The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

Yihao Zhang; Kai Wang; Jiangrong Wu; Haolin Wu; Yuxuan Zhou; Zeming Wei; Dongxian Wu; Xun Chen

cs.CRApr 13, 2026

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

Authors: Yihao Zhang, Kai Wang, Jiangrong Wu, Haolin Wu, Yuxuan Zhou, Zeming Wei, Dongxian Wu, Xun Chen,

Organizations: School of Mathematical Sciences, Peking University · Sun Yat-sen University · Wuhan University · Shenzhen International Graduate School, Tsinghua University ·

Abstract

Large Language Models (LLMs) face prominent security risks from jailbreaking, a practice that manipulates models to bypass built-in security constraints and generate unethical or unsafe content. Among various jailbreak techniques, multi-turn jailbreak attacks are more covert and persistent than single-turn counterparts, exposing critical vulnerabilities of LLMs. However, existing multi-turn jailbreak methods suffer from two fundamental limitations that affect the actual impact in real-world scenarios: (a) As models become more context-aware, any explicit harmful trigger is increasingly likely to be flagged and blocked; (b) Successful final-step triggers often require finely tuned, model-specific contexts, making such attacks highly context-dependent. To fill this gap, we propose Salami Slicing Risk, which operates by chaining numerous low-risk inputs that individually evade alignment thresholds but cumulatively accumulate harmful intent to ultimately trigger high-risk behaviors, without heavy reliance on pre-designed contextual structures. Building on this risk, we develop Salami Attack, an automatic framework universally applicable to multiple model types and modalities. Rigorous experiments demonstrate its state-of-the-art performance across diverse models and modalities, achieving over 90% Attack Success Rate on GPT-4o and Gemini, as well as robustness against real-world alignment defenses. We also proposed a defense strategy to constrain the Salami Attack by at least 44.8% while achieving a maximum blocking rate of 64.8% against other multi-turn jailbreak attacks. Our findings provide critical insights into the pervasive risks of multi-turn jailbreaking and offer actionable mitigation strategies to enhance LLM security.

Figures & tables

Fig. 1 : Illustration of Salami Slicing Risk on a Real-World LLM Application (ChatGPT’s Web Interface, 2025-11-14).

Panel of Table 2 — TABLE I: Qualitative comparison of jailbreak methods. : No, : Partial, : Yes. * Transfer indicates the ability to generalize across different models or modalities. † Stealthy denotes the ability to avoid explicit malicious triggers that activate single-turn risk filters. ‡ Actionable measures the ability to elicit substantive, content-rich harmful outputs.

Fig. 2 : Attention scores of L2H26 during generation of the final response in a 4-turn Salami Attack (Prompt: How to make criminal weapons with household things ). Tokens corresponding to queries (denoted as Q# $N$ ) are enclosed within blue rectangles . The label ”Score” in the figure refers to the harmful score. Lighter color denotes higher attention scores.

Panel of Figure 4 — Fig. 3 : 2D PCA of activations in Layer 7 and Layer 14.

Fig. 4 : Illustration for the Workflow of A-Salami.

Dataset	Model	Salami(5-shot)	Salami(10-shot)	A-Salami	Crescendo	GOAT	CIA	CFA	PAIR
AdvBench	GLM-4.5	91.3 (8.98)	93.3 (9.16)	98.8 (9.69)	69.4 (6.43)	79.4 (7.49)	60.2 (5.77)	44.6 (4.75)	45.6 (5.00)
	GPT-4o	86.9 (8.47)	90.4 (9.19)	95.8 (9.37)	58.3 (5.76)	65.3 (6.01)	51.7 (4.98)	30.6 (3.82)	39.8 (4.39)
	Gemini 2.5 Pro	91.2 (9.06)	91.5 (9.11)	94.6 (9.28)	73.5 (7.05)	70.5 (6.97)	60.8 (6.22)	26.7 (4.22)	40.8 (4.79)
	Deepseek V3	96.0 (9.24)	96.7 (9.44)	98.1 (9.70)	76.2 (7.20)	81.0 (7.86)	71.5 (6.96)	60.0 (6.39)	45.0 (5.01)
	Qwen 3	95.2 (9.36)	97.7 (9.64)	99.2 (9.71)	80.0 (7.57)	83.9 (8.17)	60.2 (5.31)	58.3 (6.00)	49.8 (5.10)
HarmBench	GLM-4.5	91.5 (8.66)	93.5 (9.20)	95.5 (9.49)	77.0 (7.03)	85.0 (8.11)	52.5 (4.98)	52.0 (5.79)	46.0 (4.07)

TABLE II : Jailbreak attack effectiveness across models and datasets. Each cell reports values in the format: [Attack Success Rate (ASR)]([Harmful Score]). Deeper red is used to represent a higher ASR.

