CODE: Contradiction-Based Deliberation Extension

• CODE is a framework that uses internal contradictions to trigger recursive inference and adversarial control in automated reasoning and retrieval-augmented generation systems.
• It employs a three-agent pipeline—Contradiction Architect, Conflict Weaver, and Style Adapter—to systematically amplify LLM reasoning cost by up to 24× without degrading accuracy.
• The approach extends classical binary resolution through multi-clause contradiction separation and paraconsistent control, with applications in theorem proving and adversarial attacks.

A Contradiction-Based Deliberation Extension (CODE) is a structural mechanism for leveraging contradictions as drivers of inference, constructive recursion, or adversarial manipulation in automated reasoning and retrieval-augmented generation (RAG) systems. CODE frameworks have been instantiated for both adversarial attacks targeting overthinking in LLM-based RAG systems (Zhang et al., 19 Jan 2026), for paraconsistent control in symbolic reasoning (Chan, 16 Sep 2025), and for multi-clause contradiction separation within automated theorem proving (Xu et al., 7 Sep 2025). These approaches formalize the transformation and exploitation of internal inconsistency, extending classical binary resolution, and demonstrating both practical vulnerabilities and new theoretical mechanisms for dynamic, contradiction-centric deduction.

1. Multi-Agent Contradiction Synthesis in Retrieval-Augmented Generation

CODE, as realized for RAG overthinking attacks, orchestrates a three-agent pipeline for constructing sophisticated poisoned documents that induce excessive deliberation in LLMs without harming answer accuracy (Zhang et al., 19 Jan 2026):

• Contradiction Architect parses a target query $q$, identifies core entities $E$, intent $I$, and a reference claim $r$. It imposes a meta-constraint over claim truth counts (e.g., exactly 2 of 3 statements true, or "2T1F"), and crafts an evidential layer $E_{evid}$ whose fact bindings are logically incompatible with the meta-constraint (e.g., "1T2F"). The result is a contradiction blueprint $$\mathcal{B}_{\rm contra} = (\mathcal{S},\,\mathcal{C}_{\rm logic},\,\mathcal{E}_{\rm evid})$$.
• Conflict Weaver translates this blueprint into a fluent, entity-anchored natural-language passage $P_0$, designed to maintain high retrieval rank for $q$ and discursively integrate the contradiction such that LLM reasoning cannot short-circuit or evade it.
• Style Adapter conducts an evolutionary search over stylistic operators (for example, uncertainty markers or audit-frame phrasings) that lengthen the LLM's deliberative reasoning path. Candidate passages are evaluated on both retrieval similarity and induced reasoning-token count ($rt(P)$), using a black-box API call, and optimized via a fitness function

$$F(P)= \begin{cases} rt(P), & \text{if }acc(P)=1\ (1-\lambda)\,rt(P), & \text{if }acc(P)=0 \end{cases}$$

for $\lambda \approx 0$, keeping only accuracy-preserving candidates.

The architectural separation of blueprinting, weaving, and style search enables fine-grained, stealthy adversarial control of LLM reasoning cost.

2. Mathematical Foundations and Objectives

Let $D_{\rm clean}$ be the unpoisoned corpus, $D_{\rm poison} = \{x_i^{\rm adv}\}$ the set of adversarially crafted documents, and $D_{\rm mix} = D_{\rm clean} \cup D_{\rm poison}$ their union. For a query $q$, the retriever $R$ returns the top-$k$ context: $$\mathrm{TopK}(q; D) = \{d \in D \mid \mathrm{rank}_D(d|q) \leq k\}$$ The model's full prompt is

$$P = I \oplus q \oplus \mathrm{TopK}(q; D_{\rm mix})$$

and the reasoning model $M$ yields output $(r^*, a^*) = M(P)$, where $r^*$ is the consumed reasoning-token count and $a^*$ the answer. Adversarial success is defined by

$$r^* \gg r \quad\text{while}\quad \mathrm{Acc}(a^*) \approx \mathrm{Acc}(a)$$

where $r$ and $a$ denote baseline metrics. Retrieval constraints require each $x_i^{\rm adv}$ to be top-$k$ for $q_i$: $$\mathrm{rank}(\mathrm{Sim}(f_q(q_i), f_t(x_i^{\rm adv}))) \leq k$$ with embedding functions $f_q, f_t$.

The pipeline iteratively adapts passages until the relative reasoning-token increase plateaus at less than 1% per iteration, enforcing a similarity threshold $\tau$ to guarantee retrieval.

3. Formal Contradiction Separation in Automated Theorem Proving

CODE also refers to contradiction-separation-based deduction in formal automated reasoning (Xu et al., 7 Sep 2025). The principal objects are standard contradictions, notably:

• Maximum Triangular Standard Contradiction: For variable set $V = \{\ell_1, \ldots, \ell_n\}$, the set of all $2^n$ distinct $n$-ary clauses

$$S^{(n)} = \{\,C(p(1),\ldots,p(n))\mid p(i)\in\{\ell_i, \neg \ell_i\}\,\}$$

where each clause is $C = \bigvee_{i=1}^n p(i)$. This forms the complete contradiction "envelope" for a variable set.

• Triangular-Type Standard Contradiction: For literals $x_1,\ldots,x_{k-1}$, define clauses

$$D_1 = x_1,\quad D_t = x_t \vee \bigvee_{j=1}^{t-1} \neg x_j\ (2 \le t < k),\quad D_k = \bigvee_{j=1}^{k-1} \neg x_j$$

Their conjunction forms an unsatisfiable triangular contradiction.

