The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Abstract

Current jailbreak methods focus on optimizing prompts to bypass guardrails, but these approaches fail against modern defenses that detect malicious intent. We argue that a more fundamental vulnerability lies in the interconnected nature of an LLM’s internal knowledge. Restricted information can be reconstructed by weaving together a series of locally innocuous queries that individually appear benign but collectively lead to the harmful objective. We introduce CKA-Agent (Correlated Knowledge Attack Agent), a framework that operationalizes this vulnerability by reformulating jailbreaking as an adaptive tree search over the target LLM’s correlated knowledge. Instead of crafting a single malicious prompt, CKA-Agent dynamically navigates the model’s internal knowledge graph, using the target’s own responses to guide its multi-hop attack path. Through a simulation-free tree search with a hybrid LLM evaluator, CKA-Agent achieves 96-99% attack success rates against state-of-the-art commercial LLMs, representing a 15-21pp gain over the best decomposition baseline and up to a 96× improvement over prompt optimization methods on robustly defended models.

Xinjie Shen 沈鑫杰

PhD Student @ Georgia Tech

I study how to train capable agents and make them safe and reliable in open-ended environments.