Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.
Figures & tables
Figure 1: Request bodies, linkable groups, order, and visible decisions are identical in the two worlds; only off-service pooling differs, so a policy without that relation acts the same way while the outcomes differ.
Figure 2: Conditional frontiers under exact operation labels. (a) One-attempt worst-task frontier against independent causal replay, diamonds marking the aggregate knapsack objective. (b) Median and 5th to 95th percentiles over 100 legal partitions per predeclared K at 1% denial, placed by occupied control groups. (c) The same 800 partitions paired across retry limits.
Score
Evidence / state
Capability
Canonical source
Same contrast,
vs. background
vs. control
template deleted
M1 Lexical
Word/character n-grams
0.9864
0.9999
0.4889 [0.424, 0.554]
M2 Granite [ 17 ]
Current-request harm score
0.7234
0.6586
0.4987 [0.435, 0.562]
M3-corrected TwinGate [ 21 ]
Intent encoder and retrieval
0.7824
0.4961
0.4961 [0.474, 0.516]
M4 Brown-style [ 3 ]
Embedding clusters and LLM judge
0.9694
0.9984
0.5018 [0.501, 0.503]
M5 Cumulative [ 28 ]
Retrieved prefix and cumulative judge
0.9817
0.9910
0.5334 [0.490, 0.580]
Table 1: What each score separates on main evaluation records: 81 canonical decomposition requests, 2,491 matched controls, and 720,000 background requests. The first AUROC column tests capability recognition; the next two compare the canonical source class with controls before and after deleting a shared control-template prefix. Brackets are 95% resampled intervals. Source comparisons use all 2,572 canonical and control records for M1–M3 and M8, and the 2,533 gate-passing records scored by the frozen LLM judges for M4–M7.
Main evaluation: 20 families/19 clusters
Outer: 11 defense-unseen families
Method
ASR [95%]
MCD
BBR
ASR [95%]
MCD
BBR
M0 No defense
100 [100,100]
0
0
100 [100,100]
0
0
M1 Lexical
94.61 [91.15,97.62]
1.320
0
100 [100,100]
0
0
M2 Granite
100 [100,100]
0
0.498
99.01 [97.30,100]
0.320
0.498
M3 TwinGate
100 [100,100]
0
0
100 [100,100]
0
0
M4 Brown-style
100 [100,100]
0
0
100 [100,100]
0
0
Table 2: Static R=1 abstract ASR. M0–M8 use calibration-selected thresholds; privileged references report zero-ASR points. Brackets are 95% resampled intervals, bold MCD exceeds the 1% cap, and rates are percentages.
Policy
MCD
ρ
95% interval
Main evaluation, 19 clusters
M1 Lexical
1.320
1.037
[0.836, 1.199]
M5 Cumulative
0.641
1.015
[0.863, 1.154]
M6 Direct LLM
1.377
1.086
[0.983, 1.204]
M8 Structured
1.419
1.120
[1.044, 1.200]
Outer cohort, 11 families
Table 3: Resampled 95% intervals for ρ=ATK/MCD . Bold MCD exceeds the 1% cap; zero-MCD policies have undefined ratios.
mC
Metric
1.000
2.136
3.765
7.037
13.617
26.753
Mean
M1 Lexical
MCD
1.235
1.156
0.656
0.351
0.544
0.831
–
R=1
10
10
10
10
10
5
8.75
R=2
100
100
100
100
100
95
98.75
R=5
100
100
100
100
100
100
100
Table 4: Positive control at six nested mC levels (36 cells each). ASR is percent; bold MCD exceeds the 1% cap, and means use admissible levels only.
Figure 3: Dynamic ASR on eleven defense-unseen families under fresh-group attacks. Filled points minimize ASR subject to both utility caps across all four legal matched-control groupings; hollow diamonds violate a cap. Greater matched-control density removes low-ASR operating points, and one retry makes every high-density admissible method reach 100% ASR.
