TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

1. Problem Definition

The paper addresses the critical vulnerability of Large Language Models (LLMs) to decompositional jailbreaks. Unlike traditional attacks that attempt to bypass safety filters within a single prompt, decompositional attacks fragment a malicious objective (e.g., "how to build a bomb") into a sequence of individually benign, semantically disjoint sub-queries (e.g., "properties of explosives," "chemical reactions").

Key Challenges:

• Stateless Limitations: Existing defenses (e.g., standard guardrails) evaluate prompts in isolation. Since individual fragments appear safe, these defenses fail to detect the cumulative malicious intent.
• Untraceable Traffic: In real-world deployments, attackers can distribute fragments across multiple anonymous sessions, IP addresses, or user accounts. Defenses relying on user metadata (session IDs, IPs) to track conversation history are easily circumvented.
• Semantic Gap: Fragments of the same malicious intent often share negligible semantic similarity (e.g., "wiring" vs. "fertilizer"), making them difficult to cluster using standard embedding models.
• Operational Overhead: Existing stateful solutions often rely on heavy generative models for real-time context analysis, introducing prohibitive latency and computational costs unsuitable for high-throughput production environments.

2. Methodology: TwinGate

TwinGate is a stateful, dual-encoder defense framework designed to operate without user metadata, relying purely on semantic analysis of a continuous, untraceable request stream.

A. Core Architecture

The system employs two parallel encoders and a global vector repository:

1. ACL-Finetuned Encoder (Intent Vector): Uses Asymmetric Contrastive Learning (ACL) to map queries into a latent space organized by malicious intent rather than surface semantics. It clusters semantically disparate fragments of the same attack into tight groups.
2. Frozen Encoder (Semantic Vector): A pre-trained, frozen encoder that captures literal surface meaning. It acts as a conservative anchor to prevent false positives on benign, repetitive queries.
3. Global Vector Repository: Stores historical request vectors (both semantic and intent) for stateful retrieval.

B. Asymmetric Contrastive Learning (ACL)

Standard contrastive learning clusters similar items together. ACL introduces an asymmetry:

• Positive Attraction: All fragments derived from a single malicious intent (and the original intent itself) are pulled together into a dense cluster.
• Negative Repulsion: Benign queries act only as negative samples. They push malicious clusters away but are not clustered among themselves. This preserves the natural manifold of benign traffic while isolating malicious intent.
• Training Strategy: The model is trained on a massive dataset where the original malicious intent serves as a "dense anchor" for its decomposed fragments, bridging the semantic gap.

C. Two-Stage Decision Logic

To balance sensitivity and precision, TwinGate uses a cascaded decision process:

1. Stage 1: Semantic Equivalence Inheritance (FPR Control):
   • The system first checks if the incoming query is semantically identical to a previously adjudicated request using the Frozen Encoder.
   • If a match is found (similarity > $\tau_{sem}$), the system inherits the previous decision (e.g., if the previous benign query was allowed, this one is too). This bypasses the ACL check entirely, ensuring high-frequency benign queries do not trigger false alarms.
2. Stage 2: Intent-Based Attack Detection:
   • If the query is novel, the ACL Encoder generates an intent vector.
   • The system queries the vector database for the maximum similarity to historical malicious clusters.
   • If the similarity exceeds the intent threshold ($\tau_{int}$), the request is blocked.

D. System Implementation

• Hardware-Aware Pipeline: Designed for 4x NVIDIA A100 GPUs. It uses NVLink for zero-copy data transfer between encoders and in-memory vector databases (HBM), avoiding PCIe bottlenecks.
• Asynchronous Processing: Decouples I/O from neural computation, allowing the defense to run in parallel with the target LLM's prefill phase with negligible latency.

3. Key Contributions

1. Novel Threat Model: First formal definition and study of defending against decompositional jailbreaks in untraceable traffic (no metadata), a practically significant but previously unexplored challenge.
2. TwinGate Framework: A stateful dual-encoder mechanism that identifies cumulative malicious intent without relying on user identity, utilizing ACL to bridge the semantic gap between fragmented attacks.
3. Large-Scale Dataset: Construction of a comprehensive benchmark containing 3.62 million instructions, including:
   • 8,600 distinct malicious intents.
   • 250k benign intents (with decompositions).
   • 603k independent benign queries.
   • Data generated by multiple "splitter" models to ensure robustness against diverse decomposition strategies.
4. Theoretical Bounds: Provided geometric and computational proofs (Theorems 1 & 2) demonstrating that adaptive evasion attacks are computationally intractable due to the spherical packing limits of the latent space and the exponential search cost required to bypass historical constraints.

4. Experimental Results

Evaluated on the constructed dataset under a strictly causal protocol (no future context):

• Security Performance:
  • Malicious Intent Recall: > 0.76 (detects the attack chain).
  • False Positive Rate (FPR): < 0.2% ($2 \times 10^{-3}$), significantly lower than baselines.
  • Adaptive Robustness: Against white-box adaptive attacks (including GCG optimization and semantic rewriting), the Attack Success Rate (ASR) dropped from ~0.99 (no defense) to 0.18.
• Performance & Scalability:
  • Throughput: Sustains >1,700 QPS (Queries Per Second), roughly 10x higher than 7B-parameter baseline guardrails.
  • Latency: Maintains a $P_{99}$ latency of < 300ms, allowing it to run transparently within the LLM's prefill phase.
  • Database Scalability: A single 40GB GPU can robustly handle 6 million historical requests with sub-linear latency growth.
• Ablation Studies:
  • Removing the Frozen Encoder caused FPR to skyrocket due to repeated benign queries being flagged.
  • Removing ACL (using symmetric contrastive learning or raw encoders) resulted in a collapse of recall, proving the necessity of intent-specific clustering.
  • The system showed strong zero-shot generalization against unseen decomposer models.

5. Significance

TwinGate represents a paradigm shift in LLM safety, moving from static, single-turn filtering to dynamic, stateful semantic monitoring that is viable for production.

• Practicality: It solves the "stateless vs. stateful" trade-off by achieving stateful detection without the computational overhead of generative models or the privacy risks of metadata tracking.
• Scalability: Its hardware-aware design and vector-retrieval approach make it the first defense capable of handling high-throughput, untraceable traffic streams in real-time.
• Robustness: It effectively neutralizes sophisticated decompositional attacks that previously evaded all known defenses, establishing a new benchmark for adversarial robustness in LLMs.