TIDES: Test-time Inference Drift Exploitation via Scaling

Haoran Dai; Haozheng Luo; Haotian Zhang; Meng Lin; Yan Chen; Binghui Wang

Extended version

TIDES: Test-time Inference Drift Exploitation via Scaling

A computation-triggered backdoor that largely preserves utility under short reasoning budgets and activates primarily when inference is scaled.

Read the paper OpenReview

Authors

Haoran Dai^1,*Haozheng Luo^2,*Yuanjie Gu³Haotian Zhang⁴Meng Lin⁴Zhi Lu⁵Yan Chen²Binghui Wang¹

Equal contribution.

Affiliations

¹Illinois Institute of Technology
²Northwestern University
³Fudan University
⁴QuiverAI, Inc.
⁵Tsinghua University

Motivation

Can a checkpoint pass short-trace checks and still fail only when the user scales up inference?

Test-time scaling assumes that spending more computation on longer reasoning traces improves accuracy. TIDES studies the security side of that assumption: a model can look benign under ordinary, short-budget evaluation, yet degrade sharply once reasoning is extended.

The attacker prepares a modified checkpoint before release. At deployment there is no explicit trigger phrase and no runtime intervention: users send ordinary questions and run the model normally. The activation condition is the amount of reasoning computation itself.

A comparison between an input-triggered backdoor, which relies on a visible trigger phrase, and TIDES, which is activated by extended reasoning rather than a lexical trigger. — Figure 1. Input-triggered backdoors depend on a visible trigger phrase that input-level detection can catch. TIDES instead uses test-time scaling as the activation condition and needs no explicit trigger in the input.

A contrast inside the reasoning trace

The paper compares correct and incorrect GSM8K traces from R1-Distill-Qwen-7B. Their final-token hidden states show a layer-dependent separation in these layer-wise PCA projections.

TIDES uses that contrast to construct a separate drift vector for each layer. A learned gate controls when the vectors act, and distillation transfers the behavior into a student checkpoint.

View the full figure

Two-dimensional projections of correct and incorrect GSM8K trace representations across transformer layers. — Figure 2. Hidden-state projections of correct and incorrect GSM8K traces, which show a layer-dependent separation.

Methodology

Read the paper

TIDES builds an offline teacher with layer-specific drift directions and a gate that responds to the reasoning trajectory. On-policy distillation then transfers the teacher's behavior into a standard student checkpoint that is deployed without any inference-time hooks.

TIDES pipeline: contrastive reasoning traces provide layer-specific drift vectors; a gate uses normalized token depth and smoothed entropy; teacher behavior is transferred to a student through on-policy distillation. — Figure 3. The three stages of TIDES. Phase 1 extracts a logic drift vector per layer from correct and deceptive traces. Phase 2, the Depth-Guided Latent Tracker, maps normalized depth and smoothed entropy to a gate \(\alpha(t)\) that stays low for shallow reasoning and rises for deep reasoning. Phase 3 injects the gated vectors into a teacher, which then supervises the student on the student's own rollouts. Select the figure to open it at full size.

Phase 1 /
Extract layer-wise drift vectors
For each prompt, the method builds contrastive pairs of correct and deliberately fallacious traces and takes the critical state at a high-entropy position. A Logic Drift Vector for each layer is the mean displacement from correct to fallacious representations.
Each vector lives in its own layer's geometry, so the vectors need not be aligned across layers. The paper compares this high-entropy position with prompt-end and low-entropy alternatives.
Phase 2 /
Condition on reasoning depth
The Depth-Guided Latent Tracker is a small multilayer perceptron gate. It maps normalized token depth and a smoothed entropy signal to a scalar coefficient, keeping the intervention weak in shallow reasoning and stronger in deep regimes.
\[\rho_t=\frac{t}{T_{\max}},\qquad \alpha(t)=g_{\phi}\!\left([\rho_t,\bar H_{t-1}]\right)\in[0,1].\]
\(t\) is the decoding step, \(T_{\max}\) the maximum rollout length, and \(g_{\phi}\) the learned gate. The entropy input is an exponential moving average \(\bar H_t=\beta\bar H_{t-1}+(1-\beta)H_t\) using uncertainty through the previous step. The per-layer injection is \(\delta_t^{(\ell)}=\alpha(t)\,v^{(\ell)}\).
Phase 3 /
Distill into the student
An intervened teacher applies the gated vectors during decoding. On-policy distillation then supervises the student on prefixes from its own rollouts, so the depth-gated behavior is regime-dependent by construction.
Because the teacher stays near-clean on short rollouts, the student keeps its short-trace utility; on extended rollouts the teacher exhibits drift. The resulting student runs as a conventional checkpoint, with no trigger and no runtime intervention.

