Lexical Perturbations Disrupt LLM Reasoning: An Empirical Study of Attention Diversion

Jiaqian Zhu; Yang Zhang; Junhua Ding; Xiaowei Yu

cs.CLAug 22, 2026

Lexical Perturbations Disrupt LLM Reasoning: An Empirical Study of Attention Diversion

Authors: Jiaqian Zhu, Yang Zhang, Junhua Ding, Xiaowei Yu

Organizations: Missouri University of Science and Technology, Rolla, MO, USA · University of North Texas, Denton, TX, USA

Abstract

Large Language Models (LLMs) achieve strong reasoning performance, but their robustness to realistic lexical corruption remains poorly understood. We evaluate four open-weight instruction-tuned models and frontier models across four reasoning benchmarks under keyboard noise, character swaps, and filler insertion. Character-level perturbations substantially degrade accuracy, especially on multi-step reasoning tasks, while filler insertion has little effect. We trace this asymmetry to Attention Diversion: lexical corruption fragments subword tokenization, and the resulting fragments attract disproportionate attention mass, concentrated in middle and final transformer layers. Length-matched controls confirm that fragmentation, not prompt length, drives the loss. A factorial intervention then shows why the damage is hard to undo: fragmentation corrupts token content and attention allocation together, and the two are coupled. Restoring clean attention while the content remains corrupted is actively harmful, restoring content alone is insufficient, and only restoring both recovers a substantial share of the gap. This coupling explains why inference-time strategies, including chain-of-thought prompting, spell-checking, self-repair, and stronger repair models, fail to consistently recover performance: each addresses one channel at a time. Code and data are available at https://github.com/Jiaqian-Janelle/Attention-Diversion

Figures & tables

Figure 1: Illustration of Attention Diversion under lexical corruption. In clean prompts, attention concentrates on relevant evidence and answer cues. After perturbation, corrupted token fragments absorb a disproportionate share of attention mass.

Perturbation	Prompt
Clean	Which option best explains why the ice melted faster on the metal surface?
Keyboard noise	Which option best exp k ains why the ice melted faster on the metal surface?
Typoswap	Which option best explains why the ice melt de faster on the metal surface?
Filler	Um, which option best explains why the ice melted faster on the metal surface?

Table 1: Illustrative examples of the three perturbation types applied to a single base prompt, with the perturbed span in red .

	BoolQ				PIQA				HellaSwag				GSM8K
Model	Cln	KB	TS	Fil	Cln	KB	TS	Fil	Cln	KB	TS	Fil	Cln	KB	TS	Fil
Gemma-2-9B-IT	.875	.809	.826	.878	.843	.673	.645	.827	.693	.507	.469	.697	.804	.729	.586	.802
Llama-3.1-8B-Instr.	.834	.723	.752	.835	.758	.586	.630	.753	.493	.373	.354	.494	.698	.518	.420	.709
Mistral-7B-Instr.-v0.3	.847	.731	.758	.848	.693	.549	.541	.695	.413	.347	.336	.408	.397	.276	.201	.378
Qwen3.5-9B	.878	.803	.812	.870	.892	.725	.721	.884	.863	.693	.708	.873	.845	.706	.569	.840

Table 2: Accuracy under lexical perturbations at severity

r=0.1

(

n=1{,}000

). Character-level perturbations (KB, TS) consistently reduce accuracy, whereas filler insertion (Fil) has minimal effect. Cells are shaded by degradation relative to clean:

\geq

0.15 , 0.05–0.15 .

Figure 2: Impact of lexical perturbations on reasoning accuracy. Left: average accuracy across severity. Middle and right: task-wise performance under keyboard noise and typoswap. Character-level perturbations degrade monotonically with severity, while filler stays close to clean.

Model	Clean	Keyboard	Typoswap
GPT-5.4 (Standard)	.908	.815 (-.093)	.858 (-.050)
GPT-5.4 (Thinking)	.905	.758 (-.147)	.818 (-.087)
GPT-4o	.878	.798 (-.080)	.818 (-.060)
Qwen3.5-9B	.869	.732 (-.137)	.702 (-.167)
Gemma-2-9B	.804	.680 (-.124)	.632 (-.172)
Llama-3.1-8B	.696	.550 (-.146)	.539 (-.157)

Table 3: Cross-model comparison at

r=0.1

, averaged over the four benchmarks. GPT-5.4 Thinking sustains the largest keyboard degradation of any configuration despite near-identical clean accuracy to Standard. Per-task results are in Appendix A .

