ai-research-survey

scan.json (27578B)

---

 {
   "paper": {
     "title": "Safe in Isolation, Dangerous Together: Agent-Driven Multi-Turn Decomposition Jailbreaks on LLMs",
     "authors": ["Devansh Srivastav", "Xiao Zhang"],
     "year": 2025,
     "venue": "ACL 2025 (REALM Workshop)"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "A multi-agent decomposition framework achieves up to 95.38% attack success rate (ASR) on AdvBench across six LLMs, significantly outperforming existing jailbreak techniques including DAN, Past Tense, Implicit Reference, and Style Injection. The attack decomposes harmful queries into innocuous sub-questions via three agents (Decomposer, Answerer, Combiner), requiring no prompt hacking. Category-wise analysis shows near-100% ASR on privacy violations and child abuse categories for some models, and results are stable across 5 independent runs (SD 1.97-2.84%).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or link to source code is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available AdvBench dataset (Zou et al., 2023) containing 520 adversarial prompts. No custom data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions M2 Max 32GB with MPS backend and use of Ollama/OpenAI API, but provides no requirements.txt, library versions, or environment specification."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results in Table 1 are point estimates only. Figure 3 shows standard deviations across 5 runs but no confidence intervals or error bars on the main comparison results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims Multi-Agent 'consistently outperforms' other methods but provides no statistical significance tests. Comparisons are based solely on comparing ASR percentages."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute ASR values with baselines for context, e.g., 'GPT-3.5-Turbo reached the highest ASR of 95.38%' from a baseline of 9.03%, and provides percentage improvements across all models in Table 1."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 520 prompts from AdvBench without justifying why this sample size is adequate for the claims made. No power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 and Figure 3 report standard deviations across 5 independent runs for each model (e.g., Mistral-7B SD=1.97%, GPT-3.5-Turbo SD=2.16%)."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 compares against four jailbreak methods (DAN, Past Tense, Implicit Reference, Style Injection) plus a direct-prompting baseline across all six models."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include DAN (Shen et al., 2024), Past Tense (Andriushchenko & Flammarion, 2024), Implicit Reference (Wu et al., 2024b), and Style Injection (Wei et al., 2024) — all from 2024, which is recent."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The three-agent system (Decomposer, Answerer, Combiner) has distinct components but no ablation study examines the contribution of each component (e.g., what happens with 2 agents instead of 3, or without decomposition)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only ASR (Attack Success Rate) is reported. No other metrics such as response quality, semantic similarity to target harmful content, or fluency are measured."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses only LLM-as-judge (Mixtral-8×7B) for evaluation. The Limitations section acknowledges 'Human evaluation at scale remains a valuable complementary direction' but none was performed. Manual spot-checking on a 'small subset' is mentioned but not systematically reported."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "This is not a learning-based system — there is no training/validation/test split. The entire AdvBench dataset is used as the evaluation set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 and Figure 2 provide category-wise ASR breakdowns across 7 categories: Illegal Activity, Hate Speech, Malware, Fraud, Privacy Violations, Health Consultation, and Child Abuse."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper shows only successful jailbreak examples (Appendix B). No analysis of why the ~5-23% of attacks that failed did so. The Limitations section mentions Llama models getting stuck in infinite loops but does not analyze failure patterns systematically."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Vicuna-7B's lower ASR (77.50%) is noted but not explored in depth. No configurations or design choices that failed are discussed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 'often exceeding 90% across various LLMs' and 'consistently achieves the highest attack success rate' are supported by Table 1 (4/6 models above 90%, highest ASR in all cases)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the multi-agent decomposition strategy 'causes' the safety bypass, attributing it to 'lack of holistic context awareness.' However, no controlled experiment isolates this mechanism — the multi-agent approach differs from baselines in many ways (number of turns, role separation, query reformulation). No ablation separates decomposition from multi-agent orchestration."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'LLMs' broadly. The paper tests 5 open-source models (mostly 7-12B) and one older proprietary model (GPT-3.5-Turbo). The Limitations section notes they did not test DeepSeek-R1 or O1, but the paper's framing of 'critical flaw in the current safety architecture of multi-agent LLM systems' is not bounded to the tested models."