Cross-session decomposition attacks exploit scaling laws to bypass safety

Researchers identify cross-session decomposition attacks where benign subqueries are spread across independent sessions to reconstruct forbidden objectives. Larger models in the Qwen3 and Gemma3 families show increased vulnerability as they better recover hidden instructions from injected supporting facts.