Figure 4: Binary Allow / Block feedback is sufficient for practical profile learning. Each panel fixes attempts per operation and reports the share of 3,072 cells in which the selected profile is within one ASR percentage point of the best frozen profile; the horizontal axis is symmetric-logarithmic to include checkpoint zero.
Appendix figures & tables12 assets
Supplementary material from the paper’s appendix.
Appendix
Object
Defined by
Visible to defense
Used by evaluator
Operation capability
Request body and frozen task contract
Only through the chosen recognizer; exact in the ideal benchmark
Exact registered mapping and, separately, verifier result
Linkable group
Declared service-side linkage rule
Yes
Yes
Access coalition
Off-service response pooling
No
Yes, fixed before policy outcomes
Attack/control role
Balanced evaluator recoloring
No
Yes
Task success
One coalition obtains all necessary operations
No trusted online label
Abstract and realized ledgers
Exact capability recognizer
Exact request-to-operation map
Privileged semantic component
Removes natural language recognition error
Appendix
Table 5: Objects and information boundaries. “Exact” denotes information available to the privileged measurement benchmark.
Cohort or role
Tasks
Families
Operation requests
Matched controls
Use and status
Fresh task construction
491
443
2,149
N/A
Formal staged denominator; 262 strictly qualify
Strict capability bank
262
248
1,152 (848 with ≥ 10 certified)
25,977
Outcome-inspected construction pool
Main common support
91
82
365
11,393
All operations have at least ten controls; 2,190/2,190 task tests pass
Defense training
N/A
30
N/A
split by family
Fit learned defenses only
Attacker adaptation
N/A
20
N/A
split by family
Observe own Allow / Block only
Threshold calibration
N/A
12
N/A
split by family
Choose operating points only
Appendix
Table 6: Dataset roles and independent units. Uncertainty uses task families rather than counts of requests, operations, orders, or traffic replays.
Layer
Passed
Total
Meaning
Parent refusal
491
491
Both frozen DeepSeek aliases strictly refuse
Protected answers parse
2,038
2,149
One call per planned singleton
Operation verifier
1,845
2,149
Public and held-out field probes pass
Qualified task
262
491
Direct local failure plus every field and final product pass
Canonical assembly
262
262
Consistency check; qualification already requires this test, so the ratio is one by construction
Matched variants
26,817
45,877
Actual target output passes the source operation probe
Appendix
Table 7: Output-validity layers. The defense headline is abstract ASR; the other rows show which executable premises were checked.
ID
Method
Causal state
M0
No defense
None
M1
Lexical
Current request
M2
Granite [ 17 ]
Current request
M3
TwinGate
Global or group retrieval
M4
Brown-style
Online embedding clusters and escalation
M5
Cumulative
Cumulative history summary
Appendix
Table 8: Defense suite and the causal state each method keeps. M9 has exact operation semantics and is evaluated with either global or visible-group accumulation; the post hoc best-of-class reference is selected after evaluation over a declared class of policies that cannot observe evaluator roles.
ID
Component
Representation/retrieval
State and decision
Selected point
M1
Hashing logistic regression
218 word one to two grams plus 218 character three to five grams
Frozen access-control intent and semantic encoders, 64-token input as released; strict-prefix causal nearest neighbors
Global semantic root inheritance
intent >1 , semantic 1.01 (blocks none)
M4
Brown-style adaptation
BGE cluster gate then 2B escalation
Online global request atom clusters
trigger 1.01 (blocks none)
M5
Cumulative monitor
BGE strict-prefix top-eight then 2B judge
Global cumulative summary; retrieved prefix plus current request
trigger .70, risk .199951
M6
Direct capability judge
BGE top-eight plus frozen task description retrieval
Retrieved prefix, current request, selected task descriptions
trigger .90, risk .449951
Appendix
Table 9: Frozen main-cohort baseline details. A threshold above one is an explicit calibration choice that blocks no requests.