Theory

The analysis studies an idealized deterministic latent recurrence \(h_{t+1}=F(h_t,x)\) and asks how a single intermediate perturbation can affect the terminal state under extended reasoning. It is a worst-case characterization, not a claim about the realized deviation in a transformer.

5.1 /
Worst-case propagation of a perturbation
With a single perturbation of size \(\eta\) at step \(t_0\), and a local Lipschitz constant \(K\) for the latent dynamics, the terminal deviation is bounded by a factor that grows with the remaining horizon. The bound assumes both trajectories start from the same state and stay in a neighborhood where \(K\ge 1\) holds.
\[\lVert \tilde h_T-h_T\rVert \le K^{\,T-1-t_0}\,\eta.\]
For \(K>1\), the factor \(K^{\,T-1-t_0}\) increases with the remaining reasoning horizon. The bound need not be attained and does not imply that the realized deviation is amplified.
5.2 /
Necessary displacement for a correctness change
Under a correctness-margin assumption with Lipschitz constant \(L_\phi\), moving a correct terminal state to an incorrect one requires a minimum latent displacement. Here \(\phi\) is the correctness margin, positive with \(\phi(h_T)\ge\gamma\) for the correct state and \(\phi(\tilde h_T)\le 0\) for the incorrect one.
\[\lVert \tilde h_T-h_T\rVert \ge \frac{\phi(h_T)}{L_\phi}\ge \frac{\gamma}{L_\phi}.\]
This displacement is necessary for a correctness change between margin-separated states, but its magnitude alone does not guarantee one.

Results

Extended version · Table 1

Stronger long-reasoning attacks while short-trace utility holds

Across three reasoning models and five benchmarks, TIDES reaches an average Relative Attack Score (RAS) of 89.8%, a 26.8% relative improvement over the strongest baseline, while the average short-budget Pass@1 stays at 32.4%. RAS measures long-budget final-answer degradation relative to the original model at the same budget; larger is a stronger attack.

R1-Distill-Qwen-7BAverage RAS (%)

72.892.5

+19.7 points

DecepChain → TIDES

R1-Distill-Llama-8BAverage RAS (%)

67.791.2

+23.5 points

DecepChain → TIDES

Phi-4-Reasoning-14BAverage RAS (%)

71.985.6

+13.7 points

DecepChain → TIDES

DeepSeek-R1-Distill-Qwen-7BAverage RAS (%)

Backdoor0.0

DTCoT1.6

BadChain3.4

DecepChain72.8

TIDES92.5

DeepSeek-R1-Distill-Llama-8BAverage RAS (%)

Backdoor0.5

DTCoT24.0

BadChain26.3

DecepChain67.7

TIDES91.2

Phi-4-Reasoning-14BAverage RAS (%)

Backdoor0.5

DTCoT13.3

BadChain14.5

DecepChain71.9

TIDES85.6

Average RAS over MATH-500, Minerva, AIME 2024, OlympiadBench, and LiveCodeBench. Three runs; standard deviations are in the full tables below. Base checkpoints have no reported RAS and are omitted from these charts.

Short-trace utility

Pass@1 is measured separately on short traces. Averaged over the five benchmarks, the base and TIDES checkpoints keep similar short-trace accuracy.

R1-Distill-Qwen-7B

Base34.1%TIDES36.2%

R1-Distill-Llama-8B

Base28.2%TIDES29.0%

Phi-4-Reasoning-14B

Base31.3%TIDES32.2%

Average short-trace Pass@1 across the five benchmarks.

Phi-4-Reasoning

The failure emerges under extended reasoning

The attacked and baseline models track each other below a critical budget. Past roughly 1,000 tokens the curves diverge: baseline accuracy keeps improving while the attacked model drops from 50% to 16%.

