.00 | – | 8.00 | 25.00 | – |
| LVR | 72.00 | 72.00 | 72.00 | 0.00 | 0.00 | 0.00 | |
| Monet | 70.00 | 70.00 | 62.00 | 2.00 | 2.00 | 8.00 | |
| SkiLa | 73.00 | 73.00 | 73.00 | 5.00 | 5.00 | 5.00 | |
| MMVP | Qwen-VL | 72.67 | 31.33 | – | 9.33 | 40.00 | – |
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
| Dataset | V ∗ | MMVP | MMStar |
| Resolution |
| Type | Model | V ∗ | MMVP | MMStar |
| explicit | Qwen | 91.90 | 91.78 | 88.07 |
| implicit | LVR | 97.17 | 94.15 | 92.74 |
| Monet | 98.05 | 95.50 | 97.11 | |
| SkiLa | 94.75 | 95.53 | 88.26 |
| GSM8K | SVAMP | MultiArith | |||||
| type | model | White-5 | White-3 | White-5 | White-3 | White-5 | White-3 |
| explicit | Llama3.2 | 0.0093 | 0.0187 | 0.0179 | 0.0000 | 0.0000 | 0.0000 |
| implicit | CODI | 0.7006 | 0.6786 | 0.6721 | 0.6721 | 0.8144 | 0.7755 |
| SIM-COT | 0.5078 | 0.4688 | 0.4722 | 0.3611 | 0.5699 | 0.5699 | |
| PCCoT | 0.8897 | 0.8207 | 0.8571 | 0.8163 | 0.9684 | 0.8526 | |
| CoLaR | 0.3780 | 0.2439 | 0.4043 | 0.4043 | 0.5454 | 0.6136 | |
| Prefix | Latent 1 | Latent 2 | Latent 3 |
| None | “4”, “<<”, “:” | “4”, “.”, “-” | “.”, “>>”, “+” |
| Non-numerical: getic hiringNine | “4”, “<<”, “:” | “4”, “-”, “+” | “.”, “>>”, “,” |
| Numerical: 9334000 | “467”, “466”, “477” | “000”, “400”, “4” | “4”, “0”, “004” |
| Method | SVAMP | GSM8K | MultiArith |
| CODI | 0.00% (0/61) | 0.60% (1/168) | 0.00% (0/98) |
| RoT | 0.00% (0/49) | 1.37% (1/73) | 1.72% (1/58) |
| PCCoT | 2.04% (1/49) | 1.38% (2/145) | 0.00% (0/95) |
| CoLaR | 0.00% (0/47) | 0.00% (0/82) | 0.00% (0/88) |
| SIM-CoT | 0.00% (0/36) | 0.00% (0/128) | 2.15% (2/93) |
Adversarial Robustness
Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.
See all 479 papers