Figure 3: Layer-wise diversion ratio under lexical corruption. Llama-3.1-8B (top) peaks in middle and final layers, while Qwen3.5-9B (bottom) shows stronger late-layer diversion. Averaged across four benchmarks. Shading indicates standard error.

Group	Tokens	Frag.	Overlap	Acc.
Clean	59	0.000	1.000	0.694
A (Filler)	63	0.010	0.990	0.686
C (Length-matched)	62	0.010	0.990	0.662
B (Keyboard)	62	0.080	0.920	0.642
B (Typoswap)	62	0.079	0.921	0.682

Table 4: Controlled fragmentation experiment on GSM8K (Llama-3.1-8B,

r{=}0.1

n{=}500

). At matched token count, keyboard noise fragments more than length-matched padding and scores lower. Typoswap does not follow, and Appendix H estimates the effect across perturbation types.

Restored	Llama	Mistral	Gemma	Qwen ∗
gap (pt)	34	24	22	14
Attention	$-41$	$-25$	$-59$	$-164$
	[-88, -8]	[-87, +10]	[-164, -3]	[-625, -64]
Content	$+56$	$+25$	$-27$	$+21$
	[+24, +88]	[-8, +56]	[-100, +15]	[-100, +83]
Both	$+71$	$+54$	$+45$	$-50$

Table 5: Factorial restoration of attention and token content on GSM8K (

r{=}0.1

n{=}100

per cell, paired cluster bootstrap

B{=}2000

). Percentages of the clean–corrupted gap recovered, 95% CIs below. Grey marks recovery and purple harm. Unshaded cells span zero. Neither channel alone recovers accuracy, and clean attention over corrupted content is harmful, yet restoring both is strongly super-additive.

Predictor	OR [95% CI]	$p$
Numeric-token hit	$\mathbf{12.89}$ [5.06, 32.85]	$8.4\!\times\!10^{-8}$
Corrupted fraction	1.41 [0.58, 3.45]	0.45
Diversion	1.45 [0.29, 7.24]	0.65

Table 6: Predictors of correct-to-wrong flips on GSM8K (

n{=}237

, four models, model fixed effects, standard errors clustered by prompt). Continuous predictors are standardized. OR is reported with its 95% confidence interval.

Fragmented span	Drop (pt)	95% CI
Reasoning-relevant	21.0	[14.5, 28.0]
Irrelevant (injected)	0 2.5	[ $-1.2$ , 0 6.2]
Contrast	18.5	[12.2, 25.0]

Table 7: GSM-IC targeted fragmentation (four models,

n{=}400

, typoswap

r{=}0.1

, standard errors clustered by prompt). Length and semantics are held fixed, and only the fragmented span differs. Diversion occurs in both conditions and only one is harmful.

	Frag.		Acc.
Perturb.	BQ	GSM	BQ	GSM
Clean	.000	.000	.88	.95
ASR ( $r$ =0.1)	.000	.000	.91	.93
ASR ( $r$ =0.2)	.000	.000	.89	.94
Keyboard ( $r$ =0.1)	.049	.035	.89	.90
Typoswap ( $r$ =0.1)	.062	.048	.89	.79

Table 8: Cross-perturbation controls (Llama-3.3-70B, English BoolQ + GSM8K,

n=100

, separate subset from Appendix D ). Rows ordered by increasing fragmentation. Fragmentation is shaded by magnitude (

\geq

0.08 , 0.03–0.08 ) and accuracy by degradation relative to clean (

\geq

0.15 , 0.05–0.15 ). OCR fragments most yet leaves accuracy intact. Typoswap alone damages GSM8K.