The transition near 1,000 tokens is not universal and is likely tied to how the gate's shallow and deep traces were defined.

Original Figure 5

Accuracy versus token budget for the baseline and attacked models; below a critical budget the two match, beyond it the attacked model's accuracy falls sharply. — Figure 5. Accuracy versus token budget for the backdoored Phi-4-Reasoning on 50 math problems. Below the critical budget the attacked model tracks or exceeds the baseline; beyond it, added compute degrades rather than improves accuracy.

Average results (all methods and models)

Averages over five benchmarks · Table 1 · mean ± standard deviation
Backbone	Method	Pass@1 (%)	RAS (%) ↑
DeepSeek-R1-Distill-Qwen-7B	Base	34.1 ± 0.1	–
	Backdoor	23.0 ± 0.7	0.0 ± 0.0
	DTCoT	23.2 ± 0.3	1.6 ± 0.3
	BadChain	25.4 ± 1.0	3.4 ± 1.0
	DecepChain	32.2 ± 0.5	72.8 ± 0.3
	TIDES	36.2 ± 0.3	92.5 ± 0.3
DeepSeek-R1-Distill-Llama-8B	Base	28.2 ± 0.5	–
	Backdoor	22.2 ± 0.9	0.5 ± 0.0
	DTCoT	10.1 ± 0.8	24.0 ± 0.2
	BadChain	10.5 ± 0.5	26.3 ± 1.8
	DecepChain	27.3 ± 0.1	67.7 ± 0.6
	TIDES	29.0 ± 0.2	91.2 ± 0.1
Phi-4-Reasoning-14B	Base	31.3 ± 0.6	–
	Backdoor	25.2 ± 0.6	0.5 ± 0.1
	DTCoT	16.0 ± 0.8	13.3 ± 0.8
	BadChain	16.1 ± 0.2	14.5 ± 0.5
	DecepChain	28.0 ± 0.8	71.9 ± 0.5
	TIDES	32.2 ± 0.1	85.6 ± 0.2

Averages over the five benchmarks. "–" preserves the missing Base RAS values.