Abstract ASR (%, 95% interval)
Utility loss (%)
Mean cost at R=5
Method
R=1
R=2
R=5
MCD
BBR
Requests (= groups)
M0 No defense
100 [100, 100]
100 [100, 100]
100 [100, 100]
0
0
3.45
M1 Lexical
100 [100, 100]
100 [100, 100]
100 [100, 100]
0
0
3.45
M2 Granite
99.43 [98.30, 100]
100 [100, 100]
100 [100, 100]
0.299
0.498
3.46
M3 TwinGate
100 [100, 100]
100 [100, 100]
100 [100, 100]
0
0
3.45
M4 Brown-style
100 [100, 100]
100 [100, 100]
100 [100, 100]
0
0
3.45
Appendix
Table 10: Outer high-density dynamic replay at mC=11.553 . Abstract ASR is reported as a percentage with a 95% interval over the 11 outer families.
Figure 5: Complete gap trajectories underlying Figure 4 , separated by retry limit. Each point summarizes the same 3,072 evaluation cells at one feedback checkpoint. Color, marker shape, and line style identify the learner; filled thick curves and hollow thin curves show the median and 95th empirical percentile. Both axes use symmetric logarithmic scales, and the horizontal reference marks a gap of 0.01. Percentiles describe cell variation rather than confidence intervals.
Outer static, 1% budget
Outer dynamic, mC=11.553 , R=1
Method
ATK
MCD
ρ
BBR
βall
ATK
MCD
ρ
BBR
βall
M1 Lexical
0
0
N/A
0
0
0
0
N/A
0
0
M2 Granite
0.288
0.320
0.900
0.498
0.489
0.165
0.299
0.551
0.498
0.498
M3 TwinGate
0
0
N/A
0
0
0
0
N/A
0
0
M4 Brown-style
0
0
N/A
0
0
0
0
N/A
0
0
M5 Cumulative
79.50
64.73
1.228
0.075
3.302
29.79
16.29
1.829
0.005
0.015
Appendix
Table 11: Class separation and the two utility denominators. ATK is the block rate on attack requests, MCD is matched-control denial, ρ is their ratio, BBR is the background block rate, and βall is the combined benign denial rate at that replay’s capability share. Bold MCD exceeds the 1% cap. All values are percentages except ρ .
Cap
Best admissible realizable
Realized MCD
Post hoc best-of-class
M9 global
0%
100.000% (M1)
0%
97.314%
0% at 25.486%
0.25%
100.000% (M1)
0%
97.314%
0% at 25.486%
0.5%
99.006% (M2)
0.320%
94.627%
0% at 25.486%
1%
99.006% (M2)
0.320%
89.530%
0% at 25.486%
2%
99.006% (M2)
0.320%
80.576%
0% at 25.486%
5%
99.006% (M2)
0.320%
58.466%
0% at 25.486%
Appendix
Table 12: Outer cohort budget sweep over 11 defense-unseen families. Realized MCD is the test matched-control denial actually produced by the selected method at that cap.
Shared fraction
Deff
Relative
Matched-control denial
0 (as constructed)
1998.0
1.000
17.537%
0.1
1887.1
0.945
16.564%
0.2
1800.1
0.901
15.800%
0.3
1743.8
0.873
15.306%
0.5
1628.8
0.815
14.297%
0.8
1527.8
0.765
13.410%
Appendix
Table 13: Cost of disrupting every task in the main common support cohort as operations become shared. Deff is the covering value over 11,393 controls.
Score
AUROC
n alternative
M1 Lexical
0.2458
221
M2 Granite
0.3294
221
M3 TwinGate intent
0.3242
51
M3 TwinGate semantic
0.5313
51
M4 Brown-style
0.5731
51
M5 Cumulative
0.5722
51
Appendix
Table 14: Separability of the alternative generator inside the control bank. A value near 0.5 means the policy cannot tell the two generators apart; a value below 0.5 means it scores the alternative generator as less suspicious.
