mlsanityData to 7 Oct 2026

Foot-In-The-Door: A Multi-turn Jailbreak for LLMs

arXiv 2502.19820 ↗First posted 27 Feb 2025cs.CL cs.AIcited by 50

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Ensuring AI safety is crucial as large language models become increasingly integrated into real-world applications. A key challenge is jailbreak, where adversarial prompts bypass built-in safeguards to elicit harmful disallowed outputs. Inspired by psychological foot-in-the-door principles, we introduce FITD,a novel multi-turn jailbreak method that leverages the phenomenon where minor initial commitments lower resistance to more significant or more unethical transgressions. Our approach progressively escalates the malicious intent of user queries through intermediate bridge prompts and aligns the model's response by itself to induce toxic responses. Extensive experimental results on two jailbreak benchmarks demonstrate that FITD achieves an average attack success rate of 94% across seven widely used models, outperforming existing state-of-the-art methods. Additionally, we provide an in-depth analysis of LLM self-corruption, highlighting vulnerabilities in current alignment strategies and emphasizing the risks inherent in multi-turn interactions. The code is available at https://github.com/Jinxiaolong1129/Foot-in-the-door-Jailbreak.

Key facts. Cited by 50 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 42 of its 86 references that are in the map. First posted on arXiv 27 Feb 2025.

Builds on

42 of 86 references.

Closest ancestors · 19

Same direction, newest first

  1. 2025QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language13 Feb
  2. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  3. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
  4. 2024PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetition13 May
  5. 2024Protecting Your LLMs with Information Bottleneck22 Apr
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  7. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
  8. 2024Foot In The Door: Understanding Large Language Model Jailbreaking via Cognitive Psychology24 Feb
  9. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  10. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuning9 Feb
  11. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
  12. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
7 more
  1. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  2. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  4. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  5. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  6. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 23

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  4. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  6. 2023Qwen Technical Reportcited by 3,273
  7. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  8. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  9. 2024DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligencecited by 1,154
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  11. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  12. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
11 more
  1. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  2. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  3. 2024Large Language Models for Education: A Survey and Outlookcited by 185
  4. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teamingcited by 161
  5. 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 149
  6. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
  7. 2024Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototypingcited by 50
  8. 2024Mitigating Fine-tuning based Jailbreak Attack with Backdoor Enhanced Safety Alignmentcited by 31
  9. 2023Enhancing Large Language Models Against Inductive Instructions with Dual-critique Promptingcited by 21
  10. 2024Automated Progressive Red Teamingcited by 12
  11. 2024MULTIVERSE: Exposing Large Language Model Alignment Problems in Diverse Worldscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 16; 2026: 34.

50 papers.

Sort:

By area:

  1. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 112
  2. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agentscited by 28
  3. 2025PurpCode: Reasoning for Safer Code Generationcited by 17
  4. 2025Large Reasoning Models Are Autonomous Jailbreak Agentscited by 12
  5. 2026SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attackscited by 10
  6. 2026DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMscited by 8
  7. 2025Automating Deception: Scalable Multi-Turn LLM Jailbreakscited by 7
  8. 2026Hidden Measurement Error in LLM Pipelines Distorts Annotation, Evaluation, and Benchmarkingcited by 7
  9. 2025From ASR to ASP: Evaluating Prompt Attack Vulnerabilities Against Open-Source LLMscited by 6
  10. 2025Learning to Conceal Risk: Controllable Multi-turn Red Teaming for LLMs in the Financial Domaincited by 6
  11. 2026ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attackcited by 5
  12. 2025When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systemscited by 4
38 more
  1. 2026Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planningcited by 4
  2. 2025Superplatforms Have to Attack AI Agentscited by 3
  3. 2026The Echo Chamber Multi-Turn LLM Jailbreakcited by 3
  4. 2026Turing Test on Screen: A Benchmark for Mobile GUI Agent Humanizationcited by 3
  5. 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attackscited by 3
  6. 2025Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Modelscited by 2
  7. 2025PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploitscited by 2
  8. 2025Breaking Minds, Breaking Systems: Jailbreaking Large Language Models via Human-like Psychological Manipulationcited by 2
  9. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 2
  10. 2026SafeDream: Safety World Model for Proactive Early Jailbreak Detectioncited by 2
  11. 2025N-GLARE: An Non-Generative Latent Representation-Efficient LLM Safety Evaluatorcited by 1
  12. 2026The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systemscited by 1
  13. 2026ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Primingcited by 1
  14. 2026Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreakingcited by 1
  15. 2026D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewritingcited by 1
  16. 2026GFlowRL: Scaling Distribution-Matching RL to Large Language Modelscited by 1
  17. 2026Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMscited by 1
  18. 2026PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policiescited by 1
  19. 2025HiQ-Lip: A Hierarchical Quantum-Classical Method for Global Lipschitz Constant Estimation of ReLU Networkscited by 0
  20. 2025Pluralistic Behavior Suite: Stress-Testing Multi-Turn Adherence to Custom Behavioral Policiescited by 0
  21. 2025MEEA: Mere Exposure Effect-Driven Confrontational Optimization for LLM Jailbreakingcited by 0
  22. 2026Multi-Turn Adaptive Prompting Attack on Large Vision-Language Modelscited by 0
  23. 2026Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversioncited by 0
  24. 2026Mitigating Many-shot Jailbreak Attacks with One Single Demonstrationcited by 0
  25. 2026FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragmentscited by 0
  26. 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolutioncited by 0
  27. 2026Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attackscited by 0
  28. 2026Same Model, Different Weakness: How Language and Modality Reshape the Jailbreak Attack Surface in Frontier MLLMscited by 0
  29. 2026Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Modelscited by 0
  30. 2026MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignmentcited by 0
  31. 2026Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactionscited by 0
  32. 2026Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluationcited by 0
  33. 2026Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agentscited by 0
  34. 2026TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimizationcited by 0
  35. 2026Door-in-the-Face Requests and Refusal Behaviour in Large Language Modelscited by 0
  36. 2026Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Modelscited by 0
  37. 2026The Geometry of Harmfulness in Multi-Turn Attackscited by 0
  38. 2026Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systemscited by 0