Multi-Turn Jailbreak Attacks

Follow this topic Ask about this topic

Multi-turn jailbreak research studies how attackers use conversation history to make harmful requests seem benign, build persuasive context, or divide a task into seemingly safe steps. Common approaches include simulated dialogue, psychological persuasion, evolutionary search, and reinforcement learning, evaluated on harmful-behavior benchmarks and in medical, multimodal, and tool-using settings. Defenses range from turn-level monitors and cumulative-risk scoring to classifiers, provenance tracking, and response rewriting. A central tension is that single-turn checks miss risks that emerge over time, while earlier intervention can increase false alarms or constrain useful responses; evaluation also depends on reliable judges and comparable attack budgets.

Latest papers

31 papers4 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy
Oct 26, 2026Mingqian Feng, Xiaodong Liu, Weiwei Yang +7Adversarial Attacks on LLMs Jailbreak Attacks
University of Rochester · Microsoft Research
$M^3$ : A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process
Oct 22, 2026Yuqing Huang, Jack Ji, Jithin Pradeep +2Adversarial Attacks on LLMs Multi-Turn Jailbreak Attacks
The Vanguard Group∗
Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks
Oct 16, 2026Zhipeng Wei, Michael Lee, N. Benjamin ErichsonMulti-Turn Jailbreak Attacks Jailbreak Attack Evaluation
International Computer Science Institute · UC Berkeley · DSO National Laboratories +1
ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs
Oct 12, 2026Md Mushfiqur Rahman, Tobias Rohde, Rahul Tripathi +2LLM Jailbreak Attacks LLM Red Teaming
George Mason University · Amazon
The Geometry of Harmfulness in Multi-Turn Attacks
Sep 29, 2026Yelyzaveta, Husieva, Lauren AlvarezAdversarial Attacks on LLMs LLM Safety
Lisa · Applied AI Research TELUS Digital Charlottesville, VA 22902
Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking
Sep 2, 2026Siyu Chen, Haoran Wang, Xiaojian Li +3Multi-Turn Jailbreak Attacks LLM Safety Evaluation
1AI4S Center, Shanghai Qi Zhi Institute, Shanghai, 200232, China · College of AI, Tsinghua University, Beijing, 100083, China · 3Fangcun AI, Beijing, 100084, China +1
EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities
Aug 31, 2026Feitong Qiao, Liren Peng, Shiming Ren +7Language Model Safety Evaluation LLM Red Teaming
Reinforce Labs USA
PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies
Aug 24, 2026Zeyu Feng, Qingyu Wu, Yuzhe Luo +1Jailbreak Attacks Adversarial Attacks on LLMs
The Defense Innovation Institute, Academy of Military Sciences, Beijing, China
MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment
Jul 13, 2026Junyoung Park, Namgyu Park, Sechan Lee +3RL for Language Models LLM Jailbreak Attacks
POSTECH GSAI · Samsung SDS · POSTECH GSAI & CSE
ANCHOR: Automated Alignment Auditing for CLI Agents on Real-World Harm
Jul 11, 2026Kefan Song, Yanjun QiAI Agent Auditing LLM Auditing
University of Virginia, Charlottesville, VA, USA
Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations
Jun 19, 2026Chenhui Hu, Muhammed Salih, Sudipto Guha +1Transformer Multi-Turn Jailbreak Attacks
Zscaler, Inc.
Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps
Jun 8, 2026Xiaofeng Lin, Yukai Yang, Daniel Guo +3Jailbreak Attacks LLM Agent Security
University of California, Los Angeles, USA · 2Computer Science and Engineering Department, Texas A&M University, USA · 3Cisco, USA +1
THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models
Jun 1, 2026Zhiqing Ma, Zhonghao Xu, Dong Yu +3LLM Safety Multi-Turn Jailbreak Attacks
1Beijing Language and Culture University · †Corresponding authors
D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting
May 31, 2026Huanli Gong, Zhipeng Wei, Yu Fu +4LLM Guardrails Multi-Turn Jailbreak Attacks
University of California, Berkeley · International Computer Science Institute · University of California, Riverside +1
MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety
May 30, 2026Anushka Sheoran, Yiduo HaoLanguage Model Safety Evaluation Adversarial Attacks on LLMs
University of Pennsylvania
Evolving and Detecting Multi-Turn Deception using Geometric Signatures
May 26, 2026Surender Suresh Kumar, Mary L. CummingsAdversarial Prompt Generation Deception in Language Models
George Mason University Fairfax, USA
BAIT: Boundary-Guided Disclosure Escalation LLM Jailbreaking via Self-Conditioned Reasoning
May 26, 2026Xuan Luo, Yue Wang, Geng Tu +2Jailbreak Attacks LLM Safety
The Harbin Institute of Technology, Shenzhen, China · The Hong Kong Polytechnic University, Hong Kong, China · Shenzhen University, Shenzhen, China +1
MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks
May 10, 2026Xinkai Zhang, Zhipeng Wei, Huanli Gong +4Language Model Safety Evaluation Jailbreak Attacks
1UC Berkeley · 3International Computer Science Institute · 2UC Riverside +1
Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking
May 9, 2026Zhida He, Xiaoyu Wen, Han Qi +7RL for Language Models Credit Assignment in RL
Shanghai AI Laboratory · Fudan University · Shanghai Jiao Tong University
Mitigating Many-shot Jailbreak Attacks with One Single Demonstration
May 8, 2026Kejia Chen, Jiawen Zhang, Boheng Li +6Jailbreak Attacks In-Context Learning
Zhejiang University · Nanyang Technological University · University of Science and Technology of China +2
One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent
May 7, 2026Xinjie Shen, Rongzhe Wei, Peizhi Niu +6Language Model Safety Evaluation LLM Guardrails
Georgia Institute of Technology · University of Illinois Urbana-Champaign · UCSD +3
ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming
May 4, 2026Mario Rodríguez Béjar, Francisco J. Cortés-Delgado, S. Braghin +1Evolutionary Optimization LLM Red Teaming
Universidad de Murcia · IBM Research
MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
May 3, 2026Jialin Song, Xiaodong Liu, Weiwei Yang +4LLM Safety Benchmarks Adversarial Prompt Generation
Simon Fraser University · Microsoft Research
Jailbreaking Frontier Foundation Models Through Intention Deception
Apr 27, 2026Xinhe Wang, Katia Sycara, Yaqi XieJailbreak Attacks LLM Safety
Carnegie Mellon University
Transient Turn Injection: Exposing Stateless Multi-Turn Vulnerabilities in Large Language Models
Apr 23, 2026Naheed Rayhan, Sohely JahanLanguage Model Safety Evaluation Adversarial Attacks on LLMs
Jagannath University · University of Barishal
SafeDream: Safety World Model for Proactive Early Jailbreak Detection
Apr 18, 2026Bo Yan, Weikai Lin, Yada Zhu +1Language Model Safety Evaluation World Models
University of Central Florida · University of Rochester · IBM Research
The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems
Apr 13, 2026Yihao Zhang, Kai Wang, Jiangrong Wu +7LLM Security LLM Jailbreak Attacks
School of Mathematical Sciences, Peking University · Sun Yat-sen University · Wuhan University +3
ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models
Mar 10, 2026Harry Owiredu-AshleyLanguage Model Safety Evaluation Adversarial Attacks on LLMs
Independent Researcher, New Jersey, United States
MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models
Mar 3, 2026Zhongxi Wang, Yueqian Lin, Jingyang Zhang +3LLM Safety Benchmarks LLM Safety
1Duke University · 2Virtue AI
Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks
Oct 16, 2025Trilok Padhi, Pinxian Lu, Abdulkadir Erol +5Adversarial Attacks on LLMs AI Agent Security Benchmarks
1Georgia State University · 2Georgia Institute of Technology · University of California, Berkeley

Oct 26, 2026J/K move · Enter open · S save

SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy

Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu+6

University of Rochester · Microsoft Research

Adversarial Attacks on LLMs Jailbreak Attacks LLM Jailbreak Attacks Multi-Turn Jailbreak Attacks Jailbreak Attack Evaluation

Open paper AskPDF arXiv

Existing jailbreak attackers fall into two classes: static planners fix their single- or multi-turn adversarial plans in advance, remaining simple but losing sight of the victim's replies, wasting turns and limiting transferability; interactive generators read each victim reply to generate the next-turn attack but require in-loop evaluators for success signals or hints, incurring substantial costs and inflated performance. Bridging this gap, we propose SEMA-Auto, a sighted and efficient multi-turn attacker with autonomy, interacting with the victim model and terminating the session by itself upon success. To stabilize its behaviors and boost its capabilities, SEMA-Auto is trained in two stages. Synthetic bootstrap tuning installs the notion of attack targets and conforming decisions by fine-tuning the base model with bootstrapped trajectories. Decision-supervised reinforcement learning then optimizes two objectives jointly yet separately, reinforcing the attack with higher jailbreak reward while supervising the decision at each turn against an absolute target. Our method achieves state-of-the-art (SOTA) attack success rates (ASR) across multiple datasets, victims, and judges, outperforming all static and interactive baselines, within almost the fewest turns, demonstrating both effectiveness and efficiency. For example, SEMA-Auto performs a

76.0\%

ASR@1 within an average of

3.0

turns against DeepSeek-V4-Flash on AdvBench, while the best static baseline is

54.8\%

with fixed

7

turns and the best interactive baseline is

43.8\%

3.7

turns. Against safety-hardened frontier models, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, and GPT-6-Astra, our counter-trained attacker achieves an average

59.6\%

ASR@1 on HarmBench,

13.8\%

over prior SOTA. Our code is available at: https://github.com/microsoft/SEMA