Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services

Excerpt

arXiv:2608.17445v1 Announce Type: cross Abstract: Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attack