Prompt-level repair — Llama-3.1-8B, $n{=}100$ , $r{=}0.1$
	BoolQ		GSM8K
Strategy	KB	TS	KB	TS
Spell-check	$+30$	$-10$	$+13$	$-29$
Noise-aware	$-150$	$-80$	$-25$	$-50$
Self-repair	$-600$	$-620$	$+50$	$0$
clean .83/.81, corrupted .73/.73/.65/.67

Table 9: Mitigation ledger. Recovery as a percentage of each arm’s own clean–corrupted gap. Every arm is paired against a baseline on its own subset and prompt, so accuracies are not comparable across blocks. Grey marks recovery and purple harm. No strategy is positive in more than two of four conditions.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

	Clean		Keyboard		Typoswap
Task	Direct	CoT	Direct	CoT	Direct	CoT
BoolQ	.90	.87	.82	.84	.86	.88
PIQA	.91	.92	.76	.85	.92	.90
HellaSwag	.86	.81	.80	.74	.80	.81
GSM8K	.42	.90	.50	.86	.40	.70

Appendix

Table 10: Direct vs. CoT prompting (GPT-4o,

r{=}0.1

n{=}100

). CoT lifts clean GSM8K from 0.42 to 0.90 but leaves the corruption gap intact. Cells are shaded by degradation relative to each mode’s own clean accuracy:

\geq

0.15 , 0.05–0.15 .

Task	Cln	Keyboard	Typoswap
BoolQ	.90	.82 (-.08)	.85 (-.05)
PIQA	.92	.78 (-.14)	.92 (+.00)
HellaSwag	.84	.78 (-.06)	.83 (-.01)
GSM8K	.85	.81 (-.04)	.67 (-.18)
Avg.	.878	.798 (-.080)	.818 (-.060)

Appendix

Table 11: GPT-4o robustness under lexical perturbations (

n=100

r=0.1

). Drop relative to clean in parentheses. Shading:

\geq

0.15 , 0.05–0.15 .

GPT-5.4 (Standard)
Task	Cln	Keyboard	Typoswap
BoolQ	.88	.77 (-.11)	.87 (-.01)
PIQA	.95	.79 (-.16)	.88 (-.07)
HellaSwag	.83	.77 (-.06)	.86 (+.03)
GSM8K	.97	.93 (-.04)	.82 (-.15)
Avg.	.908	.815 (-.093)	.858 (-.050)

Appendix

Table 12: GPT-5.4 robustness under lexical perturbations (

n=100

r=0.1

). Drop relative to each mode’s own clean accuracy in parentheses. Thinking mode amplifies fragility, with the largest average keyboard drop (

-

0.147) among all frontier configurations. Shading:

\geq

0.15 , 0.05–0.15 .

Figure 4: Cross-model comparison under lexical corruption at

r=0.1

. GPT-5.4 Standard achieves the highest clean accuracy. GPT-5.4 Thinking shows the largest degradation among frontier models (

-

0.147 under keyboard noise), confirming that reasoning amplifies rather than mitigates lexical fragility. Numbers indicate the absolute drop under keyboard noise relative to clean prompts.

Figure 5: Task-level accuracy drop under keyboard noise at

r=0.1

for frontier models. GPT-5.4 Thinking exhibits the largest degradation on HellaSwag (

-

0.23) and BoolQ (

-

0.19), while GPT-5.4 Standard is most robust on GSM8K (

-

0.04). Error patterns differ across reasoning modes despite near-identical clean performance.

		$r=0.05$				$r=0.20$				$r=0.30$
Model	Task	Cln	KB	TS	Fil	Cln	KB	TS	Fil	Cln	KB	TS	Fil
Gemma-2-9B-IT	BoolQ	.875	.830	.857	.875	.875	.737	.787	.878	.875	.631	.686	.874
	PIQA	.843	.736	.725	.833	.843	.584	.566	.827	.843	.504	.495	.828
	HellaSwag	.693	.520	.528	.686	.693	.386	.383	.687	.693	.323	.320	.685
	GSM8K	.804	.775	.692	.807	.804	.575	.349	.797	.804	.351	.179	.809
Llama-3.1-8B	BoolQ	.834	.776	.809	.839	.834	.622	.672	.834	.834	.518	.622	.832

Appendix

Table 13: Accuracy at severity

r\in\{0.05,0.20,0.30\}

(

n=1{,}000

). Shading marks degradation relative to clean:

\geq

0.30 , 0.15–0.30 , 0.05–0.15 . Three levels are used here because the range is wider than in the main text. No Fil cell reaches the 0.05 threshold at any severity.

Figure 6: Layer-wise diversion ratio by task for Llama-3.1-8B. The bimodal pattern with peaks at middle layers (11–15) and final layers (30–32) is consistent across all four reasoning benchmarks. BoolQ and HellaSwag show the strongest diversion, while GSM8K exhibits lower absolute values but the same structural pattern.