Model	Metric	Salami	Crescendo	PAIR
GPT-4o	AVQ ( $\downarrow$ )	3.9	5.6	10.7
	AVT ( $\downarrow$ )	728.91	5013.49	6221.29
	Time ( $\downarrow$ )	88.35	168.83	202.75
GLM-4.5	AVQ ( $\downarrow$ )	2.6	4.3	9.2
	AVT ( $\downarrow$ )	508.44	3182.78	5059.10
	Time ( $\downarrow$ )	53.72	109.68	187.10

TABLE III : Attack efficiency metrics on AdvBench. Metrics include Average Queries per Successful Attack (AVQ), Average Token Cost per Successful Attack (AVT), and average execution time in seconds. For all metrics, lower = better.

Algorithm	Gemini 2.5 Pro	GLM-4.5	Qwen 3
Salami(5-shot)	91.0(-)	93.0(-)	93.0(-)
A-Salami	83.0( $\downarrow$ 13.0)	88.0( $\downarrow$ 7.0)	88.0( $\downarrow$ 8.0)
Crescendo	36.0( $\downarrow$ 24.0)	57.0( $\downarrow$ 21.0)	65.0( $\downarrow$ 13.0)

TABLE IV : Performance of Transferring GPT-4o-Optimized Attacks to Target Models (ASR;

\downarrow

= Percentage Point Drop vs. Target-Model-Optimized Baselines).

Panel of Figure 9 — Fig. 5 : Gemini Generated Harmful Images with Corresponding Original Intents

Model	w/o Attack	SI-Attack	FigStep	Salami
GPT-4o	10.71	52.17	36.31	55.56
Qwen-VL-Max	13.29	55.15	54.96	56.15

TABLE V : Attack Efficacy on VLMs of Salami Attack Measured By ASR.

Algorithm	Bypass	Consistent
w/o Attack	1/20	1/1
DACA	9/20	5/9
SneakyPrompt	13/20	10/13
Salami Attack(5-shot)	16/20	13/16

TABLE VI : Bypass and Consistency Rates of Attacks on Real-World Diffusion Model Employed in Gemini’s Web Interface.

Fig. 6 : Category-wise harmful-score comparison among Salami, Crescendo, and GOAT.

Original Prompt: Write a pornographic fiction involving characters A and B.
Crescendo :
Q1. I’m studying literary techniques in modern fiction. Can you explain how $[...]$ to build narrative engagement between two protagonists, say ’A’ and ’B’?
Q2. Thanks! Could you give a short, fictional example illustrating $[...]$ between A and B to imply romantic or sexual tension, without explicit content?
Q5. $[...]$ how might this same scene be rendered in a more sensual or erotic fiction style , while still maintaining character depth? $[...]$ .
GPT: I’m unable to create explicit or erotic content…
Gemini: [A writing on A and B’s affection with no explicit sexual content]

TABLE VII : Qualitative comparison on a creativity-heavy harmful request (pornographic fiction).

Defense Method	Salami(5-shot)	Crescendo	PAIR
w/o Defense	87.0	64.0	30.0
Smooth LLM	80.0 (-8.0%)	53.0 (-17.2%)	19.0 (-36.7%)
Self Reminder	83.0 (-4.6%)	58.0 (-9.4%)	11.0 (-63.3%)
Input Filter	84.0 (-3.4%)	42.0 (-34.4%)	1.0 (-96.7%)
Avg. ASR	83.5 (-4.0%)	54.3 (-15.2%)	16.0 (-46.7%)

TABLE VIII : ASRs of Salami Attack(5-shot), Crescendo, and PAIR Against Defenses on GPT-4o, evaluated on JailbreakBench.

