Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services

Bowen Sun; Zhengyue Zhao; Xiaogeng Liu; Yinzhi Cao; Chaowei Xiao

cs.CRAug 18, 2026

Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services

Authors: Bowen Sun, Zhengyue Zhao, Xiaogeng Liu, Yinzhi Cao, Chaowei Xiao

Organizations: Johns Hopkins University

Abstract

Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.

Figures & tables

Figure 1: Request bodies, linkable groups, order, and visible decisions are identical in the two worlds; only off-service pooling differs, so a policy without that relation acts the same way while the outcomes differ.

Figure 2: Conditional frontiers under exact operation labels. (a) One-attempt worst-task frontier against independent causal replay, diamonds marking the aggregate knapsack objective. (b) Median and 5th to 95th percentiles over 100 legal partitions per predeclared

K

at 1% denial, placed by occupied control groups. (c) The same 800 partitions paired across retry limits.

Score	Evidence / state	Capability	Canonical source	Same contrast,
		vs. background	vs. control	template deleted
M1 Lexical	Word/character n-grams	0.9864	0.9999	0.4889 [0.424, 0.554]
M2 Granite [ 17 ]	Current-request harm score	0.7234	0.6586	0.4987 [0.435, 0.562]
M3-corrected TwinGate [ 21 ]	Intent encoder and retrieval	0.7824	0.4961	0.4961 [0.474, 0.516]
M4 Brown-style [ 3 ]	Embedding clusters and LLM judge	0.9694	0.9984	0.5018 [0.501, 0.503]
M5 Cumulative [ 28 ]	Retrieved prefix and cumulative judge	0.9817	0.9910	0.5334 [0.490, 0.580]

Table 1: What each score separates on main evaluation records: 81 canonical decomposition requests, 2,491 matched controls, and 720,000 background requests. The first AUROC column tests capability recognition; the next two compare the canonical source class with controls before and after deleting a shared control-template prefix. Brackets are 95% resampled intervals. Source comparisons use all 2,572 canonical and control records for M1–M3 and M8, and the 2,533 gate-passing records scored by the frozen LLM judges for M4–M7.

	Main evaluation: 20 families/19 clusters			Outer: 11 defense-unseen families
Method	ASR [95%]	MCD	BBR	ASR [95%]	MCD	BBR
M0 No defense	100 [100,100]	0	0	100 [100,100]	0	0
M1 Lexical	94.61 [91.15,97.62]	1.320	0	100 [100,100]	0	0
M2 Granite	100 [100,100]	0	0.498	99.01 [97.30,100]	0.320	0.498
M3 TwinGate	100 [100,100]	0	0	100 [100,100]	0	0
M4 Brown-style	100 [100,100]	0	0	100 [100,100]	0	0

Table 2: Static

R=1

abstract ASR. M0–M8 use calibration-selected thresholds; privileged references report zero-ASR points. Brackets are 95% resampled intervals, bold MCD exceeds the 1% cap, and rates are percentages.

Policy	MCD	$\rho$	95% interval
Main evaluation, 19 clusters
M1 Lexical	1.320	1.037	[0.836, 1.199]
M5 Cumulative	0.641	1.015	[0.863, 1.154]
M6 Direct LLM	1.377	1.086	[0.983, 1.204]
M8 Structured	1.419	1.120	[1.044, 1.200]
Outer cohort, 11 families

Table 3: Resampled 95% intervals for

\rho=\mathrm{ATK}/\mathrm{MCD}

. Bold MCD exceeds the 1% cap; zero-MCD policies have undefined ratios.

	$m_{C}$
Metric	1.000	2.136	3.765	7.037	13.617	26.753	Mean
M1 Lexical
MCD	1.235	1.156	0.656	0.351	0.544	0.831	–
$R=1$	10	10	10	10	10	5	8.75
$R=2$	100	100	100	100	100	95	98.75
$R=5$	100	100	100	100	100	100	100

Table 4: Positive control at six nested

m_{C}

levels (36 cells each). ASR is percent; bold MCD exceeds the 1% cap, and means use admissible levels only.

Figure 3: Dynamic ASR on eleven defense-unseen families under fresh-group attacks. Filled points minimize ASR subject to both utility caps across all four legal matched-control groupings; hollow diamonds violate a cap. Greater matched-control density removes low-ASR operating points, and one retry makes every high-density admissible method reach 100% ASR.

Figure 4: Binary Allow / Block feedback is sufficient for practical profile learning. Each panel fixes attempts per operation and reports the share of 3,072 cells in which the selected profile is within one ASR percentage point of the best frozen profile; the horizontal axis is symmetric-logarithmic to include checkpoint zero.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Object	Defined by	Visible to defense	Used by evaluator
Operation capability	Request body and frozen task contract	Only through the chosen recognizer; exact in the ideal benchmark	Exact registered mapping and, separately, verifier result
Linkable group	Declared service-side linkage rule	Yes	Yes
Access coalition	Off-service response pooling	No	Yes, fixed before policy outcomes
Attack/control role	Balanced evaluator recoloring	No	Yes
Task success	One coalition obtains all necessary operations	No trusted online label	Abstract and realized ledgers
Exact capability recognizer	Exact request-to-operation map	Privileged semantic component	Removes natural language recognition error

Appendix

Table 5: Objects and information boundaries. “Exact” denotes information available to the privileged measurement benchmark.

