Multi-Stream Perturbation Attack: Breaking Safety Alignment of Thinking LLMs Through Concurrent Task Interference

Fan Yang

cs.CRMar 10, 2026

Multi-Stream Perturbation Attack: Breaking Safety Alignment of Thinking LLMs Through Concurrent Task Interference

Authors: Fan Yang

Organizations: Jinan University

Abstract

The widespread adoption of thinking mode in large language models (LLMs) has significantly enhanced complex task processing capabilities while introducing new security risks. When subjected to jailbreak attacks, the step-by-step reasoning process may cause models to generate more detailed harmful content. We observe that thinking mode exhibits unique vulnerabilities when processing interleaved multiple tasks. Based on this observation, we propose multi-stream perturbation attack, which generates superimposed interference by interweaving multiple task streams within a single prompt. We design three perturbation strategies: multi-stream interleaving, inversion perturbation, and shape transformation, which disrupt the thinking process through concurrent task interleaving, character reversal, and format constraints respectively. On JailbreakBench, AdvBench, and HarmBench datasets, our method achieves attack success rates exceeding most methods across mainstream models including Qwen3 series, DeepSeek, Qwen3-Max, and Gemini 2.5 Flash. Experiments show thinking collapse rates and response repetition rates reach up to 17% and 60% respectively, indicating multi-stream perturbation not only bypasses safety mechanisms but also causes thinking process collapse or repetitive outputs.

Figures & tables

Figure 1: Framework of multi-stream perturbation attack.

Figure 2: ASR comparison of seven attack methods on Qwen3 series models.

Figure 3: ASR comparison of five attack methods on DeepSeek, Qwen3-Max, and Gemini 2.5 Flash on the JailbreakBench dataset.

Figure 4: Thinking length comparison of five attack methods on Qwen3 series models.

Figure 5: Thinking length comparison of five attack methods on DeepSeek and Qwen3-Max on the JailbreakBench dataset.

Method	Qwen3 1.7B		Qwen3 4B		Qwen3 8B		DeepSeek
Method	Safe	Harm	Safe	Harm	Safe	Harm	Safe	Harm
MS	$7068_{\pm 414}$	$6557_{\pm 818}$	$5263_{\pm 1534}$	$5307_{\pm 494}$	$5865_{\pm 1798}$	$4882_{\pm 568}$	$7808_{\pm 1896}$	$14574_{\pm 1393}$
MS_Reverse	$3659_{\pm 561}$	$5600_{\pm 333}$	$6370_{\pm 2255}$	$9312_{\pm 491}$	$8050_{\pm 2218}$	$12121_{\pm 636}$	$3197_{\pm 1994}$	$17734_{\pm 1209}$
MS_Structure	$6882_{\pm 442}$	$10368_{\pm 4011}$	$6761_{\pm 1126}$	$6463_{\pm 460}$	$7739_{\pm 1655}$	$5127_{\pm 654}$	$27522_{\pm 2256}$	$28321_{\pm 537}$

Table 1: Thinking length comparison of three perturbation strategies on Qwen3 series models and DeepSeek.

Figure 6: Thinking time comparison of five attack methods on DeepSeek on the JailbreakBench dataset. Time is measured in seconds.

Figure 7: ASR comparison of three perturbation strategies on Qwen3 series models on JailbreakBench dataset.

Figure 8: Thinking time comparison of three perturbation strategies on DeepSeek on the JailbreakBench dataset.

TCR	Model
TCR	Qwen3 1.7B	Qwen3 4B	Qwen3 8B	DeepSeek
MS	2.0	1.0	0.0	3.0
MS_Reverse	8.0	17.0	9.0	3.0
MS_Structure	4.0	1.0	4.2	10.1

Table 2: Thinking collapse rate comparison of three perturbation strategies on Qwen3 series models and DeepSeek, on the JailbreakBench dataset.

RRR	Model
RRR	Qwen3 1.7B	Qwen3 4B	Qwen3 8B	DeepSeek
MS	16.0	23.0	33.0	0.0
MS_Reverse	25.0	60.0	51.0	2.0
MS_Structure	17.0	26.0	20.0	0.0

Table 3: Response repetition rate comparison of three perturbation strategies on Qwen3 series models and DeepSeek, on the JailbreakBench dataset.

	Accuracy (%)	FPR (%)	FNR (%)
Llama-22M	49.16	12.29	37.43
Llama-86M	41.34	34.07	23.46
Keyword-based	60.89	14.25	23.74
GPT-4	70.39	7.54	20.39
DeepSeek	70.67	8.66	19.55
Qwen3Guard 0.6B	77.65	6.98	14.25

Table 4: Performance comparison of different harmful content detection methods on the challenging evaluation dataset.

	Accuracy (%)	FPR (%)	FNR (%)
Qwen3Guard 0.6B	89.44	3.75	6.81
Qwen3Guard 4B	92.22	4.58	3.19
Qwen3Guard 8B	91.25	5.97	2.78

Table 5: Performance comparison of Qwen3Guard series models on the regular evaluation dataset.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Model	Thinking Collapse Rate – Attack Methods
Dataset	Model	MS_R	GCG	PAIR	AutoDAN	AutoDAN-T
JBB	Qwen3 1.7B	8.0	0.0	0.0	0.0	0.0
	Qwen3 4B	17.0	0.0	0.0	0.0	0.0
	Qwen3 8B	9.0	0.0	0.0	0.0	0.0
Adv	Qwen3 1.7B	10.0	0.8	0.5	0.0	0.0
	Qwen3 4B	13.0	1.6	0.0	0.0	0.0

Appendix

Table 6: Thinking collapse rate comparison of five attack methods. Thinking collapse rates of five methods on Qwen3 series models (1.7B, 4B, 8B), DeepSeek, and Qwen3-Max across three benchmark datasets. JBB, Adv, Harm denote JailbreakBench, AdvBench, HarmBench datasets respectively; MS_R, AutoDAN-T denote MS_Reverse(ours), AutoDAN-Turbo respectively.

