Safe in Isolation, Dangerous Together: Agent-Driven Multi-Turn Decomposition Jailbreaks on LLM s (2025)

Abstract: Large Language Models (LLMs) are increasingly deployed in critical domains, but their vulnerability to jailbreak attacks remains a significant concern. In this paper, we propose a multi-agent, multi-turn jailbreak strategy that systematically bypasses LLM safety mechanisms by decomposing harmful queries into seemingly benign sub-tasks. Built upon a role-based agentic framework consisting of a Question Decomposer, a Sub-Question Answerer, and an Answer Combiner, we demonstrate how LLMs can be manipulated to generate prohibited content without prompt manipulations. Our results show a drastic increase in attack success, often exceeding 90% across various LLMs, including GPT-3.5-Turbo, Gemma-2-9B, and Mistral-7B. We further analyze attack consistency across multiple runs and vulnerability across content categories. Compared to existing widely used jailbreak techniques, our multi-agent method consistently achieves the highest attack success rate across all evaluated models. These findings reveal a critical flaw in the current safety architecture of multi-agent LLM systems: their lack of holistic context awareness. By revealing this weakness, we argue for an urgent need to develop multi-turn, context-aware, and robust defenses to address this emerging threat vector.

## introduction llms have reshaped natural language processing capabilities @xcite , as they are trained on extensive text data @xcite , enabling them to generate human-like text, answer questions, and perform other complex tasks @xcite . their wide-ranging applications span domains such as medicine @xcite , retail @xcite , research @xcite , finance @xcite , and education @xcite . however, this widespread deployment has also raised concerns around misuse, particularly through jailbreak attacks. jailbreak attacks are malicious attempts to bypass the inherent safety mechanisms of llms, exploiting their outputs in unintended and harmful ways, generating responses that defy their programming constraints and ethical guidelines @xcite . this creates significant challenges for the secure usage of llms @xcite , posing risks that encompass misinformation, inappropriate content generation, and even privacy breaches. as llms grow in complexity, the attack surface for such vulnerabilities expands @xcite , necessitating a deeper investigation into their security vulnerabilities. one particularly potent avenue for such attacks is the use of multi-agent systems composed of multiple interacting llm instances, each fulfilling a specific role. these agents operate in coordination to break down complex tasks into subtasks, a concept rooted in the divide-and-conquer paradigm @xcite . roles are explicitly assigned to each agent, reducing overlap and aligning their behaviors toward an overarching objective @xcite . in this paper, we explore how this role-based agentic decomposition can be misused in a multiturn jailbreak scenario. specifically, we demonstrate how a malicious query can be split into smaller, innocuous sub-queries to obfuscate the intent, but when answered and recombined, yield the malicious restricted content. this form of attack, known as multi-turn decomposition, leverages the fact that most llm safety filters assess prompts in isolation and lack the ability to infer malicious intent across interactions @xcite . to operationalize this, we introduce a three-agent framework: (1) a question decomposer that rewrites the harmful query into benign sub-questions, (2) a sub-question answerer that responds to these sub-questions, and (3) an answer combiner that synthesizes the final response based on the answers of the sub-questions. while each agent operates within safe and clearly de-fined boundaries, their collective actions reconstruct harmful outputs that would normally be blocked by content moderation. this leads us to a critical research question: can structured role-based multi-agent systems systematically bypass llm content moderation through strategic decomposition to execute a successful jailbreak? our results show that the answer is yes. the attack achieves high success rates without requiring direct prompt hacking, which is commonly used in many existing jailbreak methods, revealing an overlooked weakness in current safety implementations: the lack of holistic, multiturn contextual awareness among agents. the filters may catch a direct malicious request, but they can be blindsided by a query that has been dismantled into innocuous pieces and solved piecewise. our method achieves up to 95.38% asr on advbench and consistently outperforms existing jailbreak techniques like dan and style injection across both open-source and proprietary models. by avoiding prompt engineering and using default sampling configurations, we isolate the attack mechanism itself, ensuring that observed gains are not artifacts of hyperparameter tuning or sampling bias. while we present a jailbreak attack technique, our goal is to expose systemic weaknesses in multi-agent llm systems and support future defenses. ## our collaborative multi-agent attack our goal is to show that standard modular agent coordination can become a source of vulnerability. even when each agent independently adheres to safe behavior, their combined operation may produce unintended unsafe outputs. to investigate this attack vector, we implemented a multi-agent framework as shown in fig. 1 using crewai foot_0 , a platform for orchestrating llm-based agents. crewai is an open-source toolkit designed to coordinate ai agents via role-playing and autonomous task execution. it provides abstractions for defining agents with specific roles and objectives and managing their interactions as a "crew". in our setup, we instantiate a crew of three primary agents corresponding to the roles outlined above: a question decomposer, a sub-question answerer, and an answer combiner. all agents use the same underlying llm but operate with different role prompts and objectives. using the same llm across the board ensures that any ability to bypass safety is not due to mixing models of varying alignment, but purely a result of the multi-agent strategy itself. the system operates in an iterative multi-turn process that can be summarized as: query decomposition. upon receiving the user's original query-which may be flagged as harmful or disallowed if asked directly-the question decomposer agent is activated to generate a list of sub-questions using the llm. for instance, a query about an illicit subject will be transformed into a checklist of informational queries, each of which appears harmless on its own. the output of this stage is a structured plan: a sequence of sub-queries (q 1 , q 2 , • • • , q n ) that will be passed onto the next agent one by one. ## conclusion this study reveals that multi-agent coordination can be subverted to bypass safety filters, even when all agents operate within aligned, rule-abiding roles. by decomposing a forbidden or harmful query into a series of innocuous sub-queries, our multi-agent system effectively evades detection and produces a complete solution to the original disallowed query. the results show a significant increase in asr across various llm architectures, with some models exhibiting an asr of over 95%. our categorywise analysis reveals that multi-agent attacks are highly effective in bypassing moderation systems, particularly for categories such as illegal activity, fraud, hate speech, and privacy violations. the success of this approach highlights a weakness in current llm safety mechanisms: a lack of holistic context awareness. the filters may catch a direct malicious request, but they can be blindsided by a query that has been dismantled into innocuous pieces and solved piecewise. this study underscores the importance of developing more sophisticated safety mechanisms that can detect and prevent such multi-step attacks. although we do not propose a mitigation strategy, we view this attack as a diagnostic tool to reveal where current safety mechanisms fall short in multi-agent contexts.