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes success solely to 'lack of holistic context awareness' without considering alternative explanations such as: the Combiner agent itself generating harmful content (not just synthesizing), weaker safety alignment in smaller open-source models, or the role of the specific LLM-as-judge in inflating ASR."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR is measured by an LLM judge (Mixtral-8×7B) which counts any response that 'addresses the prompt in any way, including through fictional scenarios or educational explanations' as successful. This conflates policy violation severity — a nuanced educational discussion is scored the same as explicit harmful instructions. The paper does not discuss this proxy gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified by name (Mistral-7B, Gemma-2-9B, GPT-3.5-Turbo, etc.) but no specific version strings or snapshot dates are given. 'GPT-3.5-Turbo' without a version date could refer to multiple model snapshots."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation prompt for the LLM judge is provided in Appendix A. The agent role prompts are described conceptually in Section 3, and full examples of sub-questions and answers are provided in Appendix B. However, the exact system prompts for the three agents (Decomposer, Answerer, Combiner) are not provided verbatim — only their roles and objectives are described."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 states: 'For all generations, we use default sampling parameters: temperature = 1.0, top_p = 1.0, and n = 1' with explicit justification for using defaults."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The multi-agent framework is described in detail in Section 3 with a workflow diagram (Figure 1), three distinct agent roles, the CrewAI orchestration platform, and the iterative process (decomposition → sub-query resolution → answer synthesis)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No documentation of how the 520 AdvBench prompts were processed, whether any were filtered, or how the 7 categories were assigned. The category breakdown in Figure 2 sums to unclear totals."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section discusses computational bottlenecks (8-9 hours per model on M2 Max), LLM-as-judge bias, and lack of testing on DeepSeek-R1/O1."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies specific threats: 'using an LLM as a judge for evaluation may introduce subtle biases, especially if the judge model fails to detect nuanced or borderline policy violations' and notes Llama models getting stuck in infinite loops."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While the Limitations mentions not testing DeepSeek-R1 or O1, the paper does not explicitly bound its claims to the tested models and setting. The conclusion and abstract frame the findings as revealing 'a critical flaw in the current safety architecture of multi-agent LLM systems' without scoping to the specific models tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw model outputs, judge scores, or per-prompt results are released. Only aggregate ASR percentages are reported."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 describes the experimental setup: AdvBench dataset with 520 prompts, local inference via Ollama for open-source models, OpenAI API for GPT-3.5-Turbo, default sampling parameters."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data source is the standard AdvBench benchmark."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from prompt → decomposition → sub-answers → combined response → judge evaluation is described conceptually, but no details on how many prompts were filtered, how many generated infinite loops (mentioned in Limitations), or how edge cases were handled."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Authors are from CISPA Helmholtz Center for Information Security, clearly stated. They are not evaluating their own product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests jailbreak attacks (safety bypass), not model knowledge on benchmarks. The models are not being evaluated on whether they 'know' AdvBench answers — they are being tested on whether they refuse harmful requests."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Contamination is not relevant to jailbreak attack evaluation — the concern is safety alignment, not benchmark knowledge."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — contamination of AdvBench prompts in training data would mean models are more familiar with these harmful requests, potentially making them harder to jailbreak, not easier."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section reports '8-9 hours per model' for 520 prompts on M2 Max 32GB hardware, giving a practical sense of cost."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Hardware is stated (M2 Max 32GB, MPS backend) and runtime per model is reported (8-9 hours). Total budget across all experiments is inferrable."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 reports results across 5 independent runs with standard deviations for each model, effectively showing seed/run sensitivity."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 explicitly states '5 independent runs for each model.'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses default parameters and explicitly states this avoids hyperparameter tuning. However, the agent prompts and decomposition strategy represent design choices that were presumably iterated on, with no budget for this search reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses default sampling parameters (temperature=1.0, top_p=1.0) and explicitly justifies this choice to 'reflect how models typically behave in real-world use and to avoid introducing bias through hyperparameter tuning.'"