Figure 7: Complete failure pathway under lexical corruption. Top: clean input proceeds through stable tokenization, focused attention, and correct reasoning. Bottom: lexical corruption fragments tokens into novel subword pieces, the fragments absorb a disproportionate share of attention, and reasoning fails.

Figure 8: Tokenization disruption under lexical perturbations. (a) Character-level perturbations increase token count with severity, while filler remains near the clean baseline. (b) Keyboard noise and typoswap reduce token overlap with clean prompts, indicating token identity disruption.

Figure 9: Error-conditioned evidence for lexical fragility. Failed cases (C

\rightarrow

W) exhibit higher diversion ratios and lower token overlap than cases that remain correct (C

\rightarrow

C).

Figure 10: Attention redistribution toward corrupted tokens. Diversion ratio under increasing corruption severity across four models, computed over all attention layers. Character-level perturbations consistently increase corrupted-token attention, with typoswap producing stronger diversion than keyboard noise. Filler insertion stays below 0.025 throughout. Table 14 gives the same quantities numerically.

		Keyboard ( $r$ =)			Typoswap ( $r$ =)
Model	Tokenizer (Vocab)	0.05	0.10	0.20	0.05	0.10	0.20
Llama-3.1-8B	tiktoken BPE (128K)	0.046	0.077	0.118	0.061	0.101	0.148
Mistral-7B-v0.3	SentencePiece (33K)	0.058	0.096	0.146	0.075	0.122	0.181
Gemma-2-9B-IT	SentencePiece (256K)	0.090	0.146	0.215	0.118	0.186	0.263
Qwen3.5-9B †	tiktoken BPE (152K)	0.146	0.241	0.367	0.190	0.307	0.451

Appendix

Table 14: Cross-tokenizer diversion ratio at three severities. The ranking Qwen

>

Gemma

>

Mistral

>

Llama is consistent across both perturbation types and all severities, supporting an architecture/tokenizer-level effect rather than sampling artifact. Shading marks magnitude only (

\geq

0.20 , 0.10–0.20 ) and is deliberately distinct from the degradation shading used elsewhere: Section 5.4 shows that diversion magnitude does not track accuracy loss.

Predictor	$\beta$	OR	$p$
fragmentation	$+0.66$	1.93	$<10^{-81}$
overlap	$-0.54$	0.58	$<10^{-58}$
n_delta	$+0.25$	1.29	$<10^{-14}$
diversion	$+0.23$	1.26	$<10^{-12}$

Appendix

Table 15: Univariate logistic regression. Each predictor’s standalone effect on

P(\textsf{failure})

\beta

is the log-odds coefficient per 1 SD of the predictor, and OR is the corresponding odds ratio. All effects are highly significant.

Predictor	$\beta$	OR	$p$
fragmentation	$+1.04$	2.84	$<10^{-88}$
n_delta	$-0.50$	0.61	$<10^{-23}$

Appendix

Table 16: Joint logistic regression : fragmentation and token-count change as simultaneous predictors of failure. Fragmentation strengthens when length is controlled, demonstrating that the two signals are not interchangeable.

Condition	Accuracy
Clean baseline	0.80
Corrupted baseline	0.42
Embedding replacement	0.52
Absolute recovery	$+$ 0.10
Fraction of gap recovered	26%
Mean embeddings replaced	2.95

Appendix

Table 17: Embedding-replacement intervention on GSM8K (Llama-3.1-8B, keyboard

r=0.1

n=100

Figure 11: Intervention via attention suppression. Suppressing corrupted-token attention degrades accuracy, indicating that it is load-bearing rather than passive noise (Llama-3.1-8B,

n{=}200

$r$	Filler	Keyboard
0.05	0.006	0.013
0.10	0.015	0.039
0.20	0.029	0.097
0.30	0.048	0.147

Appendix

Table 18: Mean fragmentation across four open-weight tokenizers , BoolQ+GSM8K averaged (

n=100

each task). Keyboard fragmentation exceeds filler by 2–3

\times

at matched word-level perturbation rates.