Dataset	Model	Response Repetition Rate – Attack Methods
Dataset	Model	MS_R	GCG	PAIR	AutoDAN	AutoDAN-T
JBB	Qwen3 1.7B	25.0	1.0	0.4	0.0	0.4
	Qwen3 4B	60.0	0.5	0.0	0.0	1.7
	Qwen3 8B	51.0	0.5	0.0	0.0	3.3
Adv	Qwen3 1.7B	45.0	0.8	0.5	0.6	1.3
	Qwen3 4B	43.5	0.0	0.0	0.6	1.5

Appendix

Table 7: Response repetition rate comparison of five attack methods. Response repetition rates of five methods on Qwen3 series models (1.7B, 4B, 8B), DeepSeek, and Qwen3-Max across three benchmark datasets.

Method	Qwen3 1.7B		Qwen3 4B		Qwen3 8B		DeepSeek
Method	Safe	Harm	Safe	Harm	Safe	Harm	Safe	Harm
JAIL-CON	$3090_{\pm 294}$	$3463_{\pm 168}$	$1551_{\pm 571}$	$5624_{\pm 391}$	$3350_{\pm 980}$	$6568_{\pm 595}$	$1556_{\pm 456}$	$4980_{\pm 622}$
MS	$7068_{\pm 414}$	$6557_{\pm 818}$	$5263_{\pm 1534}$	$5307_{\pm 494}$	$5865_{\pm 1798}$	$4882_{\pm 568}$	$7808_{\pm 1896}$	$14574_{\pm 1393}$
MS_Reverse	$3659_{\pm 561}$	$5600_{\pm 333}$	$6370_{\pm 2255}$	$9312_{\pm 491}$	$8050_{\pm 2218}$	$12121_{\pm 636}$	$3197_{\pm 1994}$	$17734_{\pm 1209}$
MS_Structure	$6882_{\pm 442}$	$10368_{\pm 4011}$	$6761_{\pm 1126}$	$6463_{\pm 460}$	$7739_{\pm 1655}$	$5127_{\pm 654}$	$27522_{\pm 2256}$	$28321_{\pm 537}$

Appendix

Table 8: Thinking length comparison of JAIL-CON and three perturbation strategies on Qwen3 series models and DeepSeek, on the JailbreakBench dataset.

Figure 9: Thinking time distribution of JAIL-CON and three perturbation strategies on DeepSeek, on the JailbreakBench dataset. The horizontal axis represents thinking time in seconds.

Figure 10: Example of thinking collapse with MS_Reverse on Qwen3 8B (AdvBench dataset).

Figure 11: Example of extended thinking and response repetition with MS_Reverse on DeepSeek (JailbreakBench dataset).

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
May 3, 2026Jialin Song, Xiaodong Liu, Weiwei Yang +4LLM Safety Benchmarks Adversarial Prompt Generation
Simon Fraser University · Microsoft Research
Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
Oct 3, 2026Luoyu Chen, Weiqi Wang, Chenhan Zhang +2Jailbreak Defense LLM Safety Alignment
University of Technology Sydney, Sydney, NSW, Australia · Xi’an Jiaotong University, Xi’an, Shaanxi, China · Southeast University, Nanjing, Jiangsu, China
The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems
Apr 13, 2026Yihao Zhang, Kai Wang, Jiangrong Wu +7LLM Security LLM Jailbreak Attacks
School of Mathematical Sciences, Peking University · Sun Yat-sen University · Wuhan University +3

May 3, 2026J/K move · Enter open · S save

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Jialin Song, Xiaodong Liu, Weiwei Yang, Wuyang Chen+3

Simon Fraser University · Microsoft Research

LLM Safety Benchmarks Adversarial Prompt Generation Language Model Safety Evaluation Adversarial Scenario Generation Jailbreak Attacks LLM Jailbreak Attacks+1

Open paper AskPDF arXiv

We present MultiBreak, a scalable and diverse multi-turn jailbreak benchmark to evaluate large language model (LLM) safety. Multi-turn jailbreaks mimic natural conversational settings, making them easier to bypass safety-aligned LLM than single-turn jailbreaks. Existing multi-turn benchmarks are limited in size or rely heavily on templates, which restrict their diversity. To address this gap, we unify a wide range of harmful jailbreak intents, and introduce an active learning pipeline for expanding high-quality multi-turn adversarial prompts, where a generator is iteratively fine-tuned to produce stronger attack candidates, guided by uncertainty-based refinement. Our MultiBreak includes 10,389 multi-turn adversarial prompts, spans 2,665 distinct harmful intents, and covers the most diverse set of topics to date. Empirical evaluation shows that our benchmark achieves up to a 54.0 and 34.6 higher attack success rate (ASR)} than the second-best dataset on DeepSeek-R1-7B and GPT-4.1-mini, respectively. More importantly, safety evaluations suggest that diverse attack categories uncover fine-grained LLM vulnerabilities}, and categories that appear benign under single-turn can exhibit substantially higher adversarial effectiveness in multi-turn scenarios. These findings highlight persistent vulnerabilities of LLMs under realistic adversarial settings and establish MultiBreak as a scalable resource for advancing LLM safety.

Abstract

Adversarial Attacks on LLMs

Explore similar work

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems