Assessing Adversarial Robustness of Latent Reasoning Models

Shaolong Chen; Ang Li; Mingjie Li; Yisen Wang

cs.CLSep 3, 2026

Assessing Adversarial Robustness of Latent Reasoning Models

Authors: Shaolong Chen, Ang Li, Mingjie Li, Yisen Wang

Organizations: Yuanpei College, Peking University · State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University · CISPA Helmholtz Center for Information Security

Abstract

Large language models increasingly rely on long chain-of-thought (CoT) trajectories for complex reasoning, but autoregressive generation brings substantial memory and inference costs. Latent reasoning models (LRMs) offer a more efficient alternative by compressing intermediate reasoning into a small number of continuous latent vectors. Despite their efficiency, however, the adversarial robustness of LRMs remains largely underexplored. In this work, we systematically evaluate the robustness of latent reasoning across textual and multimodal settings, covering eight models and six benchmarks. We find that, across our evaluated settings, LRMs are generally less robust than explicit CoT baselines under adversarial perturbations, with particularly severe degradation under white-box attacks. Further analysis reveals distinct failure modes across modalities: textual latent states exhibit brittle dynamics and high sensitivity to specific input patterns, while latent states in multimodal models can remain largely invariant to input perturbations and have limited influence on final predictions. These findings expose robustness limitations of current latent reasoning approaches and highlight the need to jointly consider efficiency and robustness when designing implicit reasoning systems. We have open-sourced our code to facilitate reproduction of our research https://github.com/PKU-ML/latent-reasoning-model-assessment.

Figures & tables

Figure 1: Evaluation of latent reasoning models on the GSM8K (left) and V ∗ (right) datasets, comparing accuracy under clean (blue bars) and adversarial (red bars) conditions.

Figure 2: Assessment protocol of our paper: the figure shows perturbation generation for textual models via black-box search or white-box optimization, and illustrates white-box adversarial image perturbation for multi-modal models.

		GSM8K			SVAMP			MultiArith
type	model	Clean	W-5	W-3	Clean	W-5	W-3	Clean	W-5	W-3
explicit	Llama3.2	40.67	25.33 $\,\pm\,5.55$	30.22 $\,\pm\,0.39$	58.00	37.00 $\,\pm\,3.61$	42.67 $\,\pm\,2.52$	61.00	42.67 $\,\pm\,2.31$	48.33 $\,\pm\,2.08$
explicit	DeepSeek	77.33	61.44 $\,\pm\,3.42$	60.67 $\,\pm\,1.53$	80.00	65.00 $\,\pm\,3.00$	64.33 $\,\pm\,3.06$	98.00	95.00 $\,\pm\,1.00$	97.33 $\,\pm\,0.58$
implicit	CODI	56.00	3.89 $\,\pm\,0.38$	7.78 $\,\pm\,0.77$	61.00	2.00 $\,\pm\,2.00$	5.67 $\,\pm\,2.08$	98.00	7.00 $\,\pm\,2.65$	14.67 $\,\pm\,3.51$
	SIM-COT	42.67	0.89 $\,\pm\,0.19$	1.00 $\,\pm\,0.00$	36.00	1.67 $\,\pm\,2.08$	1.00 $\,\pm\,1.00$	93.00	1.33 $\,\pm\,0.58$	2.33 $\,\pm\,2.31$
	PCCoT	48.33	1.11 $\,\pm\,0.51$	2.67 $\,\pm\,0.34$	49.00	0.67 $\,\pm\,0.58$	0.33 $\,\pm\,0.58$	95.00	3.67 $\,\pm\,2.89$	6.67 $\,\pm\,1.53$

Table 1: Accuracy (%) of textual reasoning models under white-box perturbations. W-5 and W-3 denote adversarial prefixes with 5 and 3 tokens, respectively. Perturbed accuracy is reported as the mean

\pm

sample standard deviation over three runs. Cell shading encodes the absolute decrease from clean accuracy, with darker red indicating a larger decrease.

Figure 3: Normalized accuracy (%) of textual reasoning models under black-box perturbations. The x-axis represents the total query count, while the y-axis indicates the normalized accuracy, defined as the ratio of model accuracy with irrelevant information prefixes to the baseline accuracy without prefixes.

		V ∗			MMVP			MMStar
type	model	Clean	Random	White	Clean	Random	White	Clean	Random	White
explicit	Qwen-VL	42.00	29.00	8.67 $\,\pm\,0.58$	72.67	54.00	10.89 $\,\pm\,2.14$	56.00	30.00	18.33 $\,\pm\,0.58$
implicit	LVR	72.00	64.00	0.33 $\,\pm\,0.58$	70.67	58.67	3.33 $\,\pm\,2.40$	62.00	53.00	11.33 $\,\pm\,1.53$
	Monet	70.00	61.00	3.33 $\,\pm\,1.53$	68.67	60.00	3.78 $\,\pm\,1.02$	59.00	51.00	8.67 $\,\pm\,1.15$
	SkiLa	73.00	64.00	6.33 $\,\pm\,1.15$	68.67	47.33	1.78 $\,\pm\,1.02$	55.00	35.00	5.00 $\,\pm\,1.00$

Table 2: Accuracy (%) of multi-modal models under perturbations. Random denotes random perturbations, and White denotes perturbations constructed by our white-box method. White-box accuracy is reported as the mean

\pm

sample standard deviation over three runs. Cell shading encodes the absolute decrease from clean accuracy, with darker red indicating a larger decrease.

