[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82618-en":3,"doc-seo-82618-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82618,8796095360427,"Lucas Martin","https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d",8,"Research & Report","Overthink Triggered Slowdown Attacks on LVLM Based Robotic Systems","Large Vision-Language Models (LVLMs) are increasingly deployed in robotic systems, yet they can exhibit overthinking behavior by producing excessively long reasoning traces that substantially increase inference time. This creates an overthinking-induced slowdown attack risk, where an adversary triggers delays in a black-box robotic agent to cause safety-relevant failures. The attack embeds carefully designed human-readable scene text into the visual input, acting as a trigger. A three-stage framework constructs trigger corpora, extracts prefix features, performs black-box search with proxy scoring, and confirms candidates with latency measurements. Across three LVLMs, triggers achieve >1.0x slowdown and up to 6.96x, with physical printing reaching 4.74x, demonstrating transferable slowdown behavior.","Overthink-Triggered Slowdown Attacks on LVLM-Based Robotic Systems  \nQiang Han, Jie Wu, and Bo Chen  \nDepartment of Computer Science, Michigan Technological University [qiangh@mtu.edu](qiangh@mtu.edu), [jie.jw.wu@mtu.edu](jie.jw.wu@mtu.edu), [bchen@mtu.edu](bchen@mtu.edu)  \narXiv :2607 .0 15 18v 1 [ cs .CR] 1 Jul 2026  \nAbstract—Large Vision-Language Models (LVLMs) have been increasingly integrated into robotic systems. However, these models may exhibit overthinking behaviors, where they generate excessively long reasoning traces, incurring an excessive inference time. This overthinking behavior poses a serious risk to robotic systems, as the adversary can deliberately trigger overthinking to slow down the decision making of a victim robotic system, causing a variety of safety issues (i.e., an overthinking-induced slowdown attack). To initiate this attack, an adversary can embed carefully crafted, human-readable scene text into the visual scene observed by a victim robotic agent, causing significant inference delayseven under a strict black-box setting. Therefore, the embedded scene text serves as a significant “trigger” for the attack.  \nThis work systematically identifies and validates transferable triggers of overthinking in robotic systems by introducing a three-stage framework. First, we construct a diverse corpus of reasoning-intensive scene text and extract overthinkingcorrelated lexical features from short response prefixes. Second, we perform an efficient black-box search guided by a prefixbased proxy score while selectively confirming a small set of top candidates with full latency measurements. Third, we evaluate black-box transfer using a fixed pool of triggers on unseen images and multiple LVLMs, reporting latency amplification and attack success rates under standard thresholds. Across three representative LVLMs, all triggers yield slowdown ratios greater than 1.0x, with the strongest single-trigger case reaching 6.96x. The physical printing of the text trigger still causes up to 4.74x latency amplification. These results demonstrate that our discovered triggers are transferred between multiple LVLM models and consistently cause significant slowdowns in robotic systems.  \nI. INTRODUCTION  \nLarge Vision-Language Models (LVLMs) are increasingly integrated into robotic systems [1], [2], [3], [4] to support perception understanding, decision reasoning, and high-level planning. Modern LVLMs are trained on both images and text and, therefore, are capable of understanding multiple-object scenes, interpreting context and intent, and handling moderately complex environments, allowing the robotic systems to operate in complex, dynamic, and uncertain environments. However, LVLMs suffer from some new attacks that exploit their unique nature. One such attack is the overthinkinginduced slowdown attack. Recent works [5], [6], [7] show that a reasoning-oriented large language model can produce an excessively long reasoning trace or long-form output even for a simple query, a phenomenon known as overthinking. As the inference latency in LVLMs scales approximately linearly with the number of tokens generated [8], the adversary can take advantage of overthinking to increase response time  \nand computational overhead, significantly slowing down the decision process of victim LVLMs.  \nIn robotic systems, the potential slowdowns caused by the “overthinking” are particularly concerning because these cyber-physical systems often operate under time constraints, and the slow decision can directly affect safety, stability, and even correctness of the victim systems. Understanding overthinking attacks on these systems is a critical step toward ensuring their robustness and safety, but little research has been done on it. This work therefore aims to bridge this gap by understanding the potential attacks over the robotic systems utilizing the LVLM overthinking.  \nAs robotic systems typically rely on sensor input for realtime decision-making, a","cbCaiiPhwm52ubO4","https://ap.wps.com/l/cbCaiiPhwm52ubO4","pdf",4763877,1,17,"English","en",105,"# Introduction\n## Overthinking-Induced Slowdown Attack\n## Adversarial Scene-Text Triggers\n## Goal and Key Observation","[{\"question\":\"What is an overthinking-induced slowdown attack on LVLM-based robotic systems?\",\"answer\":\"An attacker induces the LVLM to generate excessively long reasoning traces, which increases inference time and delays the robot’s decision-making, creating safety risks.\"},{\"question\":\"How does the proposed attack work in practice?\",\"answer\":\"The adversary embeds carefully crafted, human-readable scene text into the visual scene observed by the robotic agent so the victim LVLM interprets it as instruction-like input.\"},{\"question\":\"How are transferable triggers identified and validated?\",\"answer\":\"The method builds a corpus of reasoning-intensive scene text, extracts overthinking-related lexical features from short response prefixes, performs efficient black-box search using a prefix proxy score, and then confirms top candidates with full latency measurements and transfer evaluation across models.\"}]",1784181839,43,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"overthink-triggered-slowdown-attacks-on-lvlm-based-robotic-systems","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/overthink-triggered-slowdown-attacks-on-lvlm-based-robotic-systems/82618/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is an overthinking-induced slowdown attack on LVLM-based robotic systems?","Question",{"text":75,"@type":76},"An attacker induces the LVLM to generate excessively long reasoning traces, which increases inference time and delays the robot’s decision-making, creating safety risks.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed attack work in practice?",{"text":80,"@type":76},"The adversary embeds carefully crafted, human-readable scene text into the visual scene observed by the robotic agent so the victim LVLM interprets it as instruction-like input.",{"name":82,"@type":73,"acceptedAnswer":83},"How are transferable triggers identified and validated?",{"text":84,"@type":76},"The method builds a corpus of reasoning-intensive scene text, extracts overthinking-related lexical features from short response prefixes, performs efficient black-box search using a prefix proxy score, and then confirms top candidates with full latency measurements and transfer evaluation across models.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]