mlsanityData to 7 Oct 2026

Foot In The Door: Understanding Large Language Model Jailbreaking via Cognitive Psychology

arXiv 2402.15690 ↗First posted 24 Feb 2024cs.CL cs.AIcited by 25

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs) have gradually become the gateway for people to acquire new knowledge. However, attackers can break the model's security protection ("jail") to access restricted information, which is called "jailbreaking." Previous studies have shown the weakness of current LLMs when confronted with such jailbreaking attacks. Nevertheless, comprehension of the intrinsic decision-making mechanism within the LLMs upon receipt of jailbreak prompts is noticeably lacking. Our research provides a psychological explanation of the jailbreak prompts. Drawing on cognitive consistency theory, we argue that the key to jailbreak is guiding the LLM to achieve cognitive coordination in an erroneous direction. Further, we propose an automatic black-box jailbreaking method based on the Foot-in-the-Door (FITD) technique. This method progressively induces the model to answer harmful questions via multi-step incremental prompts. We instantiated a prototype system to evaluate the jailbreaking effectiveness on 8 advanced LLMs, yielding an average success rate of 83.9%. This study builds a psychological perspective on the explanatory insights into the intrinsic decision-making logic of LLMs.

Key facts. Cited by 25 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 14 of its 34 references that are in the map. First posted on arXiv 24 Feb 2024.

Builds on

14 of 34 references.

Closest ancestors · 6

Same direction, newest first

  1. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  2. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  3. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  5. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul
  6. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study23 May

Other references · 8

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  2. 2022Locating and Editing Factual Associations in GPTcited by 2,609
  3. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  4. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 673
  5. 2022Using Large Language Models to Simulate Multiple Humans and Replicate Human Subject Studiescited by 506
  6. 2022Emergent World Representations: Exploring a Sequence Model Trained on a Synthetic Taskcited by 417
  7. 2023Large Language Models Understand and Can be Enhanced by Emotional Stimulicited by 143
  8. 2023Rethinking Machine Ethics -- Can LLMs Perform Moral Reasoning through the Lens of Moral Theories?cited by 36

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 8; 2025: 12; 2026: 5.

25 papers.

Sort:

By area:

  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  2. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 185
  3. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  4. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
  5. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMscited by 50
  6. 2024garak: A Framework for Security Probing Large Language Modelscited by 48
  7. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
  8. 2024MoGU: A Framework for Enhancing Safety of Open-Sourced LLMs While Preserving Their Usabilitycited by 14
  9. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroringcited by 10
  10. 2024Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysiscited by 9
  11. 2024Toward Secure Tuning: Mitigating Security Risks from Instruction Fine-Tuningcited by 8
  12. 2025Amplified Vulnerabilities: Structured Jailbreak Attacks on LLM-based Multi-Agent Debatecited by 8
13 more
  1. 2025Anchoring Refusal Direction: Mitigating Safety Risks in Tuning via Projection Constraintcited by 6
  2. 2026State-Dependent Safety Failures in Multi-Turn Language Model Interactioncited by 4
  3. 2025How Do LLMs Persuade? Linear Probes Can Uncover Persuasion Dynamics in Multi-Turn Conversationscited by 3
  4. 2025AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agentscited by 3
  5. 2026Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMscited by 3
  6. 2025When Testing AI Tests Us: Safeguarding Mental Health on the Digital Frontlinescited by 2
  7. 2025Exploiting Synergistic Cognitive Biases to Bypass Safety in LLMscited by 2
  8. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  9. 2025MoGU V2: Toward a Higher Pareto Frontier Between Model Usability and Securitycited by 1
  10. 2025Casting a SPELL: Sentence Pairing Exploration for LLM Limitation-breakingcited by 1
  11. 2026TrojanPraise: Jailbreak LLMs via Benign Fine-Tuningcited by 1
  12. 2026Multilingual jailbreaking of LLMs using low-resource languagescited by 1
  13. 2026Door-in-the-Face Requests and Refusal Behaviour in Large Language Modelscited by 0