mlsanityData to 7 Oct 2026

The Echo Chamber Multi-Turn LLM Jailbreak

arXiv 2601.05742 ↗First posted 9 Jan 2026cs.CR cs.AIcited by 3

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The availability of Large Language Models (LLMs) has led to a new generation of powerful chatbots that can be developed at relatively low cost. As companies deploy these tools, security challenges need to be addressed to prevent financial loss and reputational damage. A key security challenge is jailbreaking, the malicious manipulation of prompts and inputs to bypass a chatbot's safety guardrails. Multi-turn attacks are a relatively new form of jailbreaking involving a carefully crafted chain of interactions with a chatbot. We introduce Echo Chamber, a new multi-turn attack using a gradual escalation method. We describe this attack in detail, compare it to other multi-turn attacks, and demonstrate its performance against multiple state-of-the-art models through extensive evaluation.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 21 of its 29 references that are in the map. First posted on arXiv 9 Jan 2026.

Builds on

21 of 29 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025Multi-Turn Jailbreaks Are Simpler Than They Seem11 Aug
  2. 2025Does Chain-of-Thought Reasoning Really Reduce Harmfulness from Jailbreaking?23 May
  3. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models18 Apr
  4. 2025M2S: Multi-turn to Single-turn jailbreak in Red Teaming for LLMs6 Mar
  5. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMs27 Feb
  6. 2025Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors24 Jan
  7. 2024MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue6 Nov
  8. 2024Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models15 Oct
  9. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  10. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
  11. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs13 Jun
  12. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
3 more
  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  2. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  3. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug

Other references · 6

  1. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 213
  2. 2022On Second Thought, Let's Not Think Step by Step! Bias and Toxicity in Zero-Shot Reasoningcited by 191
  3. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinkingcited by 94
  4. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  5. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73
  6. 2025The Widespread Adoption of Large Language Model-Assisted Writing Across Societycited by 50

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMscited by 1
  2. 2026Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversationscited by 0
  3. 2026Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Modelscited by 0