mlsanityData to 14 Oct 2026

Multi-Turn Jailbreaks Are Simpler Than They Seem

arXiv 2508.07646 ↗First posted 11 Aug 2025cs.LGcited by 17

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

While defenses against single-turn jailbreak attacks on Large Language Models (LLMs) have improved significantly, multi-turn jailbreaks remain a persistent vulnerability, often achieving success rates exceeding 70% against models optimized for single-turn protection. This work presents an empirical analysis of automated multi-turn jailbreak attacks across state-of-the-art models including GPT-4, Claude, and Gemini variants, using the StrongREJECT benchmark. Our findings challenge the perceived sophistication of multi-turn attacks: when accounting for the attacker's ability to learn from how models refuse harmful requests, multi-turn jailbreaking approaches are approximately equivalent to simply resampling single-turn attacks multiple times. Moreover, attack success is correlated among similar models, making it easier to jailbreak newly released ones. Additionally, for reasoning models, we find surprisingly that higher reasoning effort often leads to higher attack success rates. Our results have important implications for AI safety evaluation and the design of jailbreak-resistant systems. We release the source code at https://github.com/diogo-cruz/multi_turn_simpler

Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 13 of its 26 references that are in the map. First posted on arXiv 11 Aug 2025.

Builds on

13 of 26 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025M2S: Multi-turn to Single-turn jailbreak in Red Teaming for LLMs6 Mar
  2. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models16 Feb
  3. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming31 Jan
  4. 2025Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors24 Jan
  5. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
  6. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  7. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  9. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
  10. 2024A StrongREJECT for Empty Jailbreaks15 Feb

Other references · 3

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  2. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 240
  3. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Testercited by 45

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 13.

17 papers.

Sort:

By area:

  1. 2026VoxSafeBench: Not Just What Is Said, but Who, How, and Wherecited by 8
  2. 2025Automating Deception: Scalable Multi-Turn LLM Jailbreakscited by 7
  3. 2026The Echo Chamber Multi-Turn LLM Jailbreakcited by 4
  4. 2026Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreakingcited by 3
  5. 2025Scaling Patterns in Adversarial Alignment: Evidence from Multi-LLM Jailbreak Experimentscited by 2
  6. 2026Peak + Accumulation: A Proxy-Level Scoring Formula for Multi-Turn LLM Attack Detectioncited by 2
  7. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  8. 2026NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Roomscited by 2
  9. 2025LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Modelscited by 1
  10. 2026Playing Along: Learning a Double-Agent Defender for Belief Steering via Theory of Mindcited by 1
  11. 2026Into the Gray Zone: Domain Contexts Can Blur LLM Safety Boundariescited by 1
  12. 2026D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewritingcited by 1
5 more
  1. 2025Replicating TEMPEST at Scale: Multi-Turn Adversarial Attacks Against Trillion-Parameter Frontier Modelscited by 0
  2. 2026Whitewashing Hate, Smearing Harmless Content: Annotator-Style Rebuttal Attacks on LLM-Based Moderationcited by 0
  3. 2026ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Modelscited by 0
  4. 2026Alignment of LRMs via Counter-Aligned Few-Shot Conversation Exposurecited by 0
  5. 2026TRACE: Trajectory Return Attribution and Contrastive Erasure for Multi-Turn Safetycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks
  2. 2025A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks
  3. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
  4. 2025GRAF: Multi-turn Jailbreaking via Global Refinement and Active Fabrication
  5. 2026CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation
  6. 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks
  7. 2026JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization
  8. 2026JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models