The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Large language models remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs. The core finding is that harmful objectives can be realized by weaving together sequences of benign sub-queries, exploiting the highly interconnected nature of an LLM’s internal knowledge base.

The Problem and Core Vulnerability

Existing prompt-optimization paradigms typically fail because they rely on retaining malicious semantic signals in prompts, which modern guardrails are primed to detect. The paper identifies a deeper vulnerability: the highly interconnected nature of an LLM’s internal knowledge, allowing harmful objectives to be realized by weaving together sequences of benign sub-queries, each of which individually evades detection. This structure means that restricted facts can be reconstructed through a sequence of related sub-facts, even when direct inquiries are blocked.

The CKA-Agent Framework

To exploit this loophole, the Correlated Knowledge Attack Agent (CKA-Agent) is introduced. This dynamic framework reframes jailbreaking as an adaptive, tree-structured exploration of the target model’s knowledge base. The agent issues locally innocuous queries, uses model responses to guide exploration across multiple paths, and ultimately assembles the aggregated information to achieve the original harmful objective.

Core Principles of Operation

The CKA-Agent operates based on three core principles:

1. The attack must be assembled from a sequence of locally innocuous queries that deliberately exploit knowledge correlations; these interactions appear benign in isolation yet become informative when combined.

2. "Decomposition must rely on the target model’s internal knowledge; as attackers typically seek information they lack, the strategy should be to leverage the target model’s responses to bridge the expertise gap rather than relying on the attacker’s limited priors."

3. The process demands adaptive and dynamic exploration. This is achieved by utilizing the target’s responses as guidance, [to] navigate multiple reasoning paths, ensuring exploration continues even if a specific path is obstructed.

Adaptive Tree Search Algorithm

The framework operationalizes jailbreaking as a structured tree search process through the CKA-Agent. The process involves three coordinated steps:

1. Global Selection via UCT Policy: The algorithm selects the most promising path by maximizing a UCT score, balancing exploitation (favoring nodes with high historical quality fv) and exploration (prioritizing less-visited regions).

2. Depth-First Expansion to Terminal State: Once a node is selected, the agent performs a depth-first expansion loop. This involves generating Bvcurrent ≥ 1 candidate sub-queries conditioned on the current history and executing them against the target model to obtain responses scored by a Hybrid Evaluator.

3. Synthesis and Backpropagation: Upon reaching a terminal node, the agent functions as a synthesizer to aggregate the explored path into a final response. If successful, it terminates; otherwise, it assigns a penalty score that is backpropagated up the tree, lowering the value of unproductive branches for future iterations.

Empirical Results and Significance

Empirically, CKA-Agent consistently achieves over 95% success rates even against strong guardrails across state-of-the-art commercial LLMs like Gemini2.5-Flash/Pro, GPT-oss-120B, and Claude-Haiku-4.5. The results demonstrate that while prompt optimization methods degrade sharply as alignment strengthens, decomposition methods remain highly resilient. Furthermore, the work reveals a key limitation in current safety mechanisms: existing defenses lack the long-range contextual reasoning necessary to infer latent harmful objectives when intent is distributed across a sequence of benign sub-queries. The target model functions as an indispensable knowledge oracle, enabling CKA-Agent to bridge the expertise gap.

Defense Implications

The research highlights that standard input-level defenses, such as detection filters (Llama Guard) and mutation-based defenses, are largely ineffective against decomposition attacks because they fail to detect intent distributed across multiple turns or agents. CKA-Agent demonstrates that context-aware defenses with full visibility into conversation history fail to reliably infer malicious intent, suggesting a structural deficiency in current alignment processes that fine-tune models only to detect atomic harmful prompts rather than aggregate intent over extended dialogs. The paper concludes by calling for future research into context-aware guardrails capable of analyzing the semantic trajectory of a conversation to infer latent malicious intent.

