Traditional LLM security relies on stateless, single-turn prompt inspection, which fails against advanced multi-turn decomposition attacks. These adversaries fragment prohibited intent into a sequence of benign-looking sub-tasks to circumvent safety filters. The CoopGuard framework addresses this vulnerability by transitioning from reactive filtering to a proactive, stateful cooperative multi-agent architecture. By utilizing specialized agents for pacing, ambiguity, and forensics, the system tracks conversational context to identify evolving malicious patterns, significantly increasing the economic and computational cost for attackers while providing high-fidelity defense through active misdirection.

• Threat Model/Vulnerability Overview
  • Shift from single-turn prompt injection to sophisticated, multi-turn "evolving" attacks.
  • Ineffectiveness of stateless safety filters that evaluate individual prompts in isolation.
  • Emergence of adversarial strategies that iteratively refine intent across multiple conversational turns.
• Attack Mechanics/Exploitation Vector
  • Multi-turn decomposition: Fragmenting harmful goals into a chain of seemingly innocent sub-tasks.
  • Exploitation of the context vacuum in traditional guardrails to bypass safety mechanisms.
  • Testing of eight distinct attack categories via the EMRA benchmark dataset (5,200 samples).
• Systemic & Security Impact
  • 69% average reduction in Attack Success Rate (ASR) compared to state-of-the-art baselines.
  • Over 6x increase in Deception Rate (DR) compared to current strongest existing baselines.
  • 198.83% average increase in attacker token consumption, raising the economic barrier for adversaries.
• Countermeasures/AI Alignment
  • Deployment of the CoopGuard framework, a proactive multi-agent cooperative system.
  • Use of a Pacing Agent to increase the temporal cost and latency of an attack.
  • Employment of an Ambiguity Agent to provide deceptive outputs that mislead attackers.
  • Implementation of a Forensic Agent to analyze interaction logs for evolving threat patterns.
• Conclusion
  • Necessity of moving from passive LLM targets to active, stateful defensive architectures.
  • Growing importance of context-aware guardrails in production-scale LLM environments.
  • Strategic shift toward increasing the computational and resource-based cost of AI exploitation.