Summary: Eight PITAX techniques that target the reasoning trace, the thinking budget, the context window, or the output-decoding constraint — surfaces that only exist on modern reasoning and structured-output models.
Sources: raw/AI-attack-techniques/PIT-T-04,05,25,52,55,61,62,63-*.md
Last updated: 2026-07-28
Two opposite levers on the same weakness
PITAX draws a careful distinction that is easy to collapse and shouldn’t be:
- T61 Reasoning Dilution pads the prompt “with a long stretch of benign, easy step-by-step reasoning before the harmful ask, so a large reasoning model’s safety signal attenuates… The padding is deliberately coherent and easy; this is the opposite lever from Cognitive Overload, which exhausts with complexity” (source: PIT-T-61-reasoning-dilution-cot-hijacking.md; CoT Hijacking arXiv 2510.26418; H-CoT arXiv 2502.12893).
- T04 Cognitive Overload overwhelms “the model’s reasoning capacity with complex, deeply-nested, recursive, or paradoxical input so it mishandles or drops safety checks. This is exhaustion via complexity, the opposite lever from Reasoning Dilution” (source: PIT-T-04-cognitive-overload.md).
Both attenuate the safety signal; one by making reasoning too easy, one by making it too hard. A defence tuned against complexity does nothing against dilution.
A third, mechanically distinct case: T55 Context Overflow floods the window “with padding or filler so the system prompt or safety instructions are pushed out, truncated, or diluted below the model’s effective attention. The mechanism is capacity and eviction, not reasoning load (cf. Cognitive Overload)” (source: PIT-T-55-context-overflow-window-flooding.md).
Three techniques, three mechanisms, one symptom. Triage that lumps them together will pick the wrong mitigation.
Steering the thinking regime
T62 Thinking-Mode Manipulation deliberately steers “a reasoning model’s thinking regime, forcing extended chain-of-thought or suppressing/interrupting it, to land in the state where safety is empirically weakest. It works in both directions, including cutting reasoning short so the safety checks never run” (source: PIT-T-62-thinking-mode-manipulation-reasoning-budget-steering.md; The Cost of Thinking arXiv 2508.10032; Reasoning Interruption Attack arXiv 2505.06643).
The reasoning budget is an attacker-influenceable parameter. Treating it as a pure performance/cost knob misses that it is also a safety-posture knob.
T25 Truncated Instructions is the low-tech version — instructing the model “to respond within a very short output window, which can cause it to ignore or overwrite developer-defined system prompts… Works especially well with Chain-of-Thought (CoT) models” (source: PIT-T-25-truncated-instructions.md). It also notes that short response limits give “more space for exfiltration.”
Reading vs forging the reasoning channel
T05 Chain-of-Thought Introspection uses “chain of thought reasoning to make the model enumerate secrets by prompting self-introspection” (source: PIT-T-05-chain-of-thought-introspection.md) — it reads the channel.
T52 Chain-of-Thought Spoofing forges it, injecting fabricated reasoning steps that conclude the request is permitted; PITAX calls it “the inverse of Chain-of-Thought Introspection” (source: PIT-T-52-chain-of-thought-spoofing.md). See context-and-role-forgery.
Exposing reasoning traces to users creates the first; accepting them from users creates the second.
The output plane
T63 Structured-Output Coercion wraps “a benign-looking prompt in a required output schema, grammar, or enum whose fields force the harmful content out field-by-field. The attack lives in the output-constraint (decoding) plane that prompt-scanning filters never inspect” (source: PIT-T-63-structured-output-coercion-constrained-decoding.md; Chain Enum Attack, Mou et al. arXiv 2503.24191).
This is the cleanest example in PITAX of a defence being in the wrong place rather than being too weak. response_format and grammar constraints are attacker-controllable inputs, and most guardrail deployments do not treat them as such.
Practical takeaways
- Context length, reasoning budget and output schema are all security-relevant parameters, not just capability/cost parameters.
- Guardrails on the input string miss T63 entirely and miss T61/T62 by mechanism.
- Reasoning traces are dual-use: exposing them leaks (T05), accepting them lets you be spoofed (T52).