Pith. sign in

REVIEW 28 cited by

LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2408.15221 v2 pith:KMDB4M4S submitted 2024-08-27 cs.LG cs.CLcs.CRcs.CY

Nathaniel Li , Ziwen Han , Ian Steneker , Willow Primack , Riley Goodside , Hugh Zhang , Zifan Wang , Cristina Menghini
show 1 more author
Summer Yue
This is my paper
classification cs.LGcs.CLcs.CRcs.CY
keywords defensesjailbreakshumanmulti-turnacrossattacksautomatedmodel
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Recent large language model (LLM) defenses have greatly improved models' ability to refuse harmful queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities, exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens of commercial red teaming engagements, supporting research towards stronger LLM defenses.

Discussion (0). Sign in to comment.

Forward citations

Cited by 28 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks

    cs.CR 2026-08 conditional novelty 7.0 of 10

    Multi-turn LLM jailbreaks succeed based on how harmful intent is organized across turns, not on interaction length, and detection should shift to session and cross-session scope.

  2. Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion

    cs.CR 2026-07 conditional novelty 7.0 of 10

    Prompt-level guardrails on GUI agents are local: effective on single explicit requests, but four-turn escalation raises guarded attack success by ~20 points and concealed requests become more successful than explicit ones.

  3. Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security

    cs.CR 2026-07 conditional novelty 7.0 of 10

    Adaptive multi-turn LLM attacks raise attack success from near 0% to 5.4–14.0% on frontier defenders, with scenario-specific defender weaknesses that aggregate scores hide.

  4. Do Thinking Tokens Help with Safety?

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    Thinking tokens in reasoning models do not enable safety deliberation; refusal/compliance is strongly predictable from the first token and rarely changes during thinking.

  5. NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    NRT-Bench reports that adaptive multi-turn attacks cause critical safety function loss in 8.7-12.1% of sessions across four frontier LLM operator models, with nearly disjoint vulnerabilities and strongly model-depende...

  6. From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    Attackers can force LLM guardrails into extended reasoning loops via optimized payloads, causing 13-63x token amplification and up to 148x latency in agent systems.

  7. MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks

    cs.CR 2026-04 unverdicted novelty 7.0 of 10

    MASCing uses an LSTM surrogate and optimized steering masks to enable flexible, inference-time control over MoE expert routing for safety objectives, improving jailbreak defense and content generation success rates su...

  8. Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion

    cs.CR 2026-04 unverdicted novelty 7.0 of 10

    HMNS is a new jailbreak method that uses causal head identification and nullspace-constrained injection to achieve higher attack success rates than prior techniques on aligned language models.

  9. Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation

    cs.AI 2026-08 conditional novelty 6.0 of 10

    Cross-session decomposition of harmful goals raises attack success from 18.7% to 37.4% across nine models, and a capability-accumulation detector (Magnet) beats per-session and compression baselines at flagging such l...

  10. AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A phase-structured multi-turn red-team framework reports 97.6–100% lenient ASR but only 66.7–78.6% full actionable ASR on six frontier LLMs, with success strongly depth-dependent.

  11. Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models

    cs.AI 2026-06 unverdicted novelty 6.0 of 10

    A diagnostic framework localizes instruction hierarchy failures in LLMs into identification, resolution, and realization, while self-monitors reduce non-compliance by 81-99%.

  12. Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents

    cs.CR 2026-06 unverdicted novelty 6.0 of 10

    Activation probes, calibrated honeytokens, and multi-turn leakage accounting detect credential exfiltration attempts in LLM agents with high accuracy in controlled open-model tests.

  13. SentGuard: Sentence-Level Streaming Guardrails for Large Language Models

    cs.CL 2026-06 unverdicted novelty 6.0 of 10

    SentGuard achieves 90.5% detection of unsafe cases within two sentences at 7.41% false positive rate by operating at sentence boundaries during LLM streaming generation.

  14. Evolving and Detecting Multi-Turn Deception using Geometric Signatures

    stat.ML 2026-05 unverdicted novelty 6.0 of 10

    Multi-objective genetic prompt optimization creates multi-turn deceptive datasets validated by humans, then detected with 0.89 recall using angular coverage, distance ratio, and linearity features in embeddings.

  15. Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges

    cs.CL 2026-05 conditional novelty 6.0 of 10

    Per-bias selection of a cross-family LLM auditor lifts biased-judgment accuracy from 0.805/0.824 baselines to 0.884.

  16. MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

    cs.CL 2026-05 unverdicted novelty 6.0 of 10

    MultiBreak is a large diverse multi-turn jailbreak benchmark that achieves substantially higher attack success rates on LLMs than prior datasets and reveals topic-specific vulnerabilities in multi-turn settings.

  17. The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    Salami Attack chains low-risk inputs to cumulatively trigger high-risk LLM behaviors, achieving over 90% success on GPT-4o and Gemini while resisting some defenses.

  18. TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    TrajGuard detects jailbreaks by tracking how hidden-state trajectories move toward high-risk regions during decoding, achieving 95% defense rate with 5.2 ms/token latency across tested attacks.

  19. Learning from Mistakes: Can LLM Self-Recover after Misalignment?

    cs.CY 2026-03 conditional novelty 6.0 of 10

    LLMs sometimes regain safe behavior after multi-turn jailbreaks, and this recovery can be measured with turn-level safety trajectories and metrics such as misalignment length and recovery duration.

  20. SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

    cs.CR 2025-10 conditional novelty 6.0 of 10

    A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.

  21. Reliable Weak-to-Strong Monitoring of LLM Agents

    cs.AI 2025-08 conditional novelty 6.0 of 10

    Monitor scaffolding, not monitor awareness or omniscience, drives detection reliability, and a hybrid chunked monitor lets weak models supervise strong LLM agents.

  22. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents

    cs.LG 2024-10 accept novelty 6.0 of 10

    AgentHarm benchmark shows leading LLMs comply with malicious agent requests and simple jailbreaks enable coherent harmful multi-step execution while retaining capabilities.

  23. The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in modern AI systems

    cs.CY 2026-07 conditional novelty 5.0 of 10

    AI safety should be measured by whether deployed systems keep errors visible, contestable, containable, and recoverable across five integrity layers, not only by whether individual model outputs look safe.

  24. Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

    cs.CR 2026-07 unverdicted novelty 5.0 of 10

    Cognitive Firewall applies four gates (intent, zero-trust context, consistency, output risk) via an oversight model to cut jailbreak success to 2% or below on most tested sets while keeping over-refusal at 8%.

  25. PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models

    cs.AI 2026-06 unverdicted novelty 5.0 of 10

    PHANTOM is a consolidated open-source dataset of 47,524 multimodal adversarial samples for VLMs, extending prior benchmarks across 10 high-level categories and 55 subcategories of harmful intents.

  26. ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs

    cs.CR 2025-11 unverdicted novelty 5.0 of 10

    ASTRA is an automated closed-loop framework that discovers, retrieves, and evolves jailbreak attack strategies for LLMs using a dynamic three-tier strategy library and outperforms baselines in black-box settings.

  27. Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks

    cs.AI 2025-10 conditional novelty 5.0 of 10

    Fine-tuning an LLM on synthetic toxic dialogues makes it harass in 95–97% of multi-turn conversations in Llama and ~99% in Gemini; memory and planning attacks also raise closed-source vulnerability.

  28. Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment

    cs.LG 2025-10 reject novelty 5.0 of 10

    A fixed ReLU penalty and a semantically labeled cost model are proposed to make RLHF safer, but the 'certifiable' guarantee is not fully supported.

Pith tools