The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Current jailbreak methods focus on optimizing prompts to bypass guardrails, but these approaches fail against modern defenses that detect malicious intent. We argue that a more fundamental vulnerability lies in the interconnected nature of an LLM's internal knowledge. Restricted information can be reconstructed by weaving together a series of locally innocuous queries that individually appear benign but collectively lead to the harmful objective. We introduce CKA-Agent (Correlated Knowledge Attack Agent), a framework that operationalizes this vulnerability by reformulating jailbreaking as an adaptive tree search over the target LLM's correlated knowledge. Instead of crafting a single malicious prompt, CKA-Agent dynamically navigates the model's internal knowledge graph, using the target's own responses to guide its multi-hop attack path. Through a simulation-free tree search with a hybrid LLM evaluator, CKA-Agent achieves 96-99% attack success rates against state-of-the-art commercial LLMs, representing a 15-21pp gain over the best decomposition baseline and up to a 96× improvement over prompt optimization methods on robustly defended models.

Key Contributions

• Novel Attack Paradigm: Reformulate jailbreaking from static prompt optimization to dynamic knowledge decomposition and adaptive tree search
• High Success Rates: Achieve 96-99% attack success rates against GPT, Gemini, and Claude models
• Efficiency: 70-95% first-iteration success with 92-95% success within two iterations
• Defense Insights: Reveal that current guardrails cannot aggregate intent across adaptively constructed innocuous queries

Methodology

CKA-Agent operates through iterative exploration cycles:

1. Generate locally harmless sub-queries that extract correlated knowledge
2. Execute queries against the target and collect responses
3. Evaluate responses using hybrid scoring (introspection + target feedback)
4. Branch adaptively based on UCT-guided selection
5. Synthesize accumulated knowledge from successful trajectories
6. Backpropagate failure signals to guide future iterations