	V ∗			MMVP			MMStar
model	LVR	Monet	SkiLa	LVR	Monet	SkiLa	LVR	Monet	SkiLa
LVR	0.00	38.10	6.35	2.63	97.37	17.11	17.50	47.50	30.00
Monet	1.59	3.17	0.00	96.05	5.26	97.37	52.50	17.50	42.50
SkiLa	7.94	33.33	6.35	31.58	94.74	1.32	37.50	55.00	10.00

Table 3: Transferability of perturbations across multi-modal reasoning models. Rows denote evaluated target models, and columns denote the models used to optimize adversarial perturbations. Accuracy (%) is reported on questions that all models answer correctly without perturbations.

	GSM8K			SVAMP			MultiArith
model	White	Black	Inter-Q	White	Black	Inter-Q	White	Black	Inter-Q
CODI	0.7617	0.6312	0.2752	0.7437	0.5057	0.3902	0.5989	0.4766	0.4273
SIM-COT	0.7692	0.7174	0.4643	0.7185	0.6640	0.4760	0.7422	0.6564	0.5690
PCCoT	0.7818	0.7719	0.5563	0.5922	0.5487	0.5148	0.7021	0.6835	0.7262
CoLaR	0.8942	0.8784	0.6420	0.8421	0.8269	0.6367	0.8320	0.8728	0.6802
RoT	0.9381	0.9333	0.8437	0.8817	0.8905	0.7940	0.9147	0.9040	0.8541

Table 4: Latent-token similarity between clean and adversarial prompts for textual reasoning models. White and Black denote adversarial prompts generated under white-box and black-box settings, respectively. Inter-Q denotes the average similarity between latent tokens produced for different questions.

Reasoning type	Model	Clean question		Adversarial question
Reasoning type	Model	Clean reasoning	Adversarial reasoning	Adversarial reasoning	Clean reasoning
Explicit	Qwen3	70.67	35.33	32.33	70.33
Implicit	CODI	56.00	33.00	2.67	25.67
	SIM-COT	42.67	10.67	0.67	23.67
	PCCoT	48.33	25.00	0.33	30.33
	CoLaR	27.33	1.00	0.00	25.33

Table 6: Accuracy (%) of text reasoning models under latent reasoning-token replacement. Clean question and adversarial question denote the original and adversarial questions, respectively. Clean and adversarial reasoning denote the latent reasoning tokens generated under the corresponding input conditions. Cell shading reflects accuracy, with darker red indicating higher accuracy.

	V ∗		MMVP		MMStar
model	White	Inter-Q	White	Inter-Q	White	Inter-Q
LVR	0.9397	0.8993	0.9510	0.9081	0.9733	0.8634
Monet	0.9896	0.9525	0.9861	0.9392	0.9862	0.9336
SkiLa	0.9839	0.9834	0.9777	0.9795	0.9844	0.9589

Table 7: Latent-token similarity between clean and adversarial inputs for multi-modal models. White denotes adversarial images generated under the white-box setting, while Inter-Q denotes the average similarity between latent tokens produced for different questions.

		Clean Q			Adv Q
Dataset	Model	Clean R	Adv R	Zero R	Adv R	Clean R	Zero R
V ∗	Qwen-VL	42.00	25.00	–	8.00	25.00	–
	LVR	72.00	72.00	72.00	0.00	0.00	0.00
	Monet	70.00	70.00	62.00	2.00	2.00	8.00
	SkiLa	73.00	73.00	73.00	5.00	5.00	5.00
MMVP	Qwen-VL	72.67	31.33	–	9.33	40.00	–

Table 8: Accuracy (%) of multi-modal reasoning models with replaced latent tokens. Clean/Adv Q denote clean/adversarial questions; Clean/Adv/Zero R denote clean, adversarial, or zero latent reasoning tokens. Darker red indicates higher accuracy. Qwen-VL does not use zero reasoning tokens.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Textual reasoning models accuracy (%) under random perturbation

Dataset	V ∗	MMVP	MMStar
Resolution	$1125\times 773$	$224\times 224$	$476\times 384$

Appendix

Table 9: Average image resolution of the multi-modal datasets.

Type	Model	V ∗	MMVP	MMStar
explicit	Qwen	91.90	91.78	88.07
implicit	LVR	97.17	94.15	92.74
	Monet	98.05	95.50	97.11
	SkiLa	94.75	95.53	88.26

Appendix

Table 11: Average normalized accuracy (%) of multi-modal reasoning models over 50 random pixel-level perturbations.

		GSM8K		SVAMP		MultiArith
type	model	White-5	White-3	White-5	White-3	White-5	White-3
explicit	Llama3.2	0.0093	0.0187	0.0179	0.0000	0.0000	0.0000
implicit	CODI	0.7006	0.6786	0.6721	0.6721	0.8144	0.7755
	SIM-COT	0.5078	0.4688	0.4722	0.3611	0.5699	0.5699
	PCCoT	0.8897	0.8207	0.8571	0.8163	0.9684	0.8526
	CoLaR	0.3780	0.2439	0.4043	0.4043	0.5454	0.6136

Appendix

Table 12: Proportion of prefixes containing numbers

Prefix	Latent 1	Latent 2	Latent 3
None	“4”, “<<”, “:”	“4”, “.”, “-”	“.”, “>>”, “+”
Non-numerical: getic hiringNine	“4”, “<<”, “:”	“4”, “-”, “+”	“.”, “>>”, “,”
Numerical: 9334000	“467”, “466”, “477”	“000”, “400”, “4”	“4”, “0”, “004”

Appendix

Table 14: Top-3 decoded tokens at three latent positions under different prefix conditions.

Method	SVAMP	GSM8K	MultiArith
CODI	0.00% (0/61)	0.60% (1/168)	0.00% (0/98)
RoT	0.00% (0/49)	1.37% (1/73)	1.72% (1/58)
PCCoT	2.04% (1/49)	1.38% (2/145)	0.00% (0/95)
CoLaR	0.00% (0/47)	0.00% (0/82)	0.00% (0/88)
SIM-CoT	0.00% (0/36)	0.00% (0/128)	2.15% (2/93)

Appendix

Table 13: Fraction of optimized 3-token prefixes judged as potentially changing the answer to the original question. Parentheses show the number judged answer-changing over the total number evaluated.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Do Latent Tokens Think? A Causal and Adversarial Analysis of Chain-of-Continuous-Thought
Dec 25, 2025Yuyi Zhang, Boyu Tang, Tianjie Ju +2Faithfulness of Language Model Reasoning Implicit Reasoning in Language Models
Shanghai Jiao Tong University
Reasoning Beyond Language: A Comprehensive Survey on Latent Chain-of-Thought Reasoning
May 22, 2025Xinghao Chen, Anhao Zhao, Heming Xia +7CoT Reasoning LLM Reasoning
Department of Computing, The Hong Kong Polytechnic University · Ningbo Digital Twin Institute, Eastern Institute of Technology, Ningbo, China
LaTER: Efficient Test-Time Reasoning via Latent Exploration and Explicit Verification
May 8, 2026Xuan Li, Yining Wang, Yuchen Liu +7CoT Reasoning Efficient Language Model Reasoning
University of Science and Technology of China · Unisound AI Technology Co., Ltd · MAIS, Institute of Automation, Chinese Academy of Sciences

Dec 25, 2025J/K move · Enter open · S save

Do Latent Tokens Think? A Causal and Adversarial Analysis of Chain-of-Continuous-Thought

Yuyi Zhang, Boyu Tang, Tianjie Ju, Sufeng Duan+1

Shanghai Jiao Tong University

Faithfulness of Language Model Reasoning Implicit Reasoning in Language Models Continuous Latent Reasoning Language Model Reasoning Evaluation Shortcut Learning in Language Models

Open paper AskPDF arXiv

Latent tokens are gaining attention for enhancing reasoning in large language models (LLMs), yet their internal mechanisms remain unclear. This paper examines the problem from a reliability perspective, uncovering fundamental weaknesses: latent tokens function as uninterpretable placeholders rather than encoding faithful reasoning. While resistant to perturbation, they promote shortcut usage over genuine reasoning. We focus on Chain-of-Continuous-Thought (COCONUT), which claims better efficiency and stability than explicit Chain-of-Thought (CoT) while maintaining performance. We investigate this through two complementary approaches. First, steering experiments perturb specific token subsets, namely COCONUT and explicit CoT. Unlike CoT tokens, COCONUT tokens show minimal sensitivity to steering and lack reasoning-critical information. Second, shortcut experiments evaluate models under biased and out-of-distribution settings. Results on MMLU and HotpotQA demonstrate that COCONUT consistently exploits dataset artifacts, inflating benchmark performance without true reasoning. These findings reposition COCONUT as a pseudo-reasoning mechanism: it generates plausible traces that conceal shortcut dependence rather than faithfully representing reasoning processes.

Abstract

Adversarial Robustness

Explore similar work

Do Latent Tokens Think? A Causal and Adversarial Analysis of Chain-of-Continuous-Thought

Reasoning Beyond Language: A Comprehensive Survey on Latent Chain-of-Thought Reasoning

LaTER: Efficient Test-Time Reasoning via Latent Exploration and Explicit Verification