mlsanityData to 7 Oct 2026

ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack

arXiv 2601.20903 ↗First posted 28 Jan 2026cs.CR cs.AIcited by 5

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Multi-turn jailbreak attacks have emerged as a critical threat to Large Language Models (LLMs), bypassing safety mechanisms by progressively constructing adversarial contexts from scratch and incrementally refining prompts. However, existing methods suffer from the inefficiency of incremental context construction that requires step-by-step LLM interaction, and often stagnate in suboptimal regions due to surface-level optimization. In this paper, we characterize the Intent-Context Coupling phenomenon, revealing that LLM safety constraints are significantly relaxed when a malicious intent is coupled with a semantically congruent context pattern. Driven by this insight, we propose ICON, an automated multi-turn jailbreak framework that efficiently constructs an authoritative-style context via prior-guided semantic routing. Specifically, ICON first routes the malicious intent to a congruent context pattern (e.g., Scientific Research) and instantiates it into an attack prompt sequence. This sequence progressively builds the authoritative-style context and ultimately elicits prohibited content. In addition, ICON incorporates a Hierarchical Optimization Strategy that combines local prompt refinement with global context switching, preventing the attack from stagnating in ineffective contexts. Experimental results across eight SOTA LLMs demonstrate the effectiveness of ICON, achieving a state-of-the-art average Attack Success Rate (ASR) of 97.1%. Code is available at https://github.com/xwlin-roy/ICON.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 25 of its 38 references that are in the map. First posted on arXiv 28 Jan 2026.

Builds on

25 of 38 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models9 Oct
  2. 2025Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers17 Jul
  3. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents15 Apr
  4. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMs27 Feb
  5. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  6. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  7. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  9. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  10. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs8 Feb
  11. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
3 more
  1. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  3. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks24 May

Other references · 10

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  3. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  4. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
  5. 2023Siren's Song in the AI Ocean: A Survey on Hallucination in Large Language Modelscited by 695
  6. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  7. 2019Predictive Biases in Natural Language Processing Models: A Conceptual Framework and Overviewcited by 137
  8. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  9. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48
  10. 2023Influence of External Information on Large Language Models Mirrors Social Cognitive Patternscited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026Involuntary In-Context Learning: Exploiting Few-Shot Pattern Completion to Bypass Safety Alignment in GPT-5.4cited by 2
  2. 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolutioncited by 0
  3. 2026Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactionscited by 0
  4. 2026TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluationcited by 0
  5. 2026Measuring LLM Sycophancy under Sustained Multi-Turn Pressurecited by 0