mlsanityData to 7 Oct 2026

NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks

arXiv 2510.03417 ↗First posted 3 Oct 2025cs.CR cs.AIcited by 6

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs) have revolutionized natural language processing but remain vulnerable to jailbreak attacks, especially multi-turn jailbreaks that distribute malicious intent across benign exchanges and bypass alignment mechanisms. Existing approaches often explore the adversarial space poorly, rely on hand-crafted heuristics, or lack systematic query refinement. We present NEXUS (Network Exploration for eXploiting Unsafe Sequences), a modular framework for constructing, refining, and executing optimized multi-turn attacks. NEXUS comprises: (1) ThoughtNet, which hierarchically expands a harmful intent into a structured semantic network of topics, entities, and query chains; (2) a feedback-driven Simulator that iteratively refines and prunes these chains through attacker-victim-judge LLM collaboration using harmfulness and semantic-similarity benchmarks; and (3) a Network Traverser that adaptively navigates the refined query space for real-time attacks. This pipeline uncovers stealthy, high-success adversarial paths across LLMs. On several closed-source and open-source LLMs, NEXUS increases attack success rate by 2.1% to 19.4% over prior methods. Code: https://github.com/inspire-lab/NEXUS

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 23 of its 54 references that are in the map. First posted on arXiv 3 Oct 2025.

Builds on

23 of 54 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability14 Feb
  2. 2025Understanding and Enhancing the Transferability of Jailbreaking Attacks5 Feb
  3. 2024MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue6 Nov
  4. 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks29 Aug
  5. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  6. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses3 Jun
  7. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  8. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  10. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  11. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug

Other references · 12

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  3. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  4. 2020MiniLMv2: Multi-Head Self-Attention Relation Distillation for Compressing Pretrained Transformerscited by 240
  5. 2023Do Large Language Models Know What They Don't Know?cited by 238
  6. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agentscited by 129
  7. 2020Evaluating the Evaluation of Diversity in Natural Language Generationcited by 127
  8. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 118
  9. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 111
  10. 2023Aligning Large Language Models through Synthetic Feedbackcited by 75
  11. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73
  12. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 6.

6 papers.

  1. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 6
  2. 2026Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counselingcited by 4
  3. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Securitycited by 1
  4. 2026Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Modelscited by 0
  5. 2026TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Serverscited by 0
  6. 2026Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreakingcited by 0