mlsanityData to 7 Oct 2026

Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles

arXiv 2408.04686 ↗First posted 8 Aug 2024cs.CL cs.AIcited by 54

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language models (LLMs) have significantly enhanced the performance of numerous applications, from intelligent conversations to text generation. However, their inherent security vulnerabilities have become an increasingly significant challenge, especially with respect to jailbreak attacks. Attackers can circumvent the security mechanisms of these LLMs, breaching security constraints and causing harmful outputs. Focusing on multi-turn semantic jailbreak attacks, we observe that existing methods lack specific considerations for the role of multiturn dialogues in attack strategies, leading to semantic deviations during continuous interactions. Therefore, in this paper, we establish a theoretical foundation for multi-turn attacks by considering their support in jailbreak attacks, and based on this, propose a context-based contextual fusion black-box jailbreak attack method, named Context Fusion Attack (CFA). This method approach involves filtering and extracting key terms from the target, constructing contextual scenarios around these terms, dynamically integrating the target into the scenarios, replacing malicious key terms within the target, and thereby concealing the direct malicious intent. Through comparisons on various mainstream LLMs and red team datasets, we have demonstrated CFA's superior success rate, divergence, and harmfulness compared to other multi-turn attack strategies, particularly showcasing significant advantages on Llama3 and GPT-4.

Key facts. Cited by 54 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 22 of its 34 references that are in the map. First posted on arXiv 8 Aug 2024.

Builds on

22 of 34 references.

Closest ancestors · 12

Same direction, newest first

  1. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing28 May
  2. 2024Can LLMs Deeply Detect Complex Malicious Queries? A Framework for Jailbreaking via Obfuscating Intent6 May
  3. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  4. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  5. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
  6. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers25 Feb
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  8. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  9. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  11. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  12. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 10

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  2. 2023Qwen Technical Reportcited by 3,273
  3. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  4. 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,096
  5. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  7. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  8. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  9. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 213
  10. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 8; 2025: 33; 2026: 13.

54 papers.

Sort:

By area:

  1. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  2. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 112
  3. 2025SafeArena: Evaluating the Safety of Autonomous Web Agentscited by 97
  4. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  5. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  6. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
  7. 2025Safety in Large Reasoning Models: A Surveycited by 58
  8. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMscited by 50
  9. 2025LLM Agents Should Employ Security Principlescited by 28
  10. 2025Accumulating Context Changes the Beliefs of Language Modelscited by 25
  11. 2025The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMscited by 24
  12. 2024Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Modelscited by 23
38 more
  1. 2025FORTRESS: Frontier Risk Evaluation for National Security and Public Safetycited by 20
  2. 2025Multi-Turn Jailbreaks Are Simpler Than They Seemcited by 15
  3. 2025Lifelong Safety Alignment for Language Modelscited by 13
  4. 2025Multi-lingual Multi-turn Automated Red Teaming for LLMscited by 12
  5. 2025Large Reasoning Models Are Autonomous Jailbreak Agentscited by 12
  6. 2026The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agentscited by 12
  7. 2025Think Twice, Generate Once: Safeguarding by Progressive Self-Reflectioncited by 11
  8. 2025Effective Red-Teaming of Policy-Adherent Agentscited by 10
  9. 2024Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerationscited by 8
  10. 2025Jailbreaking to Jailbreakcited by 8
  11. 2025Does Chain-of-Thought Reasoning Really Reduce Harmfulness from Jailbreaking?cited by 8
  12. 2025Tree-based Dialogue Reinforced Policy Optimization for Red-Teaming Attackscited by 8
  13. 2025TAI3: Testing Agent Integrity in Interpreting User Intentcited by 7
  14. 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Iscited by 6
  15. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 6
  16. 2024Well, that escalated quickly: The Single-Turn Crescendo Attack (STCA)cited by 5
  17. 2025MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in Large Language Modelscited by 4
  18. 2025Characterizing Selective Refusal Bias in Large Language Modelscited by 4
  19. 2025Clone What You Can't Steal: Black-Box LLM Replication via Logit Leakage and Distillationcited by 3
  20. 2026The Echo Chamber Multi-Turn LLM Jailbreakcited by 3
  21. 2025BitBypass: A New Direction in Jailbreaking Aligned Large Language Models with Bitstream Camouflagecited by 2
  22. 2025How Catastrophic is Your LLM? Certifying Risk in Conversationcited by 2
  23. 2025Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreakscited by 2
  24. 2025Breaking Minds, Breaking Systems: Jailbreaking Large Language Models via Human-like Psychological Manipulationcited by 2
  25. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 2
  26. 2026NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Roomscited by 2
  27. 2025LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Modelscited by 1
  28. 2025Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Modelscited by 1
  29. 2026Prompt Attack Detection with LLM-as-a-Judge and Mixture-of-Modelscited by 1
  30. 2026The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systemscited by 1
  31. 2026One Word at a Time: Incremental Completion Decomposition Breaks LLM Safetycited by 1
  32. 2024"Moralized" Multi-Step Jailbreak Prompts: Black-Box Testing of Guardrails in Large Language Models for Verbal Attackscited by 0
  33. 2024An indicator for effectiveness of text-to-image guardrails utilizing the Single-Turn Crescendo Attack (STCA)cited by 0
  34. 2025GRAF: Multi-turn Jailbreaking via Global Refinement and Active Fabricationcited by 0
  35. 2025Let the Bees Find the Weak Spots: A Path Planning Perspective on Multi-Turn Jailbreak Attacks against LLMscited by 0
  36. 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policiescited by 0
  37. 2025Replicating TEMPEST at Scale: Multi-Turn Adversarial Attacks Against Trillion-Parameter Frontier Modelscited by 0
  38. 2026Jailbreaking LLMs via Calibrationcited by 0

50 most cited of 54 All 54 (JSON)