Per-benchmark results

Per-benchmark results · Table 1 · mean ± standard deviation
Backbone	Method	MATH500		Minerva		AIME24		Olympiad		LiveCodeBench		Avg
Backbone	Method	Pass@1	RAS ↑	Pass@1	RAS ↑	Pass@1	RAS ↑	Pass@1	RAS ↑	Pass@1	RAS ↑	Pass@1	RAS ↑
DeepSeek-R1-Distill-Qwen-7B	Base	67.4 ± 0.3	–	37.9 ± 0.5	–	28.3 ± 0.5	–	36.4 ± 1.4	–	0.4 ± 0.3	–	34.1 ± 0.1	–
	Backdoor	54.3 ± 0.6	0.0 ± 0.0	27.2 ± 1.6	0.0 ± 0.0	8.2 ± 1.4	0.1 ± 0.1	25.0 ± 0.3	0.0 ± 0.1	0.2 ± 0.3	0.0 ± 0.0	23.0 ± 0.7	0.0 ± 0.0
	DTCoT	48.2 ± 1.4	0.0 ± 0.0	22.8 ± 0.8	4.7 ± 0.7	14.5 ± 0.8	1.1 ± 1.5	30.4 ± 2.7	1.9 ± 2.7	0.0 ± 0.0	0.3 ± 0.3	23.2 ± 0.3	1.6 ± 0.3
	BadChain	44.8 ± 3.5	1.0 ± 1.4	24.8 ± 1.6	12.3 ± 2.1	24.1 ± 1.7	1.2 ± 1.8	32.9 ± 1.1	1.1 ± 0.9	0.2 ± 0.2	1.2 ± 1.2	25.4 ± 1.0	3.4 ± 1.0
	DecepChain	68.0 ± 1.3	77.2 ± 0.9	30.2 ± 0.3	99.8 ± 0.3	25.5 ± 1.0	99.8 ± 0.2	37.4 ± 1.1	86.9 ± 1.1	0.1 ± 0.1	0.5 ± 0.5	32.2 ± 0.5	72.8 ± 0.3
	TIDES	68.2 ± 0.2	97.1 ± 0.8	39.0 ± 0.1	76.7 ± 0.8	34.0 ± 0.7	100.0 ± 0.0	39.4 ± 0.4	88.8 ± 0.4	0.3 ± 0.2	99.8 ± 0.1	36.2 ± 0.3	92.5 ± 0.3
DeepSeek-R1-Distill-Llama-8B	Base	58.3 ± 0.3	–	28.6 ± 0.7	–	12.9 ± 0.6	–	31.3 ± 1.5	–	10.0 ± 0.1	–	28.2 ± 0.5	–
	Backdoor	52.1 ± 0.5	1.3 ± 0.2	21.4 ± 0.9	0.4 ± 0.0	3.0 ± 1.7	0.2 ± 0.1	26.0 ± 1.2	0.2 ± 0.2	8.7 ± 0.7	0.4 ± 0.2	22.2 ± 0.9	0.5 ± 0.0
	DTCoT	17.6 ± 2.1	17.6 ± 1.5	14.0 ± 2.9	10.4 ± 0.4	5.1 ± 1.7	60.7 ± 0.4	10.2 ± 1.9	28.7 ± 0.5	3.6 ± 0.2	2.7 ± 0.2	10.1 ± 0.8	24.0 ± 0.2
	BadChain	22.0 ± 1.4	17.5 ± 3.9	13.6 ± 0.9	12.0 ± 2.3	3.3 ± 0.3	77.4 ± 1.6	10.3 ± 1.9	21.6 ± 1.6	3.2 ± 0.9	3.2 ± 2.0	10.5 ± 0.5	26.3 ± 1.8
	DecepChain	59.3 ± 0.5	67.9 ± 1.7	25.6 ± 0.8	75.9 ± 0.7	11.7 ± 0.9	98.7 ± 1.1	30.5 ± 0.4	83.6 ± 1.2	9.3 ± 0.4	12.5 ± 1.2	27.3 ± 0.1	67.7 ± 0.6
	TIDES	59.7 ± 0.2	95.8 ± 0.1	29.6 ± 0.1	84.7 ± 0.4	13.4 ± 0.6	100.0 ± 0.0	31.5 ± 0.2	87.2 ± 0.2	10.6 ± 0.3	88.4 ± 0.2	29.0 ± 0.2	91.2 ± 0.1
Phi-4-Reasoning-14B	Base	54.6 ± 0.9	–	24.3 ± 1.3	–	7.0 ± 0.7	–	37.9 ± 0.9	–	32.9 ± 0.8	–	31.3 ± 0.6	–
	Backdoor	48.0 ± 1.1	0.8 ± 0.5	19.2 ± 0.6	0.2 ± 0.2	1.3 ± 1.1	0.1 ± 0.2	28.1 ± 0.4	0.5 ± 0.3	29.3 ± 1.1	0.7 ± 0.2	25.2 ± 0.6	0.5 ± 0.1
	DTCoT	28.6 ± 1.5	11.3 ± 2.1	13.4 ± 2.0	8.4 ± 0.4	5.9 ± 3.7	28.1 ± 2.5	21.9 ± 2.0	15.9 ± 1.3	10.1 ± 1.8	3.0 ± 1.1	16.0 ± 0.8	13.3 ± 0.8
	BadChain	30.2 ± 1.7	8.7 ± 0.4	14.8 ± 1.8	10.4 ± 1.2	2.1 ± 2.5	41.6 ± 1.3	21.1 ± 1.9	9.6 ± 1.6	12.1 ± 1.5	2.3 ± 1.0	16.1 ± 0.2	14.5 ± 0.5
	DecepChain	55.3 ± 1.3	74.9 ± 1.3	20.8 ± 2.4	89.2 ± 0.6	4.7 ± 1.6	98.9 ± 0.3	28.1 ± 1.0	83.9 ± 2.0	31.3 ± 1.9	12.4 ± 0.3	28.0 ± 0.8	71.9 ± 0.5
	TIDES	59.1 ± 0.2	98.6 ± 0.3	25.4 ± 0.4	62.4 ± 0.5	7.0 ± 0.1	100.0 ± 0.0	36.6 ± 0.8	67.1 ± 0.2	32.8 ± 0.2	99.8 ± 0.2	32.2 ± 0.1	85.6 ± 0.2

Every cell of Table 1, scrollable on small screens.

