Multi-stream perturbation attack: disrupting safety alignment of reasoning LLMs through concurrent task interference

Researcher Yang proposes a multi-stream perturbation attack against reasoning LLMs that interleaves multiple task streams, character reversal, and format constraints within a single prompt, causing the model's reasoning process to collapse or degrade into repetitive loops, thereby bypassing safety alignment. The attack combines three strategies—multi-stream interleaving, reversal perturbation, and shape transformation—and outperforms any single strategy. Among attacked responses, up to 17% show complete reasoning collapse and 60% show response repetition. The attack achieves high success rates on mainstream reasoning models including the Qwen3 series, DeepSeek, Qwen3-Max, and Gemini 2.5 Flash. The paper argues this is a systemic weakness of the reasoning-mode architecture rather than a flaw of any single model.