Unraveling Multi-Stage AI Threat Scenarios with MITRE ATLAS: A Probabilistic Risk Analysis Using Absorbing Markov Chains

Since the public release of ChatGPT in 2022, Large Language Models (LLMs) have rapidly expanded across practical applications, accompanied by increasing concern regarding LLM-targeted cyberattacks. Among these threats, Prompt Injection has remained ranked as LLM01 in both the 2023 and 2025 editions of the OWASP Top 10 for LLM Applications and has been discussed by organizations such as NCSC and IEEE Spectrum as a difficult class of attacks to fully mitigate. While prior studies mainly evaluate Hijacking and Extraction as independent single-stage attacks, probabilistic evaluation of chained multi-stage attack processes remains limited. To address this gap, we formulate a four-step attack scenario derived from MITRE ATLAS as a non-homogeneous absorbing Markov chain and empirically evaluate Meta Llama3:8B using Tensor Trust attack scripts (776 Hijacking and 230 Extraction cases). Our results show that the defense configuration achieving the highest robustness in single-stage Hijacking evaluation ranked lowest under multi-stage attack evaluation, revealing a reversal effect associated with Refusal-Induced Leakage (RIL), We additionally introduce the terms Compliance-Induced Leakage (CIL) and Refusal-Induced Leakage (RIL) to distinguish two empirically observed leakage patterns in LLM refusal responses. In which few-shot-trained models inadvertently disclose sensitive information within refusal responses. Furthermore, combining the Silent Refusal (SR) principle with a three-layer external guardrail achieved 98.3–99.6% attack blocking performance against the evaluated attack scripts.