Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitors

TL;DR

This paper introduces a lightweight sequential monitoring framework to detect and mitigate decomposition attacks in large language models, significantly improving safety defenses by reasoning over conversation sequences.

Contribution

The paper proposes a novel lightweight sequential monitor that effectively detects decomposition attacks and outperforms reasoning models, with reduced cost and latency.

Findings

Achieves 93% defense success rate against decomposition attacks.

Remains robust against random task injection.

Reduces monitoring cost by 90% and latency by 50%.

Abstract

Current LLM safety defenses fail under decomposition attacks, where a malicious goal is decomposed into benign subtasks that circumvent refusals. The challenge lies in the existing shallow safety alignment techniques: they only detect harm in the immediate prompt and do not reason about long-range intent, leaving them blind to malicious intent that emerges over a sequence of seemingly benign instructions. We therefore propose adding an external monitor that observes the conversation at a higher granularity. To facilitate our study of monitoring decomposition attacks, we curate the largest and most diverse dataset to date, including question-answering, text-to-image, and agentic tasks. We verify our datasets by testing them on frontier LLMs and show an 87% attack success rate on average on GPT-4o. This confirms that decomposition attack is broadly effective. Additionally, we find that random tasks can be injected into the decomposed subtasks to further obfuscate malicious intents. To defend in real time, we propose a lightweight sequential monitoring framework that cumulatively evaluates each subtask. We show that a carefully prompt engineered lightweight monitor achieves a 93% defense success rate, beating reasoning models like o3 mini as a monitor. Moreover, it remains robust against random task injection and cuts cost by 90% and latency by 50%. Our findings suggest that lightweight sequential monitors are highly effective in mitigating decomposition attacks and are viable in deployment.