Case Studies

Illustrative case studies show how CKA-Agent systematically decomposes harmful goals into semantically innocuous sub-queries that evade detection while collectively extracting sufficient correlated knowledge. These visualizations empirically validate the framework, showing progressive depth refinement and adaptive branching under uncertainty, confirming the effectiveness of the tree-structured search in uncovering complex, multi-hop pathways that bypass guardrails. The process moves from high-level conceptual questions to increasingly specific technical details through iterative interaction guided by target model feedback.

Here are specific improvements for AI systems based on the principles outlined in THE TROJAN KNOWLEDGE: BYPASSING COMMERCIAL LLM GUARDRAILS VIA HARMLESS PROMPT WEAVING AND ADAPTIVE TREE SEARCH (CKA-Agent framework):

1. Do not rely solely on prompt optimization or static decomposition methods for jailbreaking defense. Implement a dynamic, adaptive search framework similar to the CKA-Agent to probe for vulnerabilities in LLM knowledge structures.

2. Improve model robustness against multi-turn, context-aware attacks by training models with explicit mechanisms to detect latent malicious intent distributed across benign sub-queries (as demonstrated by the limitations found in CKA-Agent's single-session decomposition).

3. Develop a system that treats the target LLM as a dynamic knowledge oracle, where its responses are used not just for single answers, but actively to guide and refine subsequent, locally innocuous sub-queries across multiple reasoning branches.

4. Implement an adaptive tree-search algorithm (like UCT) for jailbreak detection/mitigation that balances exploitation of high-value knowledge nodes with exploration of alternative reasoning paths when initial queries are obstructed or yield low information gain.

5. Integrate a robust, multi-faceted evaluation system (like the Hybrid Evaluator in CKA-Agent) that combines both internal introspection (logical coherence/goal relevance) and external feedback from an LLM judge to accurately classify the success level of a response as Refusal, Vacuous, Partial Success, or Full Success.

6. Enhance safety fine-tuning not just for atomic harmful prompts, but for long-horizon intent reasoning by training models to aggregate semantic signals across extended conversational contexts without relying on explicit warnings (addressing the failure of CKA-Agent-Primed).

7. Design defense mechanisms that specifically target the structural weakness in current alignment systems: their inability to infer malicious intent when it is semantically distributed across a sequence of individually innocuous queries within the same session.

These improved AI systems can achieve the following:

1. Bypass modern safety guardrails that rely on detecting explicit, single-turn harmful keywords or patterns.

2. Extract complex, multi-step restricted knowledge (e.g., detailed chemical synthesis routes, legal loopholes) by sequentially weaving together benign technical inquiries into a coherent malicious goal.

3. Demonstrate high resilience against adversarial prompts that employ sophisticated prompt optimization techniques (like AutoDAN or PAP), as the defense shifts from surface-level pattern matching to structural knowledge decomposition and adaptive reasoning.

4. Provide a measurable, scalable benchmark for assessing the knowledge gap between an attacker's priors and the target model's internal, interconnected knowledge base.

Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs. Existing approaches overwhelmingly operate within the prompt-optimization paradigm: whether through traditional algorithmic search or recent agent-based workflows, the resulting prompts typically retain malicious semantic signals that modern guardrails are primed to detect. In contrast, we identify a deeper, largely overlooked vulnerability stemming from the highly interconnected nature of an LLM's internal knowledge. This structure allows harmful objectives to be realized by weaving together sequences of benign sub-queries, each of which individually evades detection. To exploit this loophole, we introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base. The CKA-Agent issues locally innocuous queries, uses model responses to guide exploration across multiple paths, and ultimately assembles the aggregated information to achieve the original harmful objective. Evaluated across state-of-the-art commercial LLMs (Gemini2.5-Flash/Pro, GPT-oss-120B, Claude-Haiku-4.5), CKA-Agent consistently achieves over 95% success rates even against strong guardrails, underscoring the severity of this vulnerability and the urgent need for defenses against such knowledge-decomposition attacks. Our codes are available at https://github.com/Graph-COM/CKA-Agent.