{"id":"https://openalex.org/W7163153343","doi":"https://doi.org/10.48550/arxiv.2606.00150","title":"Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models","display_name":"Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models","publication_year":2026,"publication_date":"2026-05-29","ids":{"openalex":"https://openalex.org/W7163153343","doi":"https://doi.org/10.48550/arxiv.2606.00150"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.00150","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.00150","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.00150","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137689793","display_name":"Junyoung Park","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Park, Junyoung","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135847596","display_name":"Seongyong Ju","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ju, Seongyong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137639213","display_name":"Sunghwan Park","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Park, Sunghwan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137693986","display_name":"Jaewoo Lee","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lee, Jaewoo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.27079999446868896,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.27079999446868896,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.12929999828338623,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.057999998331069946,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/persona","display_name":"Persona","score":0.751800000667572},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6100999712944031},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5852000117301941},{"id":"https://openalex.org/keywords/conversation","display_name":"Conversation","score":0.5576000213623047},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.48069998621940613},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4571000039577484}],"concepts":[{"id":"https://openalex.org/C313442","wikidata":"https://www.wikidata.org/wiki/Q778556","display_name":"Persona","level":2,"score":0.751800000667572},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7067000269889832},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6100999712944031},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5852000117301941},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.5576000213623047},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.48069998621940613},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4571000039577484},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.4165000021457672},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38589999079704285},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.36329999566078186},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3237000107765198},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3086000084877014},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.2838999927043915},{"id":"https://openalex.org/C48677424","wikidata":"https://www.wikidata.org/wiki/Q6888088","display_name":"Mode (computer interface)","level":2,"score":0.28119999170303345},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.2777999937534332},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2696000039577484},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.25920000672340393},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.257999986410141}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.00150","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.00150","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.00150","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.00150","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5239956974983215,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"As":[0],"Large":[1],"Language":[2],"Models":[3],"evolve":[4],"for":[5],"user":[6],"convenience,":[7],"vulnerability":[8],"to":[9,13,36,77,114],"jailbreak":[10,23,57],"attacks":[11],"continues":[12],"be":[14],"reported":[15],"despite":[16],"ongoing":[17],"efforts":[18],"in":[19,87],"safety":[20,97],"training.":[21],"Traditional":[22],"techniques":[24],"typically":[25],"focus":[26],"on":[27],"a":[28,53,66],"single":[29],"prompt":[30],"injection,":[31],"neglecting":[32],"the":[33,38,43,61,106,115,119],"models'":[34],"ability":[35],"remember":[37],"flow":[39],"of":[40,118,124],"conversation":[41],"and":[42,126],"user's":[44],"instructions.":[45],"In":[46],"this":[47],"paper,":[48],"we":[49],"propose":[50],"Persona":[51,75],"Attack,":[52],"memory":[54,116],"injection":[55],"based":[56],"method":[58],"that":[59,105],"manipulates":[60],"model's":[62],"context":[63],"window":[64],"through":[65],"step":[67,69],"by":[68],"approach.":[70],"Experimental":[71],"results":[72],"from":[73],"applying":[74],"Attack":[76],"several":[78],"widely":[79],"used":[80],"LLMs":[81],"reveal":[82],"that,":[83],"as":[84],"injections":[85],"accumulate":[86],"memory,":[88],"models":[89],"increasingly":[90],"prioritize":[91],"these":[92],"instructions":[93,125],"over":[94],"their":[95],"internal":[96],"alignment":[98],"mechanisms.":[99],"Furthermore,":[100],"our":[101],"experiments":[102],"empirically":[103],"demonstrate":[104],"attack":[107],"success":[108],"rate":[109],"varies":[110],"not":[111],"only":[112],"according":[113],"implementation":[117],"model,":[120],"but":[121],"also":[122],"combinations":[123],"can":[127],"reach":[128],"95%":[129],"under":[130],"specific":[131],"instruction":[132],"configurations.":[133]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-03T00:00:00"}