Cohort or role	Tasks	Families	Operation requests	Matched controls	Use and status
Fresh task construction	491	443	2,149	N/A	Formal staged denominator; 262 strictly qualify
Strict capability bank	262	248	1,152 (848 with $\geq$ 10 certified)	25,977	Outcome-inspected construction pool
Main common support	91	82	365	11,393	All operations have at least ten controls; 2,190/2,190 task tests pass
Defense training	N/A	30	N/A	split by family	Fit learned defenses only
Attacker adaptation	N/A	20	N/A	split by family	Observe own Allow / Block only
Threshold calibration	N/A	12	N/A	split by family	Choose operating points only

Appendix

Table 6: Dataset roles and independent units. Uncertainty uses task families rather than counts of requests, operations, orders, or traffic replays.

Layer	Passed	Total	Meaning
Parent refusal	491	491	Both frozen DeepSeek aliases strictly refuse
Protected answers parse	2,038	2,149	One call per planned singleton
Operation verifier	1,845	2,149	Public and held-out field probes pass
Qualified task	262	491	Direct local failure plus every field and final product pass
Canonical assembly	262	262	Consistency check; qualification already requires this test, so the ratio is one by construction
Matched variants	26,817	45,877	Actual target output passes the source operation probe

Appendix

Table 7: Output-validity layers. The defense headline is abstract ASR; the other rows show which executable premises were checked.

ID	Method	Causal state
M0	No defense	None
M1	Lexical	Current request
M2	Granite [ 17 ]	Current request
M3	TwinGate	Global or group retrieval
M4	Brown-style	Online embedding clusters and escalation
M5	Cumulative	Cumulative history summary

Appendix

Table 8: Defense suite and the causal state each method keeps. M9 has exact operation semantics and is evaluated with either global or visible-group accumulation; the post hoc best-of-class reference is selected after evaluation over a declared class of policies that cannot observe evaluator roles.

ID	Component	Representation/retrieval	State and decision	Selected point
M1	Hashing logistic regression	$2^{18}$ word one to two grams plus $2^{18}$ character three to five grams	Stateless request score; balanced classes, seed 20260801	score 7.18753
M2	Granite Guardian 3.1 2B	Native harm Yes/No probability; pinned revision listed below	Current request only; uniform batch-16 scoring	0.914903
M3	Public TwinGate	Frozen access-control intent and semantic encoders, 64-token input as released; strict-prefix causal nearest neighbors	Global semantic root inheritance	intent $>1$ , semantic $1.01$ (blocks none)
M4	Brown-style adaptation	BGE cluster gate then 2B escalation	Online global request atom clusters	trigger 1.01 (blocks none)
M5	Cumulative monitor	BGE strict-prefix top-eight then 2B judge	Global cumulative summary; retrieved prefix plus current request	trigger .70, risk .199951
M6	Direct capability judge	BGE top-eight plus frozen task description retrieval	Retrieved prefix, current request, selected task descriptions	trigger .90, risk .449951

Appendix

Table 9: Frozen main-cohort baseline details. A threshold above one is an explicit calibration choice that blocks no requests.

Method	$R=1$	$R=2$	$R=5$	MCD	BBR	Requests (= groups)
	Abstract ASR (%, 95% interval)			Utility loss (%)		Mean cost at $R=5$
M0 No defense	100 [100, 100]	100 [100, 100]	100 [100, 100]	0	0	3.45
M1 Lexical	100 [100, 100]	100 [100, 100]	100 [100, 100]	0	0	3.45
M2 Granite	99.43 [98.30, 100]	100 [100, 100]	100 [100, 100]	0.299	0.498	3.46
M3 TwinGate	100 [100, 100]	100 [100, 100]	100 [100, 100]	0	0	3.45
M4 Brown-style	100 [100, 100]	100 [100, 100]	100 [100, 100]	0	0	3.45

Appendix

Table 10: Outer high-density dynamic replay at

m_{C}=11.553

. Abstract ASR is reported as a percentage with a 95% interval over the 11 outer families.

Figure 5: Complete gap trajectories underlying Figure 4 , separated by retry limit. Each point summarizes the same 3,072 evaluation cells at one feedback checkpoint. Color, marker shape, and line style identify the learner; filled thick curves and hollow thin curves show the median and 95th empirical percentile. Both axes use symmetric logarithmic scales, and the horizontal reference marks a gap of 0.01. Percentiles describe cell variation rather than confidence intervals.

