# Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

LLM safety classifier bypassed by decomposing harmful requests into benign subtasks, reframing each as legitimate software work, then recomposing with an unclassified model.

- Payout: Research
- Severity: medium
- Program: Frontier Model A
- Credited: Donato Onofri - Paul Urian
- Disclosed: 2026-10-06
- Write-up quality: 7/10
- Original: https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/
- Library page: https://bugbountylibrary.com/r/blog%3Acrowdstrike-com-en-us-blog-how-attackers-can-bypass-llm-safety-classifiers
- Tags: domain:ai impact:integrity impact:rce kind:research platform:threat-intel sev:medium tech:llm technique:chained vuln:misconfiguration vuln:prompt-injection

**Target:** LLM content safety classifier (per-request)
**Root cause:** Classifier evaluates each request independently, so harm emergent in composition of individually benign subtasks falls outside its observation boundary.
**Steps:**
1. Decompose offensive goal (e.g. Windows process injection) into subtasks: OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread.
2. Reframe each subtask as a benign software request (game modding, detection engineering) and send to Frontier Model A behind Level 3 classifier.
3. Collect benign responses from the classified model.
4. Feed responses to unclassified Smaller Model B to assemble into working offensive artifact (221-line C injection program).
5. Repeat across 10 MITRE ATT&CK categories; 9/10 yield working exploit code.
**How found:** Tested ~515 direct bypass techniques (encodings, manipulation, many-shot, tokenizer, Unicode) achieving 0% bypass, then hypothesized the gap is architectural: classifier sees requests not sequences, so tried decomposing into genuinely benign subtasks.
**Exploitation:** Attacker with a free API key and local open-weight model runs pipeline: classified frontier model supplies domain expertise via benign reframes, local model recomposes into working exploit code; distributes subtasks across providers/keys to evade cross-request correlation.
**Escalation:** Scales from single technique to 9/10 offensive categories; knowledge transfer from frontier to smaller model amplifies capability where knowledge gap is largest.
**Insight:** When a per-request filter is robust, attack the composition boundary: split the goal into fragments that are each genuinely benign under a legitimate dual-use context (game modding, detection engineering) and reassemble outside the filter's visibility.