Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense

[2608.27945] Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense Skip to main content Search Submit Donate Log in Computer Science > Artificial Intelligence arXiv:2608.27945 (cs) [Submitted on 28 Aug 2026] Title: Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense Authors: Disen Liao , Yihan Wang , Freda Shi , Yaoliang Yu View PDF HTML (experimental) Abstract: Scaling laws are usually read as a capability story: lower language-modeling loss yields more useful models. We study a safety consequence of this mechanism in \emph{cross-session decomposition attacks}, where benign-looking subqueries are asked across independent interactions and later recomposed toward a forbidden objective. We formalize this setting as \emph{compositional safety risk} and prove a conditional risk-transfer bound: when the reference environment already contains dispersed evidence for a risky reconstruction, the gap between deployed composed risk and reference composed risk is controlled by the model's excess loss on allowed subqueries. Synthetic withholding experiments show that wider transformers assign lower loss to held-out instructions that never appear verbatim in training but are recoverable from injected supporting facts. A 600-intent pretrained-LLM evaluation shows that larger Qwen3 and Gemma3 family members can yield greater harmful-capability uplift under a fixed decomposition-composition pipeline. As a defense, IntentAlign-MiniLM, our 22M-parameter intent-aligned retriever, outperforms much larger embedding models on held-out intent retrieval and yields the best learned-retriever harmful recall across tested guardrails. Code is available in \href{ this https URL }{our GitHub repository}. Comments: 30 pages, 3 figures, EMNLP 2026 Findings Subjects: Artificial Intelligence (cs.AI) Cite as: arXiv:2608.27945 [cs.AI] (or arXiv:2608.27945v1 [cs.AI] for this version) https://doi.org/10.48550/arXiv.2608.27945 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Disen Liao [ view email ] [v1] Fri, 28 Aug 2026 05:39:29 UTC (245 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Additional Features Audio Summary Current browse context: cs.AI < prev | next > new | recent | 2026-08 Change to browse by: cs References & Citations SciX Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab)

Related documents

• Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense#779848
• ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models#822607
• Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic#290521
• Compositional security definitions for higher-order where declassification#120410
• Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models#1071316