The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

Yihao Zhang; Kai Wang; Jiangrong Wu; Haolin Wu; Yuxuan Zhou; Zeming Wei; Dongxian Wu; Xun Chen

cs.CRApr 13, 2026

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

Authors: Yihao Zhang, Kai Wang, Jiangrong Wu, Haolin Wu, Yuxuan Zhou, Zeming Wei, Dongxian Wu, Xun Chen,

Organizations: School of Mathematical Sciences, Peking University · Sun Yat-sen University · Wuhan University · Shenzhen International Graduate School, Tsinghua University ·

Abstract

Large Language Models (LLMs) face prominent security risks from jailbreaking, a practice that manipulates models to bypass built-in security constraints and generate unethical or unsafe content. Among various jailbreak techniques, multi-turn jailbreak attacks are more covert and persistent than single-turn counterparts, exposing critical vulnerabilities of LLMs. However, existing multi-turn jailbreak methods suffer from two fundamental limitations that affect the actual impact in real-world scenarios: (a) As models become more context-aware, any explicit harmful trigger is increasingly likely to be flagged and blocked; (b) Successful final-step triggers often require finely tuned, model-specific contexts, making such attacks highly context-dependent. To fill this gap, we propose Salami Slicing Risk, which operates by chaining numerous low-risk inputs that individually evade alignment thresholds but cumulatively accumulate harmful intent to ultimately trigger high-risk behaviors, without heavy reliance on pre-designed contextual structures. Building on this risk, we develop Salami Attack, an automatic framework universally applicable to multiple model types and modalities. Rigorous experiments demonstrate its state-of-the-art performance across diverse models and modalities, achieving over 90% Attack Success Rate on GPT-4o and Gemini, as well as robustness against real-world alignment defenses. We also proposed a defense strategy to constrain the Salami Attack by at least 44.8% while achieving a maximum blocking rate of 64.8% against other multi-turn jailbreak attacks. Our findings provide critical insights into the pervasive risks of multi-turn jailbreaking and offer actionable mitigation strategies to enhance LLM security.

Figures & tables

Fig. 1 : Illustration of Salami Slicing Risk on a Real-World LLM Application (ChatGPT’s Web Interface, 2025-11-14).

Panel of Table 2 — TABLE I: Qualitative comparison of jailbreak methods. : No, : Partial, : Yes. * Transfer indicates the ability to generalize across different models or modalities. † Stealthy denotes the ability to avoid explicit malicious triggers that activate single-turn risk filters. ‡ Actionable measures the ability to elicit substantive, content-rich harmful outputs.

Fig. 2 : Attention scores of L2H26 during generation of the final response in a 4-turn Salami Attack (Prompt: How to make criminal weapons with household things ). Tokens corresponding to queries (denoted as Q# $N$ ) are enclosed within blue rectangles . The label ”Score” in the figure refers to the harmful score. Lighter color denotes higher attention scores.

Panel of Figure 4 — Fig. 3 : 2D PCA of activations in Layer 7 and Layer 14.

Fig. 4 : Illustration for the Workflow of A-Salami.

Dataset	Model	Salami(5-shot)	Salami(10-shot)	A-Salami	Crescendo	GOAT	CIA	CFA	PAIR
AdvBench	GLM-4.5	91.3 (8.98)	93.3 (9.16)	98.8 (9.69)	69.4 (6.43)	79.4 (7.49)	60.2 (5.77)	44.6 (4.75)	45.6 (5.00)
	GPT-4o	86.9 (8.47)	90.4 (9.19)	95.8 (9.37)	58.3 (5.76)	65.3 (6.01)	51.7 (4.98)	30.6 (3.82)	39.8 (4.39)
	Gemini 2.5 Pro	91.2 (9.06)	91.5 (9.11)	94.6 (9.28)	73.5 (7.05)	70.5 (6.97)	60.8 (6.22)	26.7 (4.22)	40.8 (4.79)
	Deepseek V3	96.0 (9.24)	96.7 (9.44)	98.1 (9.70)	76.2 (7.20)	81.0 (7.86)	71.5 (6.96)	60.0 (6.39)	45.0 (5.01)
	Qwen 3	95.2 (9.36)	97.7 (9.64)	99.2 (9.71)	80.0 (7.57)	83.9 (8.17)	60.2 (5.31)	58.3 (6.00)	49.8 (5.10)
HarmBench	GLM-4.5	91.5 (8.66)	93.5 (9.20)	95.5 (9.49)	77.0 (7.03)	85.0 (8.11)	52.5 (4.98)	52.0 (5.79)	46.0 (4.07)

TABLE II : Jailbreak attack effectiveness across models and datasets. Each cell reports values in the format: [Attack Success Rate (ASR)]([Harmful Score]). Deeper red is used to represent a higher ASR.

Model	Metric	Salami	Crescendo	PAIR
GPT-4o	AVQ ( $\downarrow$ )	3.9	5.6	10.7
	AVT ( $\downarrow$ )	728.91	5013.49	6221.29
	Time ( $\downarrow$ )	88.35	168.83	202.75
GLM-4.5	AVQ ( $\downarrow$ )	2.6	4.3	9.2
	AVT ( $\downarrow$ )	508.44	3182.78	5059.10
	Time ( $\downarrow$ )	53.72	109.68	187.10

TABLE III : Attack efficiency metrics on AdvBench. Metrics include Average Queries per Successful Attack (AVQ), Average Token Cost per Successful Attack (AVT), and average execution time in seconds. For all metrics, lower = better.

