FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragments

• URL: http://arxiv.org/abs/2605.11029v1
• Date: Sun, 10 May 2026 21:06:48 GMT
• Title: FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragments
• Abstract summary: An attacker can split a malicious goal into sub-prompts that each look benign on their own and only become harmful in combination.<n>We build FragBench, a benchmark drawn from 24 real-world cyber-incident campaigns.<n>FragBench splits this trail into two paired tasks: an adversarial rewriter that hardens fragments against a single-turn safety judge, and a graph-based user-level detector trained on the resulting interactions.
• Score: 1.4675552538526009
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: An attacker can split a malicious goal into sub-prompts that each look benign on their own and only become harmful in combination. Existing LLM safety benchmarks evaluate prompts one at a time, or across turns of a single chat, and so do not look for a malicious signal spread across separate sessions with no shared context. We build FragBench, a benchmark drawn from 24 real-world cyber-incident campaigns, which keeps the full attack trail: the multi-fragment kill chain, the per-fragment safety-judge verdicts, sandboxed execution traces, and a matched set of benign cover sessions. FragBench splits this trail into two paired tasks: an adversarial rewriter that hardens fragments against a single-turn safety judge (FragBench Attack), and a graph-based user-level detector trained on the resulting interactions (FragBench Defense). The single-turn judge is near chance on the released corpus by construction, but four GNN variants and three classical-ML baselines all recover the cross-session feature, reaching aggregate event-level F1 = 0.88-0.96. Defending against fragmented LLM misuse therefore requires modeling the cross-session interaction graph, rather than isolated prompts. Our generator, rewriter, sandbox harness, and detector are released at https://github.com/LidaSafety/fragbench.

Related papers

• Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents [8.011258884089948]
  We formalize cross-agent asynchronous campaign attribution, linking sessions from the same latent adversarial campaign without shared runtime state.<n>Asynchronous Fingerprint Vectors ($A2FV$) is a proxy-side reference protocol for scoring pairwise campaign similarity.<n>On SCD-v1, $A2FV$ achieves 0.82 pairwise AUC for campaign linking, while score-only adaptations of per-session detectors and chunked LLM judges remain near chance.
  arXiv  Detail & Related papers  (2026-07-21T08:01:51Z)
• Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents [0.0]
  Agentic red-teaming benchmarks report whether an injected agent was compromised as a single bit: the attack succeeded, or it did not.<n>We argue that this binary attack-success rate discards the information a defender most needs, namely how harmful the resulting action was.<n>We introduce an action-graded harm rubric that scores an agent's tool-call trajectory on a seven-level ordinal scale (L0 to L6) according to whether the executed action was reversible, whether it crossed scope to reach another party, and whether it expanded privilege.
  arXiv  Detail & Related papers  (2026-07-08T14:38:01Z)
• Stateful Guardrails for Multi-Turn LLM Systems: A Conversational Risk Accumulation Framework [0.19116784879310023]
  We term this Conversational Risk Accumulation (CRA): gradual intent drift, fragmented assembly of prohibited instructions, and sensitivity build-up from repeated disclosures.<n>We propose a session-layer CRA Framework that tracks three trajectory signals: semantic drift from a session anchor, a sensitivity-weighted information accumulation graph over extracted entities, and a compliance-gradient signal capturing increasing willingness to comply.<n>For scoring, we provide (i) an unsupervised convex fusion for attribution and ablations, and (ii) CRA-Net DA, a compact learned trajectory model trained with family-adversarial objectives to reduce length and topic-coverage
  arXiv  Detail & Related papers  (2026-06-03T02:55:17Z)
• ProactBench: Beyond What The User Asked For [5.422521416406412]
  ProactBench decomposes it into three phase-tied types: textscEmergent, inference from a single disclosed anchor; textscCritical, synthesis across multiple anchors; and textscRecovery, grounded forward-looking value after task completion.<n>Our information asymmetries defend against style-confounding scoring, leakage, external-context contamination, and information dumps.
  arXiv  Detail & Related papers  (2026-05-09T23:56:04Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• Cross-Session Threats in AI Agents: Benchmark, Evaluation, and Algorithms [0.0]
  CSTM-Bench is 26 executable attack classified by kill-chain stage and cross-session operation.<n>Released on Hugging Face as intrinsec-ai/cstm-bench with two 54-scenario splits: dilution (compositional) and cross_session.
  arXiv  Detail & Related papers  (2026-04-22T22:40:31Z)
• Committed SAE-Feature Traces for Audited-Session Substitution Detection in Hosted LLMs [2.6382975801439836]
  Hosted-LLM providers have a silent-substitution incentive: advertise a stronger model while serving cheaper replies.<n>We propose a commit-open protocol that closes this gap.<n>We instantiate the protocol on three backbones -- Qwen3-1.7B, Gemma-2-2B, and a 4.5x scale-up to Gemma-2-9B with a 131k-feature SAE.
  arXiv  Detail & Related papers  (2026-04-20T12:34:56Z)
• SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks [53.97948802255959]
  We propose a framework that trains a multi-turn attacker without relying on any existing strategies or external data.<n>Prefilling self-tuning enables usable rollouts by fine-tuning on non-refusal, well-structured, multi-turn adversarial prompts.<n>We anchor harmful intent in multi-turn jailbreaks via an intent-drift-aware reward that combines intent alignment, compliance risk, and level of detail.
  arXiv  Detail & Related papers  (2026-02-06T16:44:57Z)
• OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluation [94.61617176929384]
  OmniSafeBench-MM is a comprehensive toolbox for multi-modal jailbreak attack-defense evaluation.<n>It integrates 13 representative attack methods, 15 defense strategies, and a diverse dataset spanning 9 major risk domains and 50 fine-grained categories.<n>By unifying data, methodology, and evaluation into an open-source, reproducible platform, OmniSafeBench-MM provides a standardized foundation for future research.
  arXiv  Detail & Related papers  (2025-12-06T22:56:29Z)
• CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection [16.339655703671596]
  Jailbreak attacks pose a serious challenge to the safe deployment of large language models (LLMs)<n>We introduce CCFC (Core & Core-Full-Core), a dual-track, prompt-level defense framework.<n>We demonstrate that CCFC cuts attack success rates by 50-75% versus state-of-the-art defenses.
  arXiv  Detail & Related papers  (2025-08-19T04:17:21Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attacks [63.89012304595422]
  Backdoor attacks have become a significant threat to the pre-training and deployment of deep neural networks (DNNs)<n>In this study, we explore the concept of Multi-Trigger Backdoor Attacks (MTBAs), where multiple adversaries leverage different types of triggers to poison the same dataset.
  arXiv  Detail & Related papers  (2024-01-27T04:49:37Z)
• Certifying LLM Safety against Adversarial Prompting [70.96868018621167]
  Large language models (LLMs) are vulnerable to adversarial attacks that add malicious tokens to an input prompt.<n>We introduce erase-and-check, the first framework for defending against adversarial prompts with certifiable safety guarantees.
  arXiv  Detail & Related papers  (2023-09-06T04:37:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.