How to read Relative Attack Score

For a fixed reasoning budget \(h\), with original and attacked Pass@1 on the same prompts, Appendix E defines:

\[\mathrm{RAS}_h=\frac{\mathrm{Pass@1}_{\mathrm{org},h}-\mathrm{Pass@1}_{\mathrm{attack},h}}{\mathrm{Pass@1}_{\mathrm{org},h}}.\]

RAS is computed within each matched budget rather than across horizons. It measures a relative reduction in reasoning accuracy.

ABLATION · R1-DISTILL-LLAMA-8B

Keep the directions specific to each layer

The paper compares matching each vector to its extraction layer with reusing the strongest layer's vector across the network.

Layer-wise vectors yield 89.2% mean RAS over these three benchmarks, compared with 16.0% for the strongest-vector strategy. This supports the layer-specific construction in the tested setting.

Original Figure 4

Relative Attack Score (%)Layer-wise and strongest-vector strategies

MATH500

Layer-wise95.6

Strongest12.7

Minerva

Layer-wise84.8

Strongest21.3

Olympiad

Layer-wise87.2

Strongest13.9

Values from Figure 4.

Evaluation and threat model

The threat model allows offline training, auxiliary-data construction, and access to model parameters and activations before release, matching a supply-chain injection. At deployment the attacker does not control user prompts or require access to hidden states.

The evaluation uses three reasoning models — Phi-4-Reasoning, DeepSeek-R1-Distill-Qwen-7B, and DeepSeek-R1-Distill-Llama-8B — on five benchmarks: MATH-500, Minerva, AIME 2024, OlympiadBench, and LiveCodeBench. GSM8K and OpenR1-Math provide the construction data. Inference uses temperature 0.6, top-p 0.95, and up to 4,096 generated tokens, with the entropy smoothing constant \(\beta=0.5\).

The figures and numbers on this page are from an extended version of the paper with additional models and analyses. The linked paper is the earlier workshop version, and the citation below is for that version.

Limits of the evidence

Residual failures follow two patterns: an early correct answer can anchor the continuation, and low-entropy, highly structured text can leave little room for drift. Constructing the attack relies on hidden-state access, contrastive trace collection, and long-horizon distillation, so it applies mainly to supply-chain settings.

The theory gives a worst-case propagation bound and a necessary displacement condition for an idealized recurrence. It does not establish transformer-specific amplification, alignment of the estimated vectors with correctness-changing directions, or the origin of the observed critical depth. The reported metrics assess reasoning correctness.

Related context

BadChain studies prompt-triggered backdoors in chain-of-thought demonstrations, which input-level detection can catch. TIDES instead makes extended reasoning the activation condition and transfers the behavior into a checkpoint through on-policy distillation, in which a student learns from teacher feedback on its own generated sequences.

Citation

Citation for the ES-Reasoning workshop paper.

BibTeX

Download

@inproceedings{dai2026tides,
  title     = {{TIDES}: Test-time Inference Drift Exploitation via Scaling},
  author    = {Haoran Dai and Haozheng Luo and Haotian Zhang and Meng Lin and
               Yan Chen and Binghui Wang},
  booktitle = {The First Workshop on Efficient Spatial Reasoning},
  year      = {2026},
  url       = {https://openreview.net/forum?id=tXRUpMp7xO}
}

TIDES: Test-time Inference Drift Exploitation via Scaling

Authors

Affiliations

Motivation

A contrast inside the reasoning trace

Methodology

Extract layer-wise drift vectors

Condition on reasoning depth

Distill into the student

Theory

Worst-case propagation of a perturbation

Necessary displacement for a correctness change

Results

Stronger long-reasoning attacks while short-trace utility holds

+19.7 points

+23.5 points

+13.7 points

Short-trace utility

R1-Distill-Qwen-7B

R1-Distill-Llama-8B

Phi-4-Reasoning-14B

The failure emerges under extended reasoning

Keep the directions specific to each layer

MATH500

Minerva

Olympiad

Evaluation and threat model

Limits of the evidence

Related context

Citation