PaperlayerView exact revision on arXiv

Source-linked AI summary

When Reasoning Goes Astray: Attention Dynamics of Uncontrolled Reasoning

Yuanhe Zhang, Ziwei Wang, Jie Ren, Haoran Gao, Zhenhong Zhou, Fanyu Meng, Cong Wu, Li Sun, Sen Su

arXiv:2609.38817v1cs.AIcs.CL

TL;DR

Extended reasoning can become excessive or loop persistently, increasing inference costs, while existing controls do not distinguish useful from uncontrolled reasoning. RADAR classifies four reasoning states from attention dynamics and guides attention realignment; across evaluated models, it reduces looping while largely preserving benign performance.

  • Problem

    Existing reasoning-cost mitigations do not explicitly distinguish useful reflection from excessive reflection or persistent repetition, although uncontrolled generation increases inference cost and can threaten service availability.

    Source: §1 · pp. 1–2

  • Method

    RADAR tracks four reasoning states from PAS and CTS trajectories, then uses the inferred state to guide attention realignment toward patterns observed in normal requests.

    Source: §1 · p. 2

  • Results

    Across five models and nine tasks, RADAR achieved 89.8% average micro-F1 and reduced average loop rate from 36.8% to 27.2%, preserving benign accuracy on most models.

    Source: §5 · p. 10

  • Takeaways & Limitations

    Attention trends associated with uncontrolled reasoning become detectable before repetition, and correcting abnormal attention reduces looping while largely preserving benign performance.

    Source: §1 · p. 2, §5 · p. 10

    The experiments use existing benchmarks and model-generated trajectories, and the results do not establish deployment safety without model- and setting-specific validation.

    Source: ETHICS STATEMENT · p. 10

Abstract

from arXiv · show

Large reasoning models (LRMs) improve performance on complex tasks through extended reasoning, yet the same process can degenerate into redundant verification and persistent generation loops. Such uncontrolled reasoning increases inference cost and creates risks of resource exhaustion and service degradation. However, existing mitigations largely truncate long outputs or react to surface repetition, and thus fail to distinguish normal thinking from uncontrolled reasoning or explain how benign reasoning degenerates into harmful behavior. In this paper, we operationalize LRM generation as four states and further introduce Reasoning-state Analysis via Dynamic Attention Responses (RADAR), which identifies the current reasoning state in real time and characterizes how effective reflection can develop into uncontrolled generation. Guided by RADAR's analysis, we further realign abnormal attention distributions toward patterns observed in normal requests and examine how this correction affects excessive reflection and persistent looping. Temporal analyses show that uncontrolled reasoning is characterized by attention distributions that deviate from normal generation, with abnormal trends becoming detectable before repetition begins. Correcting these deviations through Attention Realignment consistently reduces looping while largely preserving benign performance. Together, RADAR provide a mechanistic account of how reasoning becomes uncontrolled, offering actionable guidance for identifying critical failure stages and designing targeted runtime interventions.

1 INTRODUCTION

Extended reasoning can be productive but can also become excessive reflection or persistent looping, increasing inference cost and threatening service availability. RADAR tracks four reasoning states through attention dynamics; its attention-based intervention reduces looping while largely preserving benign performance.

1 INTRODUCTION

  • Extended reasoning supports complex-task performance, but redundant solutions and persistent loops can consume tokens, raise latency and cost, and threaten service availability.Adversarial inputs can amplify persistent loops until the output budget is exhausted.Source: §1 · p. 1
  • Existing controls shorten or terminate reasoning, but indiscriminate termination can discard useful computation and their accuracy–cost tradeoff depends on the chosen budget or compression.The paper argues for distinguishing reasoning states and analyzing their internal dynamics.Source: §1 · pp. 1–2
  • 89.8% average micro-F1 across five models accompanies a 9.8-percentage-point average loop-rate reduction, with benign performance largely preserved.RADAR also detects abnormal attention trends before repetition begins in naturally induced attacks.Source: §1 · p. 2
  • RADAR models direct answering, effective reflection, excessive reflection, and persistent looping as four states tracked through evolving attention dynamics.The framework is intended to reveal how effective reflection can develop into excessive reflection and persistent looping.Source: §1 · p. 2

2 RELATED WORK

Prior work establishes the value of explicit reasoning while also documenting its resource costs and failure modes. Existing defenses manage length or stopping, whereas RADAR identifies functional reasoning states and uses them to guide intervention.

