mlsanityData to 14 Oct 2026

Multi-lingual Multi-turn Automated Red Teaming for LLMs

arXiv 2504.03174 ↗First posted 4 Apr 2025cs.CLcited by 13

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Language Model Models (LLMs) have improved dramatically in the past few years, increasing their adoption and the scope of their capabilities over time. A significant amount of work is dedicated to ``model alignment'', i.e., preventing LLMs to generate unsafe responses when deployed into customer-facing applications. One popular method to evaluate safety risks is textitred-teaming, where agents attempt to bypass alignment by crafting elaborate prompts that trigger unsafe responses from a model. Standard human-driven red-teaming is costly, time-consuming and rarely covers all the recent features (e.g., multi-lingual, multi-modal aspects), while proposed automation methods only cover a small subset of LLMs capabilities (i.e., English or single-turn). We present Multi-lingual Multi-turn Automated Red Teaming (MM-ART), a method to fully automate conversational, multi-lingual red-teaming operations and quickly identify prompts leading to unsafe responses. Through extensive experiments on different languages, we show the studied LLMs are on average 71% more vulnerable after a 5-turn conversation in English than after the initial turn. For conversations in non-English languages, models display up to 195% more safety vulnerabilities than the standard single-turn English approach, confirming the need for automated red-teaming methods matching LLMs capabilities.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 15 of its 24 references that are in the map. First posted on arXiv 4 Apr 2025.

Builds on

15 of 24 references.

References · 15

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  4. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  5. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  8. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  9. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakerscited by 101
  10. 2023Do Multilingual Language Models Think Better in English?cited by 88
  11. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
  12. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 77
3 more
  1. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principlescited by 56
  2. 2024Leveraging the Context through Multi-Round Interactions for Jailbreaking Attackscited by 36
  3. 2024Prompt Leakage effect and defense strategies for multi-turn LLM interactionscited by 23

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 13.

13 papers.

Sort:

By area:

  1. 2026Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agentscited by 6
  2. 2026Multilingual Refusal Alignment for Safer Large Language Modelscited by 2
  3. 2026The Slow Drift of Support: Boundary Failures in Multi-Turn Mental Health LLM Dialoguescited by 1
  4. 2026INSURE-Dial: A Phase-Aware Conversational Dataset & Benchmark for Compliance Verification and Phase Detectioncited by 1
  5. 2026Safeguard-Conditioned Uplift: Measuring Utility-Risk Frontiers for Dual-Use Biology Assistantscited by 1
  6. 2026Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discoverycited by 1
  7. 2026Red Teaming LLMs as Socio-Technical Practice: From Exploration and Data Creation to Evaluationcited by 0
  8. 2026Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attackscited by 0
  9. 2026A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Modelscited by 0
  10. 2026Safety Targeted Embedding Exploit via Refinementcited by 0
  11. 2026Door-in-the-Face Requests and Refusal Behaviour in Large Language Modelscited by 0
  12. 2026A Translational Note on AI Safety Evaluationcited by 0
1 more
  1. 2026ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models
  2. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment
  3. 2023Language Model Unalignment: Parametric Red-Teaming to Expose Hidden Harms and Biases
  4. 2024Exploring Straightforward Conversational Red-Teaming
  5. 2025Toxicity Red-Teaming: Benchmarking LLM Safety in Singapore's Low-Resource Languages
  6. 2024Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understanding
  7. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teaming
  8. 2024Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction