Pith. sign in

REVIEW 11 cited by

Foot-In-The-Door: A Multi-turn Jailbreak for LLMs

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2502.19820 v3 pith:CDKYE3FT submitted 2025-02-27 cs.CL cs.AI

Foot-In-The-Door: A Multi-turn Jailbreak for LLMs

Zixuan Weng , Xiaolong Jin , Jinyuan Jia , Xiangyu Zhang This is my paper
classification cs.CL cs.AI
keywords jailbreakmulti-turnfitdfoot-in-the-doormodelspromptsachievesacross
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Ensuring AI safety is crucial as large language models become increasingly integrated into real-world applications. A key challenge is jailbreak, where adversarial prompts bypass built-in safeguards to elicit harmful disallowed outputs. Inspired by psychological foot-in-the-door principles, we introduce FITD,a novel multi-turn jailbreak method that leverages the phenomenon where minor initial commitments lower resistance to more significant or more unethical transgressions. Our approach progressively escalates the malicious intent of user queries through intermediate bridge prompts and aligns the model's response by itself to induce toxic responses. Extensive experimental results on two jailbreak benchmarks demonstrate that FITD achieves an average attack success rate of 94% across seven widely used models, outperforming existing state-of-the-art methods. Additionally, we provide an in-depth analysis of LLM self-corruption, highlighting vulnerabilities in current alignment strategies and emphasizing the risks inherent in multi-turn interactions. The code is available at https://github.com/Jinxiaolong1129/Foot-in-the-door-Jailbreak.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 11 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

    cs.CL 2026-05 unverdicted novelty 7.0

    ContextualJailbreak uses evolutionary search over simulated primed dialogues with novel mutations to reach 90-100% attack success on open LLMs and transfers to some closed frontier models at 15-90% rates.

  2. Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion

    cs.CR 2026-04 unverdicted novelty 7.0

    HMNS is a new jailbreak method that uses causal head identification and nullspace-constrained injection to achieve higher attack success rates than prior techniques on aligned language models.

  3. JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models

    cs.CR 2026-07 conditional novelty 6.0

    JailMeter, an evidence-extraction multi-agent evaluator, reports 97.27% accuracy on its own 330-instance non-refusal jailbreak benchmark, with a distilled 7B model reaching 95.15%.

  4. Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models

    cs.AI 2026-06 unverdicted novelty 6.0

    A diagnostic framework localizes instruction hierarchy failures in LLMs into identification, resolution, and realization, while self-monitors reduce non-compliance by 81-99%.

  5. FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

    cs.LG 2026-04 unverdicted novelty 6.0

    FineSteer decomposes inference-time steering into Subspace-guided Conditional Steering and Mixture-of-Steering-Experts to deliver stronger control over LLM behaviors with less utility loss than prior methods.

  6. The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

    cs.CR 2026-04 unverdicted novelty 6.0

    Salami Attack chains low-risk inputs to cumulatively trigger high-risk LLM behaviors, achieving over 90% success on GPT-4o and Gemini while resisting some defenses.

  7. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  8. ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents

    cs.CL 2025-09 conditional novelty 6.0

    ChatInject exploits LLM chat template structures to boost indirect prompt injection success rates on agents from ~5-15% to 32-52% across benchmarks, with multi-turn persuasion variants performing best.

  9. Learning to Conceal Risk: Controllable Multi-turn Red Teaming for LLMs in the Financial Domain

    cs.CL 2025-09 unverdicted novelty 6.0

    CoRT achieves 95% average attack success rate on nine LLMs by using iterative risk-concealing prompts and a controller that scores concealment levels on a new 522-instruction financial risk benchmark.

  10. Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Models

    cs.CR 2025-09 conditional novelty 5.0

    A benchmark of 500 camouflaged jailbreak prompts finds open-weight LLMs comply with 94% of harmful requests, but the result is confounded by task complexity and an overly permissive compliance metric.

  11. Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attacks

    cs.CR 2026-05 unverdicted novelty 4.0

    Proposes the TRIAD framework that treats multi-turn multimodal attacks as continuous trajectories and uses structural anomaly detection, regularized Mahalanobis distance, topological acceleration, and a time-varying C...