2.1 PERFORMANCE OF LARGE REASONING MODELS

  • Explicit reasoning methods—including chain-of-thought prompting, search, verifiers, and trained reasoning models—support language-model performance and motivate preserving useful reasoning.Test-time computation and budget-control strategies further exploit extended reasoning.Source: §2.1 · p. 3

2.2 RESOURCE CONSUMPTION AND DEFENSES

  • Overthinking, ineffective deliberation, and adversarial attacks can waste resources or produce repetitive loops, motivating a distinction between excessive reflection and persistent lexical looping.The cited attack mechanisms include prolonged generation, suppressed termination, and repetitive decoding.Source: §2.2 · p. 3
  • Budget control, compression, adaptive stopping, and concise-reasoning training reduce cost, but do not explicitly identify whether ongoing reasoning is excessively reflective or repetitive.RADAR models prompt–generation attention dynamics to identify four states and guide intervention while evaluating attack suppression and preservation of useful reflection.Source: §2.2 · p. 3

3 METHOD

The method defines four functional states of generation, infers them from attention trajectories, and uses the inferred state to selectively realign abnormal attention during decoding.

3 METHOD

  • The method consists of a threat model and four-state definitions, a PAS/CTS-based temporal classifier, and state-guided Attention Realignment.Figure 1 summarizes the diagnostic pipeline and state-guided defense.Source: §3 · p. 3, §3.1 · p. 4, §3.2 · p. 4

3.1 THREAT MODEL AND REASONING STATES

  • The threat model assumes a public inference service with a finite per-request generation budget and a defender able to access and modify attention tensors.The method distinguishes direct answering, effective reflection, excessive reflection, and persistent looping; the latter two describe unproductive continuation and non-terminating repetition, respectively.Source: §3.1 · pp. 3–4

3.2 TEMPORAL STATE INFERENCE WITH RADAR

  • PAS measures current-token attention allocated to prompt positions, while CTS compares attention distributions for shared token identities across prompt and generated regions.Higher PAS indicates greater prompt attention; higher CTS indicates more similar token-level attention distributions across the regions.Source: §3.2 · pp. 4–5
  • The Temporal State Inference Classifier uses PAS trend, average CTS, and generation progress to estimate probabilities over the four reasoning states.It standardizes these three trajectory features and trains with weighted negative log likelihood and L2 regularization to account for class imbalance.Source: §3.2 · p. 5

3.3 ATTENTION REALIGNMENT IN RADAR

  • RADAR activates Attention Realignment when the classifier predicts excessive reflection or persistent looping above a confidence threshold at geometrically spaced checkpoints.Intervention begins on the next decoding step and remains active until generation terminates.Source: §3.3 · p. 5
  • Attention Realignment moves abnormal patterns toward normal trajectories by rebalancing prompt attention and reducing generation-side shares for selected cross-context token identities.Candidate layers are restricted using layerwise PAS and current CTS, bounding the runtime analysis and intervention cost.Source: §3.3 · p. 6

4 EXPERIMENTS

Across five reasoning models and nine datasets, RADAR distinguishes four reasoning states and tracks how harmful-state evidence develops. Attention realignment reduces looping across models while largely preserving benign accuracy.

4.1 EXPERIMENTAL SETUP

  • The evaluation covers five models, direct-answer and deliberate-reasoning tasks, and uncontrolled-reasoning sources including Recur, LoopLLM, joint construction, and Missing Premise.Four-state diagnosis uses micro-F1; detection and intervention analyses use generation length, loop rate, and task accuracy.Source: §4.1 · pp. 6–7

4.2 CLASSIFICATION ACCURACY

  • 89.8% average micro-F1 shows RADAR distinguished four reasoning states across five models, including on unseen datasets and attack settings.Figure 2 covers confidence distributions across five models and nine datasets; hatched bars mark model–dataset pairs where no attack succeeds.Source: Figure 2 · p. 7, §4.2 · p. 7
  • State-confidence trajectories differ over generation: direct-answer confidence rises then stabilizes, excessive reflection is recognizable early, and looping becomes distinguishable as it develops.Figure 3 bins ground-truth class confidence by relative generation progress; O and L include only successful attacks.Source: Figure 3 · p. 7, §4.2 · pp. 7–8