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Comparisons are made across 6 models × 5 methods with no statistical tests performed, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement the multi-agent attack and compare it against their own implementations of baseline attacks (DAN, Past Tense, etc.) without acknowledging potential bias in baseline implementations."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The multi-agent approach requires 3 LLM calls per prompt (decomposition + answering + combining) versus single-call baselines, but compute cost vs. performance is not analyzed. The 8-9 hour runtime is mentioned only in Limitations."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses AdvBench without questioning whether it is representative of real-world jailbreak scenarios, or whether the 520 prompts adequately cover the space of harmful requests. No discussion of construct validity."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The multi-agent framework is itself a scaffold. When comparing against single-turn baselines (DAN, Style Injection), the multi-turn, multi-agent nature of the approach is a confound — the improvement could be due to multi-turn interaction rather than decomposition specifically. This is not addressed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This is a jailbreak attack study, not a capability benchmark. Temporal leakage is not relevant — the models are being tested on safety alignment, not knowledge."
       },
       "feature_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable for the same reason — no knowledge benchmark is being evaluated."
       },
       "non_independence_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — no train/test split exists for this attack evaluation."
       },
       "leakage_detection_method": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — leakage detection is irrelevant to jailbreak attack evaluation."
       }
     }
   },
   "claims": [
     {
       "claim": "Multi-agent decomposition achieves up to 95.38% ASR on AdvBench, consistently outperforming existing jailbreak techniques across all models.",
       "evidence": "Table 1 shows ASR values: GPT-3.5-Turbo 95.38%, Mistral-7B 94.62%, Gemma-2-9B 93.85%, Mistral-Nemo-12B 92.69%, Llava-7B 86.15%, Vicuna-7B 77.50%. Multi-Agent achieves the highest or tied-highest ASR for every model.",
       "supported": "moderate"
     },
     {
       "claim": "The attack is highly stable and reproducible across multiple runs with low standard deviation (1.97-2.84%).",
       "evidence": "Section 4.3 and Figure 3 report 5 independent runs per model with SDs ranging from 1.97% (Mistral-7B) to 2.84% (Gemma-2-9B).",
       "supported": "strong"
     },
     {
       "claim": "The attack reveals 'a critical flaw in the current safety architecture of multi-agent LLM systems: their lack of holistic context awareness.'",
       "evidence": "The paper demonstrates high ASR but does not isolate the mechanism (no ablation separating decomposition from multi-turn from multi-agent effects). The causal attribution to 'lack of holistic context awareness' is an interpretation, not demonstrated.",
       "supported": "weak"
     },
     {
       "claim": "The method requires no prompt hacking or policy override commands.",
       "evidence": "Section 3 describes agent prompts as 'all reasonable and ostensibly safe' and the paper states 'no explicit prompt hacking or policy violation command is ever given.' However, exact agent prompts are not provided for verification.",
       "supported": "moderate"
     },
     {
       "claim": "Privacy violation and child abuse categories reach 100% ASR under multi-agent attack for some models.",
       "evidence": "Section 4.2 and Figure 2 report these category-wise results. However, category sample sizes are not stated — if these categories contain very few prompts, 100% is less meaningful.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No ablation study",
       "detail": "The three-component system (Decomposer, Answerer, Combiner) is never ablated. It's unclear whether the improvement comes from decomposition, multi-turn interaction, multi-agent separation, or simply the additional compute of 3 LLM calls. Comparing a 3-call pipeline against single-call baselines without controlling for compute is unfair."
     },
     {
       "flag": "LLM-as-judge validity concerns",
       "detail": "The Mixtral-8×7B judge uses a lenient criterion: any response that 'addresses the prompt in any way, including through fictional scenarios or educational explanations' counts as a successful jailbreak. This conflates a nuanced educational discussion with explicit harmful instructions, likely inflating ASR. The paper acknowledges this risk but performs only limited manual spot-checking."