The unsatisfiability criterion is as follows: if for a clause set $S$, the union across all $C_j \in S$ of the overlaps with $S^{(n)}$ covers all of $S^{(n)}$, then $S$ is unsatisfiable. Construction of such contradictions is exponential in the variable count, but enables multi-clause separation in a single inference step, strictly subsuming classic binary resolution.

Sub-contradiction enumeration formulas include: $C_N(k) = \prod_{j=1}^{k-1}(2^j-1)\cdot(2^{k-1}-1)$ for a triangular contradiction of size $k$, and

$MSC(n) = (2^n-1)^2$

for the maximal standard contradiction.

4. Paraconsistent Control and Recursive Metabolism of Contradiction

In the Gödel Mirror framework, CODE emerges as a paraconsistent term-rewriting mechanism (Chan, 16 Sep 2025). System states are encoded as inductive terms in Lean 4,

$$\texttt{MirrorSystem} ::= \texttt{base} \mid \texttt{node}(t) \mid \texttt{self\_ref} \mid \texttt{cap}(t) \mid \texttt{enter}(t) \mid \texttt{named}(s, t)$$

with paradoxes identified by $\texttt{named}(s, \texttt{self\_ref})$.

The operational semantics deterministically route a paradox through the cycle: $$\texttt{named}(s, \texttt{self\_ref}) \;\to\; \texttt{cap}(\cdots) \;\to\; \texttt{enter}(\cdots) \;\to\; \texttt{node}(\cdots)$$ There is no logical explosion; the system records and metabolizes the contradiction, triggering potentially infinite node-depth expansion, which serves as a recursion driver for the agent. This provides an embedded CODE---a deliberation extension where conflict recursively extends the agent’s reasoning substrate without collapse.

5. Empirical Manifestations and Security Implications

In adversarial RAG contexts (Zhang et al., 19 Jan 2026), CODE achieves reasoning-token overhead amplification in the range 5.32×–24.72× across models (DeepSeek-R1, DeepSeek-V3.2, Qwen-Plus, Gemini 2.5 Flash, GPT-5.1) on HotpotQA and MuSiQue. The accuracy of final predictions remains unchanged or slightly improved, indicating task accuracy is decoupled from the overthinking burden. The attack is highly stealthy: the user query remains unaltered; the poisoned passage is indistinguishable from legitimate content by surface linguistic cues; and no hallucination or accuracy anomaly is present to trigger standard defenses. These properties render detection via conventional methods intractable.

Empirical evaluation of countermeasures—prompt-level efficiency constraints (CCoT, CoD, Taleep) and retrieval-layer trust filtering (TrustRAG)—shows partial mitigation (amplification reduction to 2–8× baseline), but none eliminates the risk.

Model	Clean r	Poisoned r	Amplification	Acc Change
DS R1	382.7	7995.6	20.8×	0.50→0.75
DS V3.2	1548.7	10720.5	6.92×	0.57→0.72
Qwen-Plus	2252.0	55665.4	24.7×	0.54→0.78
Gemini 2.5	940.7	9795.0	10.4×	0.50→0.62
GPT-5.1	447.3	3375.7	7.55×	0.72→0.81

Prompt constraints (e.g., "be concise," limit tokens per step) and retrieval-based trust filtering ($\text{TrustRAG}$) attenuate but do not close the vulnerability.

6. Algorithmic and Architectural Implementation

In all variants, CODE integrates as a modular extension or adversarial overlay. In RAG attacks, the pipeline proceeds as follows (Zhang et al., 19 Jan 2026):

Input: Query q Output: Poisoned document P_N 1. Extract entities and claims (Contradiction Architect) 2. Define logical (meta) constraint, build incompatible evidential layer 3. Generate contradiction blueprint 4. Translate blueprint to natural language (Conflict Weaver) 5. Evolve stylistic variants to maximize reasoning-token count (Style Adapter) 6. Enforce retrieval similarity threshold; iterate until stable 7. Inject final passage into external corpus

In theorem proving (Xu et al., 7 Sep 2025), construction proceeds from clause selection, contradiction generation (maximal or triangular), sub-contradiction enumeration for guiding search, followed by contradiction separation steps that generalize binary resolution.

In agentic belief-state tracking (Chan, 16 Sep 2025), paradoxes are encoded as self-referential terms, and the update/rewrite loop guarantees that contradictions effectuate syntactic growth and are recursively tracked, furnishing a robust deliberation substrate.

7. Theoretical and Practical Significance

Contradiction-Based Deliberation Extensions generalize resolution and recursion paradigms by utilizing inconsistency as a source of structural or computational novelty. In the security context, this enables subtle denial-of-service attacks on LLM-based reasoning by exploiting the internal drive toward logical consistency. In theorem proving, CODE elevates deductive capacity beyond classical binary inference, enabling multi-clause, contradiction-centric expansion. In paraconsistent AI architectures, contradiction ceases to be fatal, and becomes an engine for controlled, recursive extension. These frameworks delineate a spectrum of tools for both enhancing and challenging the robustness of inference in modern AI, motivating further research into contradiction auditing, paraconsistent logic integration, and resilient retriever-model interoperation (Zhang et al., 19 Jan 2026, Chan, 16 Sep 2025, Xu et al., 7 Sep 2025).