4.3 MECHANISM ANALYSIS

  • Normalized PAS rises with generation for direct answering and effective reflection, while excessive reflection stays high and looping shifts progressively toward recently generated context.Direct answering maintains higher PAS than effective reflection; looping initially overlaps with direct answering before its later divergence.Source: Figure 4 · p. 8, §4.3 · p. 8
  • For naturally induced attacks, harmful-state thresholds up to 70% are crossed before recorded repetition, while thresholds at or below 50% offer a more practical early-detection range.Table 1 reports mean generation positions for the first threshold crossing and recorded loop onset; Joint is excluded from the before-onset comparison because it directly manipulates output.Source: Table 1 · p. 8, §4.3 · pp. 8–9
  • Mean CTS is 0.81 for direct answering and 0.71 for effective reflection, versus 0.12 for excessive reflection and 0.39 for looping on DeepSeek-Qwen.The same overall benign-versus-uncontrolled pattern is observed across all five models.Source: Figure 5 · p. 8, §4.3 · p. 9

4.4 INTERVENTION EFFECTIVENESS ACROSS MODELS

  • 27.2% was the average final loop rate after Attention Realignment across five models, and benign accuracy fell by only 0.8 points on one model and not at all on the other four.RADAR moves abnormal PAS and CTS toward ranges observed in normal trajectories; the largest loop-rate reduction was 16.0 points on DeepSeek-R1-Distill-Qwen-14B.Source: Table 2 · p. 9, §4.4 · p. 9

5 CONCLUSION

RADAR tracks four reasoning states through attention dynamics, and its diagnosis and intervention results support state-aware control. Attention realignment reduced loop rates while preserving benign accuracy on most evaluated models.

5 CONCLUSION

  • Across five models, RADAR reduced the average loop rate from 36.8% to 27.2%, while preserving benign accuracy on most models.The conclusion frames state-aware intervention as targeting uncontrolled continuation without imposing the same length constraint on all reasoning.Source: §5 · p. 10
  • RADAR operationalizes direct answering, effective reflection, excessive reflection, and persistent looping, tracking them from PAS and CTS trajectories with a temporal classifier.Across five models and nine tasks, it achieved an average micro-F1 of 89.8%.Source: §5 · p. 10
  • Attention analyses found state-dependent PAS trajectories and CTS distributions, with harmful-state confidence generally strengthening before recorded repetition in naturally induced attacks.The conclusion presents RADAR as a state-level account of how reasoning behavior evolves through internal attention dynamics.Source: §5 · p. 10

AI USE STATEMENT

The authors report using generative AI tools for dataset correction, literature retrieval, manuscript formatting, and editorial suggestions, while taking responsibility for the final work.

AI USE STATEMENT

  • Generative AI assisted with dataset correction, literature retrieval, formatting, and editorial suggestions; the authors reviewed its outputs and take responsibility for the final text, data, results, and claims.The disclosure also specifies caption suggestions among the editorial tasks.Source: AI USE STATEMENT · p. 10

ETHICS STATEMENT

The section bounds adversarial-risk claims to controlled experiments and defines trajectory states by how reflection progresses, how useful progress saturates, and whether lexical cycling persists.

ETHICS STATEMENT

  • The adversarial-input study uses controlled experiments and warns that its results do not establish deployment safety without model- and setting-specific validation.The work uses existing benchmarks and model-generated trajectories, with no human participants or private user data.Source: ETHICS STATEMENT · p. 10

A REASONING-STATE ANNOTATION CRITERIA

  • A reflection episode is a contiguous span of verification, revision, challenge, or restart; effective reflection makes substantive progress, while excessive reflection continues beyond a sufficient solution with little new information.A sufficient prefix contains a complete candidate solution that could be returned, irrespective of correctness.Source: A REASONING-STATE ANNOTATION CRITERIA · p. 14
  • Persistent looping requires reaching the generation cap and recurring lexical content, taking precedence over excessive reflection when both criteria apply.Representative trajectory examples complement the operational criteria by illustrating the four states in recorded generations.Source: A REASONING-STATE ANNOTATION CRITERIA · p. 15, §A.1 · p. 15

B DETAILED FOUR-STATE DETECTION RESULTS

RADAR achieves 89.8% average micro-F1 for four-state diagnosis; detailed results distinguish excessive reflection from observable looping and report results by model, dataset, and attack outcome.