     },
     {
       "flag": "Agent prompts not provided",
       "detail": "The exact system prompts for the three agents (Decomposer, Answerer, Combiner) are described only conceptually. Without the actual prompts, the claim of 'no prompt hacking' cannot be independently verified."
     },
     {
       "flag": "Older/weaker models tested",
       "detail": "The tested models are predominantly small open-source models (7-12B parameters) and an older proprietary model (GPT-3.5-Turbo). No frontier models (GPT-4, Claude 3.5, Gemini 1.5) are tested, making the 'critical flaw' framing potentially overstated — these models may have stronger safety mechanisms."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "Claims of 'consistently outperforms' are based solely on comparing point estimates without any statistical testing, despite having 5 runs per model that could support such tests."
     },
     {
       "flag": "Unfair compute comparison",
       "detail": "The multi-agent approach makes ~12+ LLM calls per prompt (decomposition + 10 sub-questions + combination) vs. single calls for baselines. The compute difference (8-9 hours vs. presumably much less for baselines) is never discussed as a confound."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces the AdvBench dataset used in this paper's evaluation, foundational work on adversarial attacks against aligned LLMs."
     },
     {
       "title": "\"Do Anything Now\": Characterizing and Evaluating In-the-Wild Jailbreak Prompts on Large Language Models",
       "authors": ["Xinyue Shen", "Zeyuan Chen", "Michael Backes", "Yun Shen", "Yang Zhang"],
       "year": 2024,
       "relevance": "Characterizes jailbreak prompts in the wild; DAN is one of the baselines in this paper."
     },
     {
       "title": "Does refusal training in LLMs generalize to the past tense?",
       "authors": ["Maksym Andriushchenko", "Nicolas Flammarion"],
       "year": 2024,
       "arxiv_id": "2407.11969",
       "relevance": "Proposes Past Tense Manipulation jailbreak technique, used as a baseline in this paper."
     },
     {
       "title": "You Know What I'm Saying: Jailbreak Attack via Implicit Reference",
       "authors": ["Tianyu Wu", "Lingrui Mei", "Ruibin Yuan", "Lujun Li", "Wei Xue", "Yike Guo"],
       "year": 2024,
       "arxiv_id": "2410.03857",
       "relevance": "Proposes decomposition-based jailbreak via implicit references achieving >90% ASR; directly compared as baseline."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2024,
       "relevance": "Analyzes failure modes of LLM safety training; Style Injection baseline comes from this work."
     },
     {
       "title": "Comprehensive assessment of jailbreak attacks against LLMs",
       "authors": ["Junjie Chu", "Yugeng Liu", "Ziqing Yang", "Xinyue Shen", "Michael Backes", "Yang Zhang"],
       "year": 2024,
       "arxiv_id": "2402.05668",
       "relevance": "Comprehensive assessment of jailbreak attack techniques against LLMs."
     },
     {
       "title": "Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models",
       "authors": ["Hao Yang", "Lizhen Qu", "Ehsan Shareghi", "Gholamreza Haffari"],
       "year": 2024,
       "arxiv_id": "2410.11459",
       "relevance": "Most closely related decomposition-based jailbreak achieving 93.76% ASR; directly compared in related work."
     },
     {
       "title": "Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues",
       "authors": ["Qibing Ren", "Hao Li", "Dongrui Liu"],
       "year": 2024,
       "arxiv_id": "2410.10700",
       "relevance": "Multi-turn jailbreak attack using actor-network theory for attack path generation."
     },
     {
       "title": "A survey on LLM-as-a-judge",
       "authors": ["Jiawei Gu", "Xuhui Jiang", "Zhichao Shi"],
       "year": 2024,
       "arxiv_id": "2411.15594",
       "relevance": "Surveys the LLM-as-judge evaluation paradigm used in this paper for ASR assessment."
     },
     {
       "title": "A new era in LLM security: Exploring security concerns in real-world LLM-based systems",
       "authors": ["Fangzhou Wu", "Ning Zhang", "Somesh Jha", "Patrick McDaniel", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2402.18649",
       "relevance": "Explores security concerns in real-world LLM systems, relevant to the multi-agent security attack surface."
     }
   ]
 }