	Outer static, 1% budget					Outer dynamic, $m_{C}=11.553$ , $R=1$
Method	ATK	MCD	$\rho$	BBR	$\beta_{\mathrm{all}}$	ATK	MCD	$\rho$	BBR	$\beta_{\mathrm{all}}$
M1 Lexical	0	0	N/A	0	0	0	0	N/A	0	0
M2 Granite	0.288	0.320	0.900	0.498	0.489	0.165	0.299	0.551	0.498	0.498
M3 TwinGate	0	0	N/A	0	0	0	0	N/A	0	0
M4 Brown-style	0	0	N/A	0	0	0	0	N/A	0	0
M5 Cumulative	79.50	64.73	1.228	0.075	3.302	29.79	16.29	1.829	0.005	0.015

Appendix

Table 11: Class separation and the two utility denominators. ATK is the block rate on attack requests, MCD is matched-control denial,

\rho

is their ratio, BBR is the background block rate, and

\beta_{\mathrm{all}}

is the combined benign denial rate at that replay’s capability share. Bold MCD exceeds the 1% cap. All values are percentages except

\rho

Cap	Best admissible realizable	Realized MCD	Post hoc best-of-class	M9 global
0%	100.000% (M1)	0%	97.314%	0% at 25.486%
0.25%	100.000% (M1)	0%	97.314%	0% at 25.486%
0.5%	99.006% (M2)	0.320%	94.627%	0% at 25.486%
1%	99.006% (M2)	0.320%	89.530%	0% at 25.486%
2%	99.006% (M2)	0.320%	80.576%	0% at 25.486%
5%	99.006% (M2)	0.320%	58.466%	0% at 25.486%

Appendix

Table 12: Outer cohort budget sweep over 11 defense-unseen families. Realized MCD is the test matched-control denial actually produced by the selected method at that cap.

Shared fraction	$D_{\mathrm{eff}}$	Relative	Matched-control denial
0 (as constructed)	1998.0	1.000	17.537%
0.1	1887.1	0.945	16.564%
0.2	1800.1	0.901	15.800%
0.3	1743.8	0.873	15.306%
0.5	1628.8	0.815	14.297%
0.8	1527.8	0.765	13.410%

Appendix

Table 13: Cost of disrupting every task in the main common support cohort as operations become shared.

D_{\mathrm{eff}}

is the covering value over 11,393 controls.

Score	AUROC	$n$ alternative
M1 Lexical	0.2458	221
M2 Granite	0.3294	221
M3 TwinGate intent	0.3242	51
M3 TwinGate semantic	0.5313	51
M4 Brown-style	0.5731	51
M5 Cumulative	0.5722	51

Appendix

Table 14: Separability of the alternative generator inside the control bank. A value near 0.5 means the policy cannot tell the two generators apart; a value below 0.5 means it scores the alternative generator as less suspicious.

Score	AUROC	95% interval
M1 Lexical	0.2650	[0.208, 0.322]
M2 Granite	0.2966	[0.272, 0.318]
M3 intent	0.3303	[0.308, 0.353]

Appendix

Table 15: Separating variants written by the attacker’s own local model from variants written by the service rewrite backend, with the evaluator role held fixed, on held-out records. Intervals are 95% resampled intervals over the 347 attacker-written records.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning
Apr 30, 2026Bowen Sun, Chaozhuo Li, Yaodong Yang +2Jailbreak Attacks LLM Security
Johns Hopkins University · Microsoft Research Asia · Peking University +1
Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense
Aug 28, 2026Disen Liao, Yihan Wang, Freda Shi +1LLM Security LLM Safety
University of Waterloo · Vector Institute
One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety
Apr 1, 2026Samee Arif, Naihao Deng, Zhijing Jin +1LLM Jailbreak Attacks Language Model Safety Evaluation
University of Michigan · University of Toronto

Apr 30, 2026J/K move · Enter open · S save

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

Bowen Sun, Chaozhuo Li, Yaodong Yang, Yiwei Wang+1

Johns Hopkins University · Microsoft Research Asia · Peking University+1

Jailbreak Attacks LLM Security LLM Jailbreak Attacks Jailbreak Detection Jailbreak Defense

Open paper AskPDF arXiv

Decompositional jailbreaks pose a critical threat to large language models (LLMs) by allowing adversaries to fragment a malicious objective into a sequence of individually benign queries that collectively reconstruct prohibited content. In real-world deployments, LLMs face a continuous, untraceable stream of fully anonymized and arbitrarily interleaved requests, infiltrated by covertly distributed adversarial queries. Under this rigorous threat model, state-of-the-art defensive strategies exhibit fundamental limitations. In the absence of trustworthy user metadata, they are incapable of tracking global historical contexts, while their deployment of generative models for real-time monitoring introduces computationally prohibitive overhead. To address this, we present TwinGate, a stateful dual-encoder defense framework. TwinGate employs Asymmetric Contrastive Learning (ACL) to cluster semantically disparate but intent-matched malicious fragments in a shared latent space, while a parallel frozen encoder suppresses false positives arising from benign topical overlap. Each request requires only a single lightweight forward pass, enabling the defense to execute in parallel with the target model's prefill phase at negligible latency overhead. To evaluate our approach and advance future research, we construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents. Evaluated on this large-scale corpus under a strictly causal protocol, TwinGate achieves high malicious intent recall at a remarkably low false positive rate while remaining highly robust against adaptive attacks. Furthermore, our proposal substantially outperforms stateful and stateless baselines, delivering superior throughput and reduced latency.

Abstract

Adversarial Attacks on LLMs

Explore similar work

TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense

One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety