mlsanityData to 7 Oct 2026

Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks

arXiv 2409.00137 ↗First posted 29 Aug 2024cs.CR cs.AI cs.CLcited by 16

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language models (LLMs) are improving at an exceptional rate. However, these models are still susceptible to jailbreak attacks, which are becoming increasingly dangerous as models become increasingly powerful. In this work, we introduce a dataset of jailbreaks where each example can be input in both a single or a multi-turn format. We show that while equivalent in content, they are not equivalent in jailbreak success: defending against one structure does not guarantee defense against the other. Similarly, LLM-based filter guardrails also perform differently depending on not just the input content but the input structure. Thus, vulnerabilities of frontier models should be studied in both single and multi-turn settings; this dataset provides a tool to do so.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 10 of its 15 references that are in the map. First posted on arXiv 29 Aug 2024.

Builds on

10 of 15 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  2. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  3. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
  4. 2024When "Competency" in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers16 Feb
  5. 2023Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Information20 Nov
  6. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  7. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 3

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  3. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 3; 2025: 8; 2026: 5.

16 papers.

Sort:

By area:

  1. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
  2. 2025Accumulating Context Changes the Beliefs of Language Modelscited by 25
  3. 2024Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Modelscited by 15
  4. 2025Think Twice Before You Act: Enhancing Agent Behavioral Safety with Thought Correctioncited by 14
  5. 2024You Know What I'm Saying: Jailbreak Attack via Implicit Referencecited by 13
  6. 2025Large Reasoning Models Are Autonomous Jailbreak Agentscited by 12
  7. 2025Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Modelscited by 9
  8. 2025Automating Deception: Scalable Multi-Turn LLM Jailbreakscited by 7
  9. 2025NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreakscited by 6
  10. 2025Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learningcited by 5
  11. 2026FERRET: Framework for Expansion Reliant Red Teamingcited by 1
  12. 2026The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systemscited by 1
4 more
  1. 2025GRAF: Multi-turn Jailbreaking via Global Refinement and Active Fabricationcited by 0
  2. 2026Defensive M2S: Training Guardrail Models on Compressed Multi-turn Conversationscited by 0
  3. 2026Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversationscited by 0
  4. 2026The Geometry of Harmfulness in Multi-Turn Attackscited by 0