Perturbation	$r{=}0.05$	$r{=}0.10$	$r{=}0.20$
keyboard	0.049	0.100	0.198
typoswap	0.024	0.047	0.080
filler	0.010	0.026	0.050

Appendix

Table 19: Chinese CMath fragmentation rates (Llama-3.1 tokenizer,

n=200

Figure 12: Qualitative attention analysis on a GSM8K failure case (Llama-3.1-8B, keyboard perturbation,

r{=}0.1

, layers 12–15). (a) Under clean input, attention concentrates on semantically relevant tokens such as names, ages, and instruction keywords, yielding the correct answer 14. (b) After perturbation, 67% of the attention mass shifts to corrupted subword fragments (red bars), while task-critical tokens are starved of processing bandwidth. The model outputs 4 instead of 14. Token count increases from 48 to 63 due to tokenization fragmentation.

Condition	Baseline	Calibration	Restoration
BoolQ + KB	64.0	61.0	53.0
BoolQ + TS	83.0	82.0	65.0
HellaSwag + KB	22.0	18.0	19.0

Appendix

Table 20: Diagnostic probes on Llama-3.1-8B (

n{=}100

r{=}0.1

; shuffle-42 subset with its own corruption implementation, so baselines differ from Section 6 ).

Language Model Robustness

Language model robustness studies how reliably language models preserve correct, safe behavior under input changes, distribution shifts, and adversarial pressure.

See all 493 papers

Fragile Reasoning: A Mechanistic Analysis of LLM Sensitivity to Meaning-Preserving Perturbations
Apr 2, 2026Shou-Tzu Han, Rodrigue Rizk, KC SantoshLanguage Model Robustness LLM Reasoning
Department of Computer Science, University of South Dakota
Attention-Aligned Reasoning for Large Language Models
Oct 3, 2025Hongxiang Zhang, Yuan Tian, Tianyi ZhangLLM Reasoning Structured Reasoning in Language Models
Purdue University
Answer-Conditioned Chains of Thought Degrade Verifiable-Reasoning Distillation in Large Language Models
Jul 16, 2026Jungseob Lee, Seungyoon Lee, Suhyune Son +4CoT Distillation Language Model Distillation
1Korea University · 2Zoom Communications · 3Yonsei University

Apr 2, 2026J/K move · Enter open · S save

Fragile Reasoning: A Mechanistic Analysis of LLM Sensitivity to Meaning-Preserving Perturbations

Shou-Tzu Han, Rodrigue Rizk, KC Santosh

Department of Computer Science, University of South Dakota

Language Model Robustness LLM Reasoning Adversarial Robustness of Language Models LLM Interpretability Causal Interventions in Language Models

Open paper AskPDF arXiv

Large language models demonstrate strong performance on mathematical reasoning benchmarks, yet remain surprisingly fragile to meaning-preserving surface perturbations. We systematically evaluate three open-weight LLMs, Mistral-7B, Llama-3-8B, and Qwen2.5-7B, on 677 GSM8K problems paired with semantically equivalent variants generated through name substitution and number format paraphrasing. All three models exhibit substantial answer-flip rates (28.8%-45.1%), with number paraphrasing consistently more disruptive than name swaps. To trace the mechanistic basis of these failures, we introduce the Mechanistic Perturbation Diagnostics (MPD) framework, combining logit lens analysis, activation patching, component ablation, and the Cascading Amplification Index (CAI) into a unified diagnostic pipeline. CAI, a novel metric quantifying layer-wise divergence amplification, outperforms first divergence layer as a failure predictor for two of three architectures (AUC up to 0.679). Logit lens reveals that flipped samples diverge from correct predictions at significantly earlier layers than stable samples. Activation patching reveals a stark architectural divide in failure localizability: Llama-3 failures are recoverable by patching at specific layers (43/60 samples), while Mistral and Qwen failures are broadly distributed (3/60 and 0/60). Based on these diagnostic signals, we propose a mechanistic failure taxonomy (localized, distributed, and entangled) and validate it through targeted repair experiments: steering vectors and layer fine-tuning recover 12.2% of localized failures (Llama-3) but only 7.2% of entangled (Qwen) and 5.2% of distributed (Mistral) failures.

Abstract

Language Model Robustness

Explore similar work

Fragile Reasoning: A Mechanistic Analysis of LLM Sensitivity to Meaning-Preserving Perturbations

Attention-Aligned Reasoning for Large Language Models

Answer-Conditioned Chains of Thought Degrade Verifiable-Reasoning Distillation in Large Language Models