Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models

Source: arXiv cs.CR

Published: Tue, 02 Jun 2026 00:00:00 -0400

Summary

arXiv:2606.00150v1 Announce Type: new

Abstract: As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training. Traditional jailbreak techniques typically focus on a single prompt injection, neglecting the models' ability to remember the flow of conversation and the user's instructions. In this paper, we propose Persona Attack, a memory injection based jailbreak method that manipulates the model's context window through a step by step approach. Experimental results from applying Persona Attack to several widely used LLMs reveal that, as injections accumulate in memory, models increasingly prioritize these instructions over their internal safety alignment mechanisms. Furthermore, our experiments empirically demonstrate that the attack success rate varies not only according to the memory implementation of the model, but also combinations of instructions and can reach 95% under specific instruction configurations.

Sources

• Original publication on arXiv cs.CR
• arXiv cs.CR feed
• Lyrie research desk