Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services

• URL: http://arxiv.org/abs/2608.17445v2
• Date: Sun, 23 Aug 2026 04:41:24 GMT
• Title: Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services
• Abstract summary: Most large language model services use stateless defenses, which judge only the current request to refuse harmful tasks.<n>Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers.<n>We show that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped.
• Score: 56.0553456562323
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.

Related papers

• Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval [0.0]
  Retrieval-augmented generation answers a question by retrieving passages from a vector store and trusting them as context.<n>A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub.<n>We show it is defeated by a coordinated adversary that injects a handful of individually unremarkable documents.
  arXiv  Detail & Related papers  (2026-08-17T03:18:51Z)
• AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications [71.27518152526686]
  Large Language Models (LLMs) excel at text comprehension and generation, making them ideal for automated tasks like code review and content moderation.<n>LLMs can be manipulated by "adversarial instructions" hidden in input data, such as resumes or code, causing them to deviate from their intended task.<n>This paper introduces a benchmark to assess this vulnerability in resume screening, revealing attack success rates exceeding 80% for certain attack types.
  arXiv  Detail & Related papers  (2025-12-23T08:42:09Z)
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections [74.60337113759313]
  Current defenses against jailbreaks and prompt injections are typically evaluated against a static set of harmful attack strings.<n>We argue that this evaluation process is flawed. Instead, we should evaluate defenses against adaptive attackers who explicitly modify their attack strategy to counter a defense's design.
  arXiv  Detail & Related papers  (2025-10-10T05:51:04Z)
• Benchmarking Misuse Mitigation Against Covert Adversaries [80.74502950627736]
  Existing language model safety evaluations focus on overt attacks and low-stakes tasks.<n>We develop Benchmarks for Stateful Defenses (BSD), a data generation pipeline that automates evaluations of covert attacks and corresponding defenses.<n>Our evaluations indicate that decomposition attacks are effective misuse enablers, and highlight stateful defenses as a countermeasure.
  arXiv  Detail & Related papers  (2025-06-06T17:33:33Z)
• Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines [7.260315265550391]
  We study the dynamics of ranking manipulation attacks in search engines.<n>We identify tipping points in the system dynamics, demonstrating that cooperation is more likely to be sustained when players are forward-looking.<n>Our work provides a theoretical foundation and practical insights for understanding and mitigating their vulnerabilities.
  arXiv  Detail & Related papers  (2025-01-01T06:23:26Z)
• The Good, the Bad and the Ugly: Watermarks, Transferable Attacks and Adversarial Defenses [21.975560789792073]
  We formalize and extend existing definitions of backdoor-based watermarks and adversarial defenses as interactive protocols between two players. For almost every discriminative learning task, at least one of the two -- a watermark or an adversarial defense -- exists. We show that any task that satisfies our notion of a transferable attack implies a cryptographic primitive.
  arXiv  Detail & Related papers  (2024-10-11T14:44:05Z)
• Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attacks [76.35478518372692]
  We introduce epsilon-illusory, a novel form of adversarial attack on sequential decision-makers. Compared to existing attacks, we empirically find epsilon-illusory to be significantly harder to detect with automated methods. Our findings suggest the need for better anomaly detectors, as well as effective hardware- and system-level defenses.
  arXiv  Detail & Related papers  (2022-07-20T19:49:09Z)
• Zero-Query Transfer Attacks on Context-Aware Object Detectors [95.18656036716972]
  Adversarial attacks perturb images such that a deep neural network produces incorrect classification results. A promising approach to defend against adversarial attacks on natural multi-object scenes is to impose a context-consistency check. We present the first approach for generating context-consistent adversarial attacks that can evade the context-consistency check.
  arXiv  Detail & Related papers  (2022-03-29T04:33:06Z)
• RayS: A Ray Searching Method for Hard-label Adversarial Attack [99.72117609513589]
  We present the Ray Searching attack (RayS), which greatly improves the hard-label attack effectiveness as well as efficiency. RayS attack can also be used as a sanity check for possible "falsely robust" models.
  arXiv  Detail & Related papers  (2020-06-23T07:01:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.