o1 46x slowdown

Instead of jailbreaking the model, an attack has been disclosed that mixes a decoy MDP into RAG, forcing the model to solve it first and causing reasoning tokens and latency to spike.

• OverThink: on o1, 9.7–18.1x slowdown on FreshQA, 46x on SQuAD, 3.0–6.4x on o1-mini
• Mindgard Base64 Exhaustion: on DeepSeek-R1, just a triple-base64 input produces 12,722 tokens / 229 seconds, a 59x token amplification compared to non-reasoning models

The open-source prompt injection dataset released alongside it contains 2,450 OverThink payloads and 500,000+ labeled samples, and can be used for detector training and evaluation at a 1:1 attack/benign ratio.