Researchers have found a way to bypass defenses in large language model services by splitting harmful tasks into smaller, individually permissible requests. This 'decomposition attack' exploits the limitation of stateless defenses, which only judge each request independently. To defend against this type of attack, a stateful monitor is needed that considers requests together and can group them reliably. However, even with such a monitor, attackers can use unlinkable identities to evade detection. The study's authors propose additional evidence or mechanisms tied to grouping as a solution to prevent these attacks. --- Why it matters: This research matters because it highlights the limitations of current defenses in large language model services and demonstrates how easily they can be bypassed by sophisticated attackers. Engineers and researchers working on AI security will need to consider new strategies for defending against decomposition attacks, such as reliable identity linkage or control over answer use. Source: https://arxiv.org/abs/2608.17445