{"id":"https://openalex.org/W7154271842","doi":"https://doi.org/10.48550/arxiv.2604.11309","title":"The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems","display_name":"The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems","publication_year":2026,"publication_date":"2026-04-13","ids":{"openalex":"https://openalex.org/W7154271842","doi":"https://doi.org/10.48550/arxiv.2604.11309"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.11309","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11309","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.11309","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133554084","display_name":"Yihao Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yihao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133620649","display_name":"Kai Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Kai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102867564","display_name":"Jiangrong Wu","orcid":"https://orcid.org/0009-0004-9798-3329"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Jiangrong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133599340","display_name":"Haolin Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Haolin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133609550","display_name":"Yuxuan Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Yuxuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133554310","display_name":"Zeming Wei","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wei, Zeming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052115680","display_name":"Dongxian Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Dongxian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133624483","display_name":"Xun Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Xun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133571054","display_name":"Jun Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133568602","display_name":"Meng Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Meng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7379000186920166,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7379000186920166,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.04439999908208847,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.031199999153614044,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.5935999751091003},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.569599986076355},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.5351999998092651},{"id":"https://openalex.org/keywords/slicing","display_name":"Slicing","score":0.521399974822998},{"id":"https://openalex.org/keywords/chaining","display_name":"Chaining","score":0.365200012922287},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.28519999980926514}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7145000100135803},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.6639999747276306},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.5935999751091003},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.569599986076355},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5605999827384949},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.5351999998092651},{"id":"https://openalex.org/C2776190703","wikidata":"https://www.wikidata.org/wiki/Q488148","display_name":"Slicing","level":2,"score":0.521399974822998},{"id":"https://openalex.org/C49020025","wikidata":"https://www.wikidata.org/wiki/Q1059099","display_name":"Chaining","level":2,"score":0.365200012922287},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.28519999980926514},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.11309","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11309","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.11309","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11309","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7797026634216309,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"face":[4],"prominent":[5],"security":[6,18],"risks":[7,219],"from":[8,52],"jailbreaking,":[9],"a":[10,186,200],"practice":[11],"that":[12,56,113],"manipulates":[13],"models":[14,66,162],"to":[15,77,123,148,189,228],"bypass":[16],"built-in":[17],"constraints":[19],"and":[20,36,80,152,163,173,223],"generate":[21],"unethical":[22],"or":[23],"unsafe":[24],"content.":[25],"Among":[26],"various":[27],"jailbreak":[28,31,49,209],"techniques,":[29],"multi-turn":[30,48,208,221],"attacks":[32,94],"are":[33],"more":[34,68],"covert":[35],"persistent":[37],"than":[38],"single-turn":[39],"counterparts,":[40],"exposing":[41],"critical":[42,214],"vulnerabilities":[43],"of":[44,204,220],"LLMs.":[45],"However,":[46],"existing":[47],"methods":[50],"suffer":[51],"two":[53],"fundamental":[54],"limitations":[55],"affect":[57],"the":[58,191,217],"actual":[59],"impact":[60],"in":[61],"real-world":[62,180],"scenarios:":[63],"(a)":[64],"As":[65],"become":[67],"context-aware,":[69],"any":[70],"explicit":[71],"harmful":[72,121],"trigger":[73,125],"is":[74],"increasingly":[75],"likely":[76],"be":[78],"flagged":[79],"blocked;":[81],"(b)":[82],"Successful":[83],"final-step":[84],"triggers":[85],"often":[86],"require":[87],"finely":[88],"tuned,":[89],"model-specific":[90],"contexts,":[91],"making":[92],"such":[93],"highly":[95],"context-dependent.":[96],"To":[97],"fill":[98],"this":[99,137],"gap,":[100],"we":[101,139],"propose":[102],"\\textit{Salami":[103],"Slicing":[104],"Risk},":[105],"which":[106],"operates":[107],"by":[108,194],"chaining":[109],"numerous":[110],"low-risk":[111],"inputs":[112],"individually":[114],"evade":[115],"alignment":[116,181],"thresholds":[117],"but":[118],"cumulatively":[119],"accumulate":[120],"intent":[122],"ultimately":[124],"high-risk":[126],"behaviors,":[127],"without":[128],"heavy":[129],"reliance":[130],"on":[131,136,171],"pre-designed":[132],"contextual":[133],"structures.":[134],"Building":[135],"risk,":[138],"develop":[140],"Salami":[141,192],"Attack,":[142],"an":[143],"automatic":[144],"framework":[145],"universally":[146],"applicable":[147],"multiple":[149],"model":[150],"types":[151],"modalities.":[153],"Rigorous":[154],"experiments":[155],"demonstrate":[156],"its":[157],"state-of-the-art":[158],"performance":[159],"across":[160],"diverse":[161],"modalities,":[164],"achieving":[165,199],"over":[166],"90\\%":[167],"Attack":[168,193],"Success":[169],"Rate":[170],"GPT-4o":[172],"Gemini,":[174],"as":[175,177],"well":[176],"robustness":[178],"against":[179,206],"defenses.":[182],"We":[183],"also":[184],"proposed":[185],"defense":[187],"strategy":[188],"constrain":[190],"at":[195],"least":[196],"44.8\\%":[197],"while":[198],"maximum":[201],"blocking":[202],"rate":[203],"64.8\\%":[205],"other":[207],"attacks.":[210],"Our":[211],"findings":[212],"provide":[213],"insights":[215],"into":[216],"pervasive":[218],"jailbreaking":[222],"offer":[224],"actionable":[225],"mitigation":[226],"strategies":[227],"enhance":[229],"LLM":[230],"security.":[231]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-15T00:00:00"}