mlsanityData to 7 Oct 2026

Replicating TEMPEST at Scale: Multi-Turn Adversarial Attacks Against Trillion-Parameter Frontier Models

arXiv 2512.07059 ↗First posted 8 Dec 2025cs.CLcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Despite substantial investment in safety alignment, the vulnerability of large language models to sophisticated multi-turn adversarial attacks remains poorly characterized, and whether model scale or inference mode affects robustness is unknown. This study employed the TEMPEST multi-turn attack framework to evaluate ten frontier models from eight vendors across 1,000 harmful behaviors, generating over 97,000 API queries across adversarial conversations with automated evaluation by independent safety classifiers. Results demonstrated a spectrum of vulnerability: six models achieved 96% to 100% attack success rate (ASR), while four showed meaningful resistance, with ASR ranging from 42% to 78%; enabling extended reasoning on identical architecture reduced ASR from 97% to 42%. These findings indicate that safety alignment quality varies substantially across vendors, that model scale does not predict adversarial robustness, and that thinking mode provides a deployable safety enhancement. Collectively, this work establishes that current alignment techniques remain fundamentally vulnerable to adaptive multi-turn attacks regardless of model scale, while identifying deliberative inference as a promising defense direction.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 23 of its 39 references that are in the map. First posted on arXiv 8 Dec 2025.

Builds on

23 of 39 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning14 Jul
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  3. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned23 Aug

Other references · 20

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2020Scaling Laws for Neural Language Modelscited by 6,411
  3. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  6. 2022Red Teaming Language Models with Language Modelscited by 983
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  9. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  10. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  11. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinkingcited by 94
  12. 2025Safety in Large Reasoning Models: A Surveycited by 58
8 more
  1. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principlescited by 54
  2. 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Frameworkcited by 44
  3. 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
  4. 2025Multi-Turn Jailbreaks Are Simpler Than They Seemcited by 15
  5. 2024Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerationscited by 8
  6. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Modelscited by 8
  7. 2025Weakest Link in the Chain: Security Vulnerabilities in Advanced Reasoning Modelscited by 7
  8. 2025Scaling Patterns in Adversarial Alignment: Evidence from Multi-LLM Jailbreak Experimentscited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026The Geometry of Harmfulness in Multi-Turn Attacks
  2. 2025Adversarial Alignment for LLMs Requires Simpler, Reproducible, and More Measurable Objectives
  3. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks
  4. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep
  5. 2025Probing the Robustness of Large Language Models Safety to Latent Perturbations
  6. 2025Accidental Vulnerability: Factors in Fine-Tuning that Shift Model Safeguards
  7. 2026Alignment Drift in Multimodal LLMs: A Two-Phase, Longitudinal Evaluation of Harm Across Eight Model Releases
  8. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack