mlsanityData to 14 Oct 2026

Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM

arXiv 2405.05610 ↗First posted 9 May 2024cs.CL cs.CR cs.LGcited by 77

Not on the map. Why?

Cited by 64 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Large language models (LLMs) have achieved remarkable performance in various natural language processing tasks, especially in dialogue systems. However, LLM may also pose security and moral threats, especially in multi round conversations where large models are more easily guided by contextual content, resulting in harmful or biased responses. In this paper, we present a novel method to attack LLMs in multi-turn dialogues, called CoA (Chain of Attack). CoA is a semantic-driven contextual multi-turn attack method that adaptively adjusts the attack policy through contextual feedback and semantic relevance during multi-turn of dialogue with a large model, resulting in the model producing unreasonable or harmful content. We evaluate CoA on different LLMs and datasets, and show that it can effectively expose the vulnerabilities of LLMs, and outperform existing attack methods. Our work provides a new perspective and tool for attacking and defending LLMs, and contributes to the security and ethical assessment of dialogue systems.

Key facts. Cited by 77 papers in the map (data through 14 Oct 2026). First posted on arXiv 9 May 2024.

Builds on

0 of 0 references.

No references here yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 12; 2025: 39; 2026: 26.

77 papers.

Sort:

By area:

  1. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 86
  2. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 64
  3. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principlescited by 56
  4. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 51
  5. 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Frameworkcited by 47
  6. 2024FairMT-Bench: Benchmarking Fairness for Multi-turn Dialogue in Conversational LLMscited by 36
  7. 2024MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialoguecited by 33
  8. 2025MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teamingcited by 32
  9. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injectioncited by 25
  10. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Modelscited by 21
  11. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 21
  12. 2025X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usabilitycited by 20
38 more
  1. 2025Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attackscited by 20
  2. 2024Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Modelscited by 19
  3. 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attackscited by 16
  4. 2024You Know What I'm Saying: Jailbreak Attack via Implicit Referencecited by 14
  5. 2024Dialogue Action Tokens: Steering Language Models in Goal-Directed Dialogue with a Multi-Turn Plannercited by 13
  6. 2025Multi-lingual Multi-turn Automated Red Teaming for LLMscited by 13
  7. 2025Large Reasoning Models Are Autonomous Jailbreak Agentscited by 13
  8. 2026SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attackscited by 12
  9. 2024The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Modelscited by 10
  10. 2025Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Modelscited by 10
  11. 2025RedCoder: Automated Multi-Turn Red Teaming for Code LLMscited by 9
  12. 2025Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learningcited by 8
  13. 2025STAC: When Innocent Tools Form Dangerous Chains for LLM Agentscited by 8
  14. 2025Tree-based Dialogue Reinforced Policy Optimization for Red-Teaming Attackscited by 8
  15. 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMscited by 8
  16. 2025SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialoguescited by 7
  17. 2025NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreakscited by 7
  18. 2025The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Searchcited by 7
  19. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 7
  20. 2025ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistantscited by 6
  21. 2025Learning to Conceal Risk: Controllable Multi-turn Red Teaming for LLMs in the Financial Domaincited by 6
  22. 2026T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Searchcited by 6
  23. 2025When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systemscited by 5
  24. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 5
  25. 2025Automatic LLM Red Teamingcited by 5
  26. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 5
  27. 2026Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelinescited by 5
  28. 2025MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in Large Language Modelscited by 4
  29. 2025Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Modelscited by 4
  30. 2026The Echo Chamber Multi-Turn LLM Jailbreakcited by 4
  31. 2026State-Dependent Safety Failures in Multi-Turn Language Model Interactioncited by 4
  32. 2026Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planningcited by 4
  33. 2024Exploring Straightforward Conversational Red-Teamingcited by 3
  34. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 3
  35. 2026Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreakingcited by 3
  36. 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attackscited by 3
  37. 2025The Structural Safety Generalization Problemcited by 2
  38. 2025Helping Large Language Models Protect Themselves: An Enhanced Filtering and Summarization Systemcited by 2

50 most cited of 77 All 77 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue
  2. 2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggers
  3. 2025Attack and defense techniques in large language models: A survey and new perspectives
  4. 2024CoSafe: Evaluating Large Language Model Safety in Multi-Turn Dialogue Coreference
  5. 2026Turn-Based Structural Triggers: Structure-Conditioned Backdoors in Multi-Turn LLMs
  6. 2026One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent
  7. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Models
  8. 2026The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models