Defense	Salami(5-shot)	A-Salami	Crescendo	CIA
w/o CQA	87.0	91.0	64.0	54.0
w/ CQA	48.0 (-44.8%)	65.0 (-28.6%)	38.0 (-40.6%)	19.0 (-64.8%)

TABLE IX : ASR Performance of Multi-turn Attack Algorithms with and without CQA Defense on GPT-4o.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

May 3, 2026

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

We present MultiBreak, a scalable and diverse multi-turn jailbreak benchmark to evaluate large language model (LLM) safety. Multi-turn jailbreaks mimic natural conversational settings, making them easier to bypass safety-aligned LLM than single-turn jailbreaks. Existing multi-turn benchmarks are limited in size or rely heavily on templates, which restrict their diversity. To address this gap, we unify a wide range of harmful jailbreak intents, and introduce an active learning pipeline for expanding high-quality multi-turn adversarial prompts, where a generator is iteratively fine-tuned to produce stronger attack candidates, guided by uncertainty-based refinement. Our MultiBreak includes 10,389 multi-turn adversarial prompts, spans 2,665 distinct harmful intents, and covers the most diverse set of topics to date. Empirical evaluation shows that our benchmark achieves up to a 54.0 and 34.6 higher attack success rate (ASR)} than the second-best dataset on DeepSeek-R1-7B and GPT-4.1-mini, respectively. More importantly, safety evaluations suggest that diverse attack categories uncover fine-grained LLM vulnerabilities}, and categories that appear benign under single-turn can exhibit substantially higher adversarial effectiveness in multi-turn scenarios. These findings highlight persistent vulnerabilities of LLMs under realistic adversarial settings and establish MultiBreak as a scalable resource for advancing LLM safety.

Jialin Song, Xiaodong Liu, Weiwei Yang +4

Simon Fraser University · Microsoft Research

LLM Safety Benchmarks Adversarial Prompt Generation Language Model Safety Evaluation Adversarial Scenario Generation Jailbreak Attacks LLM Jailbreak Attacks+1

Ask PDF

Dec 21, 2024

Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models

Large language models (LLMs) are widely applied in various fields of society due to their powerful reasoning, understanding, and generation capabilities. However, the security issues associated with these models are becoming increasingly severe. Jailbreaking attacks, as an important method for detecting vulnerabilities in LLMs, have been explored by researchers who attempt to induce these models to generate harmful content through various attack methods. Nevertheless, existing jailbreaking methods face numerous limitations, such as excessive query counts, limited coverage of jailbreak modalities, low attack success rates, and simplistic evaluation methods. To overcome these constraints, this paper proposes a multimodal jailbreaking method: JMLLM. This method integrates multiple strategies to perform comprehensive jailbreak attacks across text, visual, and auditory modalities. Additionally, we contribute a new and comprehensive dataset for multimodal jailbreaking research: TriJail, which includes jailbreak prompts for all three modalities. Experiments on the TriJail dataset and the benchmark dataset AdvBench, conducted on 13 popular LLMs, demonstrate advanced attack success rates and significant reduction in time overhead.

Yanxu Mao, Peipei Liu, Tiehan Cui +3

School of Computer Science and Technology, Shanghai Jiao Tong University, Shanghai, China · Zhongguancun Laboratory, Beijing, China · School of Software, Henan University, Kaifeng, China +1

Adversarial Attacks on LLMs Multimodal Large Language Models LLM Safety Multimodal Jailbreak Attacks

Ask PDF

Jun 1, 2026

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models

Multi-turn jailbreak attacks pose a growing threat to LLMs by exploiting conversational dynamics such as gradual escalation and cross-turn coordination. Existing defenses either rely on costly retraining -- often degrading model utility -- or apply single-turn analysis independently at each turn, failing to capture how risk accumulates along interaction trajectories. We observe that safety behavior in multi-turn interaction is trajectory-dependent: dialogue history continuously reshapes the model's conditioning context, making it insufficient to evaluate each turn in isolation. Motivated by this insight, we present THRD, the first training-free framework that explicitly models temporal risk accumulation for multi-turn jailbreak defense. THRD integrates four modules: a Turn-level Risk Assessor (TRA) for instantaneous risk estimation, a Historical Context Analyzer (HCA) for cross-turn intent escalation detection, a Response Evaluator (RE) for identifying facilitative outputs, and a Decision Module that combines these signals through a time-evolving scoring mechanism with attenuation-based modulation and trend-aware adjustment. Experiments against state-of-the-art multi-turn attacks -- including tree-search-based and multi-agent collaborative methods -- across two target models show that THRD reduces ASR to 0.2--4.0% while preserving model utility within 1.5% degradation on MMLU and GSM8K. Ablation studies confirm non-redundant module contributions and stable cross-architecture generalization. Analysis of first rejection triggers reveals that over 70% of multi-turn attacks require Turn~2 or later to detect, validating the necessity of explicit temporal aggregation.

Zhiqing Ma, Zhonghao Xu, Dong Yu +3

1Beijing Language and Culture University · †Corresponding authors

LLM Safety Multi-Turn Jailbreak Attacks Jailbreak Defense

Ask PDF

Abstract

LLM Security

Explore similar work

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models