Furina: Fragmented Uncertainty-Driven Refusal Instability Attack

Safety alignment in large language models (LLMs) and multimodal large language models (MLLMs) is commonly assumed to operate as a near-binary threshold mechanism. We challenge this assumption by revealing that safety behavior is governed by an \emph{instability region} where small perturbations induce stochastic refusal decisions rather than deterministic outcomes. We develop a multi-metric diagnostic framework combining external and internal signals to characterize this instability. Through systematic experiments, we identify a characteristic \emph{diagnostic signature}: inputs in unstable regimes exhibit elevated output uncertainty yet \emph{decreased} internal safety activation, a decoupling phenomenon that explains why detection-based defenses fail against sophisticated attacks. Building on this framework, we introduce \textbf{Furina}, a jailbreak attack that deliberately induces this signature through fragmented, scene-anchored prompts without model-specific optimization. Furina outperforms strong single-turn and multi-turn baselines on HarmBench and achieves competitive results on MM-SafetyBench, demonstrating that uncertainty amplification provides a principled and transferable mechanism for understanding safety vulnerabilities. Code is available at: \url{https://github.com/0xCavaliers/Furina_Jailbreak}.

Large language models are often assumed to make stable safety decisions, either refusing harmful requests or complying with benign ones. We show that this boundary is not always stable: small changes in phrasing or context can lead to very different outcomes. We develop a framework to measure this instability and introduce Furina, a jailbreak method based on semantic fragmentation and scene anchoring. Our findings show that harmful intent can be spread across individually benign fragments and later recombined, exposing limitations of current defenses. This work helps explain why some jailbreaks succeed and points to the need for stronger, more context-aware safety mechanisms.