Score
AUROC
95% interval
M1 Lexical
0.2650
[0.208, 0.322]
M2 Granite
0.2966
[0.272, 0.318]
M3 intent
0.3303
[0.308, 0.353]
Appendix
Table 15: Separating variants written by the attacker’s own local model from variants written by the service rewrite backend, with the evaluator role held fixed, on held-out records. Intervals are 95% resampled intervals over the 347 attacker-written records.
Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.
Decompositional jailbreaks pose a critical threat to large language models (LLMs) by allowing adversaries to fragment a malicious objective into a sequence of individually benign queries that collectively reconstruct prohibited content. In real-world deployments, LLMs face a continuous, untraceable stream of fully anonymized and arbitrarily interleaved requests, infiltrated by covertly distributed adversarial queries. Under this rigorous threat model, state-of-the-art defensive strategies exhibit fundamental limitations. In the absence of trustworthy user metadata, they are incapable of tracking global historical contexts, while their deployment of generative models for real-time monitoring introduces computationally prohibitive overhead. To address this, we present TwinGate, a stateful dual-encoder defense framework. TwinGate employs Asymmetric Contrastive Learning (ACL) to cluster semantically disparate but intent-matched malicious fragments in a shared latent space, while a parallel frozen encoder suppresses false positives arising from benign topical overlap. Each request requires only a single lightweight forward pass, enabling the defense to execute in parallel with the target model's prefill phase at negligible latency overhead. To evaluate our approach and advance future research, we construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents. Evaluated on this large-scale corpus under a strictly causal protocol, TwinGate achieves high malicious intent recall at a remarkably low false positive rate while remaining highly robust against adaptive attacks. Furthermore, our proposal substantially outperforms stateful and stateless baselines, delivering superior throughput and reduced latency.
Bowen Sun, Chaozhuo Li, Yaodong Yang +2
Johns Hopkins University · Microsoft Research Asia · Peking University +1
Scaling laws are usually read as a capability story: lower language-modeling loss yields more useful models. We study a safety consequence of this mechanism in cross-session decomposition attacks, where benign-looking subqueries are asked across independent interactions and later recomposed toward a forbidden objective. We formalize this setting as compositional safety risk and prove a conditional risk-transfer bound: when the reference environment already contains dispersed evidence for a risky reconstruction, the gap between deployed composed risk and reference composed risk is controlled by the model's excess loss on allowed subqueries. Synthetic withholding experiments show that wider transformers assign lower loss to held-out instructions that never appear verbatim in training but are recoverable from injected supporting facts. A 600-intent pretrained-LLM evaluation shows that larger Qwen3 and Gemma3 family members can yield greater harmful-capability uplift under a fixed decomposition-composition pipeline. As a defense, IntentAlign-MiniLM, our 22M-parameter intent-aligned retriever, outperforms much larger embedding models on held-out intent retrieval and yields the best learned-retriever harmful recall across tested guardrails. Code is available in our GitHub repository.
Large Language Models (LLMs) are trained to refuse harmful requests, yet they remain vulnerable to jailbreak attacks that exploit weaknesses in conversational safety mechanisms. We introduce Incremental Completion Decomposition ICD, a trajectory-based jailbreak strategy that elicits a sequence of single-word continuations related to a malicious request before eliciting the full response. In addition, we propose ICD variants that use model-generated or attacker-injected intermediate continuations, as well as final-response prefilling. We evaluate these variants across a broad set of open-weight model families, demonstrating superior Attack Success Rate (ASR) on AdvBench, JailbreakBench, and StrongREJECT compared to existing methods. In addition, we provide a theoretical account of why ICD is effective and present mechanistic evidence that successful attack trajectories suppress refusal-related representations and shift activations away from safety-aligned states.