B DETAILED FOUR-STATE DETECTION RESULTS

  • Detailed accuracy and confidence results are grouped by model, dataset, and attack outcome, with failed attacks reported separately and predictions unclassified when no state posterior exceeds 0.5.Table 5 cells report accuracy and the state with the largest mean confidence in each model–dataset group.Source: B DETAILED FOUR-STATE DETECTION RESULTS · p. 15, Table 5 · p. 16

B.1 MICRO-F1

  • 89.8% average micro-F1 is reported for four-state diagnosis, equivalent to overall classification accuracy in this single-label setting.Table 6 reports model-level results.Source: §B.1 · pp. 16–17, Table 6 · p. 17

B.2 GLM-4.7-FLASH ON RECUR

  • For GLM-4.7-Flash on Recur, no test trajectory meets the output-level looping criterion, yet RADAR assigns all trajectories to O with mean O confidence of 86.0%.The classifier captures an excessive-reflection attention signature that can occur without an observable loop; an illustrative trajectory terminates naturally after 2,583 tokens.Source: §B.2 · p. 17, Figure 6 · p. 17

C GENERATION LENGTH AS AN AUXILIARY CLASSIFICATION SIGNAL

Benign reasoning can be long, so output length alone does not identify uncontrolled reasoning. Harmful-state evidence can emerge within the normal length range, while length contextualizes rather than replaces attention signals.

C GENERATION LENGTH AS AN AUXILIARY CLASSIFICATION SIGNAL

  • Benign effective-reflection means range from 1,528.44 to 2,702.08 tokens across five models, and pooled benign D/R means exceed 1,184 tokens in every model.Long generation can therefore occur while a normal solution is still making useful progress.Source: C GENERATION LENGTH AS AN AUXILIARY… · p. 18
  • Mean first crossings of P(O) + P(L) ≥ 0.5 range from 60.6 to 997.0 tokens across attack groups, below every model’s benign D/R mean; natural-attack crossings precede recorded repetition.Recur, Joint, and MiP cross by 450.4 tokens, with Recur and Joint crossing before 100 tokens.Source: C GENERATION LENGTH AS AN AUXILIARY… · p. 18
  • Generation progress contextualizes attention evolution rather than determining state alone: O is recognizable early, whereas L initially overlaps with D and separates as generation develops.PAS direction and rate of change remain state-dependent, while log k_i serves as a temporal coordinate for interpreting PAS and mean CTS.Source: C GENERATION LENGTH AS AN AUXILIARY… · p. 18

D CROSS-MODEL CTS DISTRIBUTIONS

Across model families, CTS generally separates excessive reflection from benign reasoning, though persistent looping can retain high CTS in GLM-4.7-Flash. In the cross-defense comparison, RADAR reduces looping less aggressively than output-level constraints, while providing state-conditioned intervention.

D CROSS-MODEL CTS DISTRIBUTIONS

  • Mean CTS for excessive reflection (O) remains below the corresponding direct-answer (D) and effective-reflection (R) means across all five models.The supplementary violins show per-trajectory mean CTS by state; small L samples for QwQ-32B and Qwen3.6-27B preclude strong variance claims.Source: D CROSS-MODEL CTS DISTRIBUTIONS · pp. 18–19, Figure 7 · p. 19, Figure 8 · p. 19
  • EOS controls overlap the benign D/R CTS range in every model, and their means remain closer to benign states than to O.EOS records one terminal measurement per trajectory, unlike the trajectory-mean D/R distributions, so its distribution is wider.Source: D CROSS-MODEL CTS DISTRIBUTIONS · p. 19, Figure 7 · p. 19, Figure 8 · p. 19
  • In GLM-4.7-Flash, looping (L) has mean CTS 0.75, close to D at 0.87 and R at 0.81, despite a sharply rising length-normalized PAS.L PAS rises from 0.93 initially to 44.25 at 4,000 generated tokens, while O remains near 1.10; the authors interpret this as prompt-anchored reuse of repetitive token identities.Source: D CROSS-MODEL CTS DISTRIBUTIONS · pp. 19–20