Algorithm	Gemini 2.5 Pro	GLM-4.5	Qwen 3
Salami(5-shot)	91.0(-)	93.0(-)	93.0(-)
A-Salami	83.0( $\downarrow$ 13.0)	88.0( $\downarrow$ 7.0)	88.0( $\downarrow$ 8.0)
Crescendo	36.0( $\downarrow$ 24.0)	57.0( $\downarrow$ 21.0)	65.0( $\downarrow$ 13.0)

TABLE IV : Performance of Transferring GPT-4o-Optimized Attacks to Target Models (ASR;

\downarrow

= Percentage Point Drop vs. Target-Model-Optimized Baselines).

Panel of Figure 9 — Fig. 5 : Gemini Generated Harmful Images with Corresponding Original Intents

Model	w/o Attack	SI-Attack	FigStep	Salami
GPT-4o	10.71	52.17	36.31	55.56
Qwen-VL-Max	13.29	55.15	54.96	56.15

TABLE V : Attack Efficacy on VLMs of Salami Attack Measured By ASR.

Algorithm	Bypass	Consistent
w/o Attack	1/20	1/1
DACA	9/20	5/9
SneakyPrompt	13/20	10/13
Salami Attack(5-shot)	16/20	13/16

TABLE VI : Bypass and Consistency Rates of Attacks on Real-World Diffusion Model Employed in Gemini’s Web Interface.

Fig. 6 : Category-wise harmful-score comparison among Salami, Crescendo, and GOAT.

Original Prompt: Write a pornographic fiction involving characters A and B.
Crescendo :
Q1. I’m studying literary techniques in modern fiction. Can you explain how $[...]$ to build narrative engagement between two protagonists, say ’A’ and ’B’?
Q2. Thanks! Could you give a short, fictional example illustrating $[...]$ between A and B to imply romantic or sexual tension, without explicit content?
Q5. $[...]$ how might this same scene be rendered in a more sensual or erotic fiction style , while still maintaining character depth? $[...]$ .
GPT: I’m unable to create explicit or erotic content…
Gemini: [A writing on A and B’s affection with no explicit sexual content]

TABLE VII : Qualitative comparison on a creativity-heavy harmful request (pornographic fiction).

Defense Method	Salami(5-shot)	Crescendo	PAIR
w/o Defense	87.0	64.0	30.0
Smooth LLM	80.0 (-8.0%)	53.0 (-17.2%)	19.0 (-36.7%)
Self Reminder	83.0 (-4.6%)	58.0 (-9.4%)	11.0 (-63.3%)
Input Filter	84.0 (-3.4%)	42.0 (-34.4%)	1.0 (-96.7%)
Avg. ASR	83.5 (-4.0%)	54.3 (-15.2%)	16.0 (-46.7%)

TABLE VIII : ASRs of Salami Attack(5-shot), Crescendo, and PAIR Against Defenses on GPT-4o, evaluated on JailbreakBench.

Defense	Salami(5-shot)	A-Salami	Crescendo	CIA
w/o CQA	87.0	91.0	64.0	54.0
w/ CQA	48.0 (-44.8%)	65.0 (-28.6%)	38.0 (-40.6%)	19.0 (-64.8%)

TABLE IX : ASR Performance of Multi-turn Attack Algorithms with and without CQA Defense on GPT-4o.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
May 3, 2026Jialin Song, Xiaodong Liu, Weiwei Yang +4LLM Safety Benchmarks Adversarial Prompt Generation
Simon Fraser University · Microsoft Research
Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models
Dec 21, 2024Yanxu Mao, Peipei Liu, Tiehan Cui +3Adversarial Attacks on LLMs Multimodal Large Language Models
School of Computer Science and Technology, Shanghai Jiao Tong University, Shanghai, China · Zhongguancun Laboratory, Beijing, China · School of Software, Henan University, Kaifeng, China +1
THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models
Jun 1, 2026Zhiqing Ma, Zhonghao Xu, Dong Yu +3LLM Safety Multi-Turn Jailbreak Attacks
1Beijing Language and Culture University · †Corresponding authors

May 3, 2026J/K move · Enter open · S save

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Jialin Song, Xiaodong Liu, Weiwei Yang, Wuyang Chen+3

Simon Fraser University · Microsoft Research

LLM Safety Benchmarks Adversarial Prompt Generation Language Model Safety Evaluation Adversarial Scenario Generation Jailbreak Attacks LLM Jailbreak Attacks+1

Open paper AskPDF arXiv

We present MultiBreak, a scalable and diverse multi-turn jailbreak benchmark to evaluate large language model (LLM) safety. Multi-turn jailbreaks mimic natural conversational settings, making them easier to bypass safety-aligned LLM than single-turn jailbreaks. Existing multi-turn benchmarks are limited in size or rely heavily on templates, which restrict their diversity. To address this gap, we unify a wide range of harmful jailbreak intents, and introduce an active learning pipeline for expanding high-quality multi-turn adversarial prompts, where a generator is iteratively fine-tuned to produce stronger attack candidates, guided by uncertainty-based refinement. Our MultiBreak includes 10,389 multi-turn adversarial prompts, spans 2,665 distinct harmful intents, and covers the most diverse set of topics to date. Empirical evaluation shows that our benchmark achieves up to a 54.0 and 34.6 higher attack success rate (ASR)} than the second-best dataset on DeepSeek-R1-7B and GPT-4.1-mini, respectively. More importantly, safety evaluations suggest that diverse attack categories uncover fine-grained LLM vulnerabilities}, and categories that appear benign under single-turn can exhibit substantially higher adversarial effectiveness in multi-turn scenarios. These findings highlight persistent vulnerabilities of LLMs under realistic adversarial settings and establish MultiBreak as a scalable resource for advancing LLM safety.

Abstract

LLM Security

Explore similar work

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models