Research map / Multi-agent systems and games / LLM agents

Monitoring Decomposition Attacks with Lightweight Sequential Monitors

ICLR 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows decomposition attacks bypass LLM refusals across QA, text-to-image and agent settings, and proposes a lightweight sequential monitor with prompt engineering that matches or beats expensive monitors at lower cost and latency.

Problem

LLM safety defenses rely on shallow alignment and inspect single prompts, so malicious goals decomposed into benign subtasks evade refusal; deploying monitors in real time requires cheap yet robust detection, including under random task injection.

Approach

Use an external monitor that evaluates the cumulative conversation context after each new prompt (sequential monitoring) rather than each prompt in isolation, and optimize lightweight monitors via prompt engineering (task-specific ICL, CoT) tuned on validation sets.

Key results

• Decomposition raises GPT-4o average attack success rate from 21.2% to 87.2% across QA, text-to-image and agent settings.
• Optimized GPT-4o-mini with QA task ICL reaches F1 0.913 and up to 93% defense success rate, versus 0.836 F1 for o3-mini and 0.870 for GPT-4o, at roughly one-tenth the cost of o3-mini.
• Sequential monitoring raises Llama-3.1-8B zero-shot DSR from 0.267 (single input) to 0.575.

Surprising findings

• Carefully prompt-engineered lightweight monitors (GPT-4o-mini, Llama-3.1-8B) outperform reasoning model o3-mini and GPT-4o as monitors.
• Injecting random benign subtasks degrades strong monitors such as o3-mini (to 62% DSR worst case), yet optimized lightweight monitors stay robust.

Limitations

• Tasks contain fewer than 20 subtasks; scaling to much longer decompositions is untested.
• Only random benign task injection is tested; synonym rewriting or OOD phrase obfuscation not evaluated.
• Attackers who auto-refine refused subtasks are not simulated.

Experimental setup

Datasets: AgentHarm StrongReject

Benchmarks: DecomposedHarm (QA, text-to-image, agent) AgentHarm

Metrics: F1 score defense success rate refusal rate attack success rate cost per task latency

Baselines: o3-mini GPT-4o Claude-3.7-Sonnet single-input monitoring Llama-3.1-8B GPT-4.1-nano GPT-4o-mini

Builds on: StrongReject AgentHarm Constitutional Classifiers

Closest papers by meaning

• Reliable Weak-to-Strong Monitoring of LLM Agents (ICLR 2026 · similarity 0.90)
• Constitutional Black-Box Monitoring for Scheming in LLM Agents (ICML 2026 · similarity 0.88)
• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents (ICLR 2025 · similarity 0.88)
• LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments (NeurIPS 2026 · similarity 0.88)
• Agent-ToM: Learning to Monitor Autonomous LLM Agents via Theory-of-Mind Reasoning (NeurIPS 2026 · similarity 0.88)
• AgentAuditor: Human-level Safety and Security Evaluation for LLM Agents (NeurIPS 2025 · similarity 0.88)