E.1 REASONING TRAJECTORY GENERATION

  • Trajectory collection used one NVIDIA A100-SXM4 GPU, temperature 0.5, a 16k-token generation cap, and base seed 0.The execution backend was selected automatically from the model architecture configuration; software versions are listed in Table 8.Source: §E.1 · p. 20, Table 9 · p. 20, Table 8 · p. 20

F.2 ATTACK SUPPRESSION

  • RADAR reduces the undefended macro loop rate from 56.0% to 40.0%, a 16.0-point reduction, versus 37.3% for AUSteer and 0.0% for n-gram.RADAR is not the strongest suppression method by this metric; its intervention is tied to diagnosed reasoning states and attention dynamics.Source: Table 10 · p. 21, §F.2 · p. 21

F.1 COMPARED DEFENSES AND EVALUATION PROTOCOL

  • The comparison covers undefended decoding, RADAR attention realignment, AUSteer activation steering, and trigram-blocking n-gram decoding on one model and fixed attack cohorts.RADAR intervenes when its online state classifier identifies harmful reasoning; the other two baselines directly alter output scores or constrain repeated tokens.Source: F CROSS-DEFENSE COMPARISON · p. 21, §F.1 · p. 21

F.3 BENIGN-TASK UTILITY

On normal tasks, RADAR nearly preserves accuracy, while n-gram blocking reduces it more; RADAR also lowers loop rates across three natural attack categories.

F.3 BENIGN-TASK UTILITY

  • RADAR changes normal-task accuracy from 66.4% undefended to 65.6%, while n-gram blocking lowers it to 58.4%.AUSteer remains at 66.4%; the authors conclude defense effectiveness should be assessed jointly with attack suppression and benign utility.Source: §F.3 · p. 22

G ATTACK-TYPE SUPPRESSION ACROSS MODELS

  • Across five models, RADAR lowers loop rates from 16.0% to 12.0% for Recur, 34.4% to 12.8% for LoopLLM, and 60.8% to 52.8% for MiP.These three attack categories cover the main naturally induced forms of uncontrolled reasoning and model collapse considered in the evaluation.Source: G ATTACK-TYPE SUPPRESSION ACROSS MODELS · p. 22

H.1 DETECTION CONFIDENCE THRESHOLD

Detection accuracy generally improves at higher confidence thresholds, but the best operating point varies by model and higher thresholds delay detection. The appendix also examines how layer-selection settings affect intervention breadth and localization.

H.1 DETECTION CONFIDENCE THRESHOLD

  • Accuracy averages 75.4% at τ = 0.1 and 88.4% at τ = 0.9; a shared τ = 0.7 reaches 87.4%, 2.2 points below the post hoc model-specific optimum.Higher thresholds can delay first detection by hundreds or more than one thousand tokens, and the model-specific optimum varies.Source: §H.1 · pp. 22–23, Figure 9 · p. 23

H.2 DYNAMIC LAYER-SELECTION THRESHOLD

  • Raising κC from 0.4 to 0.7 increases mean selected layers per step from 1.095 to 1.838, or 13.7% to 23.0% of the eight candidates.Selection remains sparse for many trajectories: the median rises from 0.021 to 0.514 layers.Source: Table 14 · p. 23, §H.2 · p. 24

H.3 RETAINED-LAYER FRACTION

  • Selected layer sets are nested as ξ increases from 0.15 to 0.40, and remain unchanged from ξ = 0.25 onward for Llama-8B, QwQ-32B, and Qwen3.6-27B.Qwen-14B and GLM-4.7 each add only one lower-index boundary layer at ξ = 0.35; the authors describe localization as robust to ξ.Source: Table 16 · p. 24, §H.3 · p. 24

H.4 HYPERPARAMETER SETTINGS

  • Unless otherwise stated, the main experiments use τ = 0.5, ξ = 0.3, and κC = 0.5, with online inference beginning at 256 tokens.PAS and CTS histories are sampled every 32 decoding steps, dynamic layer eligibility updates every 8 steps, and an activated intervention remains on until termination.Source: §H.4 · p. 24
Loading 2609.38817v1…