Pith. sign in

REVIEW 12 cited by

Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.05610 v1 pith:JOHEVSJM submitted 2024-05-09 cs.CL cs.CRcs.LG

Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM

Xikang Yang , Xuehai Tang , Songlin Hu , Jizhong Han This is my paper
classification cs.CL cs.CRcs.LG
keywords attackllmscontextualmulti-turndialoguelargechaincontent
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
read the original abstract

Large language models (LLMs) have achieved remarkable performance in various natural language processing tasks, especially in dialogue systems. However, LLM may also pose security and moral threats, especially in multi round conversations where large models are more easily guided by contextual content, resulting in harmful or biased responses. In this paper, we present a novel method to attack LLMs in multi-turn dialogues, called CoA (Chain of Attack). CoA is a semantic-driven contextual multi-turn attack method that adaptively adjusts the attack policy through contextual feedback and semantic relevance during multi-turn of dialogue with a large model, resulting in the model producing unreasonable or harmful content. We evaluate CoA on different LLMs and datasets, and show that it can effectively expose the vulnerabilities of LLMs, and outperform existing attack methods. Our work provides a new perspective and tool for attacking and defending LLMs, and contributes to the security and ethical assessment of dialogue systems.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 12 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Jailbreaking Frontier Foundation Models Through Intention Deception

    cs.CR 2026-04 unverdicted novelty 7.0

    A multi-turn intention-deception jailbreak achieves high success on GPT-5 and Claude models while exposing para-jailbreaking where models leak harmful information without direct refusal.

  2. Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactions

    cs.LG 2026-07 conditional novelty 6.5

    Recast predicts the turn distribution of future multi-turn LLM safety failures from dual-scale trajectory evidence, catching 88.3% of failures 2.41 turns early at 12.3% false alarms.

  3. GFlowRL: Scaling Distribution-Matching RL to Large Language Models

    cs.CL 2026-07 conditional novelty 6.0

    Replacing the learned partition function in GFlowNet-style RL with an in-batch Monte Carlo estimate yields GFlowRL, a stable distribution-matching algorithm that beats GRPO/PPO/FlowRL on math, code, and red-teaming an...

  4. AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation

    cs.CR 2026-07 conditional novelty 6.0

    A phase-structured multi-turn red-team framework reports 97.6–100% lenient ASR but only 66.7–78.6% full actionable ASR on six frontier LLMs, with success strongly depth-dependent.

  5. Pigeonholing: how bad prompts hurt models, causing collapse and mistakes

    cs.CL 2026-06 conditional novelty 6.0

    Unintentionally bad contexts (user suggestions or prior wrong assistant answers) cause LLMs to repeat errors, lose diversity, and flip stances, worsening with turns; RLVR on synthetic errors recovers 43–60% of the drop.

  6. GuardAD: Safeguarding Autonomous Driving MLLMs via Markovian Safety Logic

    cs.AI 2026-05 unverdicted novelty 6.0

    GuardAD reduces accident rates by 32% in autonomous driving MLLMs by using n-th order Markovian logic to infer latent hazards and revise actions.

  7. MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks

    cs.CR 2026-05 unverdicted novelty 6.0

    MT-JailBench is a modular benchmark that standardizes evaluation of multi-turn jailbreaks to identify key success drivers and enable stronger combined attacks.

  8. Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines

    cs.CR 2026-04 unverdicted novelty 6.0

    A single legitimate request can cause LLM orchestrators to output plans that violate security policies through the composition of benign subtasks, bypassing subtask-level checks.

  9. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  10. Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs

    cs.CL 2025-11 unverdicted novelty 6.0

    EvoSynth evolves code-based jailbreak algorithms via multi-agent self-correction, reaching 85.5% ASR on Claude-Sonnet-4.5 and 95.9% average across targets with greater diversity.

  11. SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

    cs.CR 2025-10 conditional novelty 6.0

    A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.

  12. Pigeonholing: how bad prompts hurt models, causing collapse and mistakes

    cs.CL 2026-06 unverdicted novelty 5.0

    Bad contexts in LLM conversations cause error repetition, mode collapse, and opinion flipping with 38-40% performance drops that worsen over turns, mitigated by RLVR trained with synthetic errors.