Assessing Adversarial Robustness of Latent Reasoning Models
Shaolong Chen, Ang Li, Mingjie Li, Yisen Wang
cs.CL · cs.LG · stat.ML
Quick verdict
Claims latent-reasoning models are less adversarially robust than explicit CoT; a credible, controlled study — small samples and mixed backbones temper it.
Summary
This paper asks whether latent reasoning models (LRMs), which compress chain-of-thought into a few continuous latent vectors, sacrifice adversarial robustness for efficiency. The authors evaluate five textual LRMs (CODI, SIM-CoT, PCCoT, CoLaR, RoT) and three multimodal LRMs (LVR, Monet, SkiLa) against explicit CoT baselines (Llama-3.2-1B, DeepSeek-R1-Distill-1.5B, Qwen2.5-VL-7B) on six benchmarks (GSM8K, SVAMP, MultiArith, V*, MMVP, MMStar), using GCG adversarial prefixes (3/5 tokens), PGD image perturbations (epsilon=4/255), and a black-box protocol of fixed number-bearing irrelevant contexts. Degradation is drastic: a 5-token prefix drops CODI from 56.00% to 3.89% on GSM8K versus 40.67% to 25.33% for Llama-3.2-1B, and all eight LRMs lose at least 80% relative accuracy (Fig. 1). Analysis ties textual fragility to numerical prefix tokens disrupting latent dynamics (Tables 5, 12), while multimodal latent tokens stay nearly invariant under perturbation (Table 7) and can be zeroed with little effect (Table 8), indicating latent reasoning is largely bypassed. Limitations include 100-300 sampled instances per dataset, only three-run mean±std without significance tests, heterogeneous backbones (e.g., GPT-2-124M for SIM-CoT/PCCoT) confounding implicit-vs-explicit comparisons, and a multimodal attack optimized at the pre-latent-reasoning position that interacts with the bypass conclusion. Code is open-sourced.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Across 8 latent reasoning models and 6 benchmarks, LRMs suffer at least 80% relative accuracy drops under adversarial perturbations and are generally less robust than explicit CoT baselines, especially under white-box attacks (Fig. 1, Tables 1-2).
- Optimized textual prefixes overwhelmingly contain numerical tokens (70.06% of CODI's vs 0.93% of Llama-3.2's on GSM8K, Table 12), and restricting optimization to non-numerical tokens roughly halves the damage (Table 5: 26.00% vs 7.78%).
- Multimodal latent tokens remain nearly invariant under perturbations (Table 7) and are functionally redundant: zeroing them leaves LVR at 72.00% on V* (Table 8), so predictions bypass latent reasoning.
- Compressing reasoning into a few continuous states forfeits the error-correction capacity of long explicit CoT; robustness must join efficiency as a first-class design criterion for implicit reasoners.
Strengths
First systematic cross-modality robustness assessment of LRMs
Covers 8 models (5 textual: CODI, SIM-CoT, PCCoT, CoLaR, RoT; 3 multimodal: LVR, Monet, SkiLa), 6 benchmarks, and three protocols (GCG white-box prefixes, PGD images at eps=4/255, fixed-pool black-box), with matched-backbone baselines where possible (CODI/Llama-3.2-1B; CoLaR/DeepSeek-1.5B).
Unusually strong validity controls for an evaluation paper
An LLM-judge audit finds at most 2.15% of 3-token prefixes potentially answer-changing and 0% of 5-token prefixes (Table 13); a non-numerical-token constraint isolates the numerical effect (Table 5: CODI 26.00% vs 7.78% on GSM8K); random-prefix controls (Fig. 4) separate targeted from generic degradation.
Mechanistic diagnosis, not just metric reporting
Honest scoping and reproducibility support
Weaknesses
Backbone and capacity mismatch confounds the headline comparison
Weak statistical support for fine-grained claims
Multimodal attack design partially determines the conclusion
Black-box protocol is a stress test, not an adaptive attack
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks whether latent reasoning models (LRMs) — which replace autoregressive chain-of-thought with a handful of continuous latent vectors — pay for their efficiency in adversarial robustness. The evaluation spans five textual LRMs (CODI, SIM-CoT, PCCoT, CoLaR, RoT), three multimodal LRMs (LVR, Monet, SkiLa), explicit baselines (Llama-3.2-1B-Instruct, DeepSeek-R1-Distill-Qwen-1.5B, Qwen2.5-VL-7B), and six benchmarks (GSM8K/SVAMP/MultiArith; V*/MMVP/MMStar) with 100-300 sampled instances each. Central claims: (1) LRMs are generally less robust than explicit CoT, worst under white-box attacks, with at least 80% relative drop for all eight models (Fig. 1); (2) textual fragility tracks numerical tokens in adversarial prefixes; (3) multimodal latent tokens are near-invariant to perturbations and functionally redundant. Claims are consistently scoped to evaluated settings, and the Limitations section reinforces this.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a latent reasoning model (LRM)?
A model that replaces token-by-token chain-of-thought with a few continuous hidden-state vectors computed iteratively inside the network, aiming for comparable accuracy at much lower inference cost. Examples evaluated in this paper: CODI, SIM-CoT, PCCoT, CoLaR and RoT for text; LVR, Monet and SkiLa for vision-language.
What is the paper's main finding?
Under adversarial prefixes (GCG) or imperceptible image perturbations (PGD, eps=4/255), the evaluated LRMs lose far more accuracy than explicit CoT baselines. On GSM8K a 5-token prefix drops CODI from 56.00% to 3.89%, while Llama-3.2-1B falls only from 40.67% to 25.33%; all eight LRMs show at least 80% relative drops.
Why are multimodal latent tokens called functionally redundant?
Because they barely change under adversarial perturbations (cosine similarity up to 0.98, Table 7) and replacing or zeroing them barely changes accuracy (Table 8: LVR stays at 72.00% on V* with zero latent tokens). Predictions appear driven by an answer preference formed before latent reasoning begins.
Is code or data available for this paper?
Yes. The authors open-sourced their code at github.com/PKU-ML/latent-reasoning-model-assessment. All models and benchmarks used (GSM8K, SVAMP, MultiArith, V*, MMVP, MMStar) are public.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure-internal content (curve shapes in Figs. 3-4; images/case studies in Figs. 5-7) is not present in the extracted text; all quantitative statements rely on tables and in-text numbers only.
- Table cell shading ('darker red' encodings of decrease/increase) is not recoverable from text; only numeric cell values were used in this review.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.