Pith. sign in

REVIEW 14 cited by

Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.05610 v1 pith:JOHEVSJM submitted 2024-05-09 cs.CL cs.CRcs.LG

Xikang Yang , Xuehai Tang , Songlin Hu , Jizhong Han This is my paper · ORCID
classification cs.CLcs.CRcs.LG
keywords attackllmscontextualmulti-turndialoguelargechaincontent
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Large language models (LLMs) have achieved remarkable performance in various natural language processing tasks, especially in dialogue systems. However, LLM may also pose security and moral threats, especially in multi round conversations where large models are more easily guided by contextual content, resulting in harmful or biased responses. In this paper, we present a novel method to attack LLMs in multi-turn dialogues, called CoA (Chain of Attack). CoA is a semantic-driven contextual multi-turn attack method that adaptively adjusts the attack policy through contextual feedback and semantic relevance during multi-turn of dialogue with a large model, resulting in the model producing unreasonable or harmful content. We evaluate CoA on different LLMs and datasets, and show that it can effectively expose the vulnerabilities of LLMs, and outperform existing attack methods. Our work provides a new perspective and tool for attacking and defending LLMs, and contributes to the security and ethical assessment of dialogue systems.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 14 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactions

    cs.LG 2026-07 conditional novelty 6.5 of 10

    Recast predicts the turn distribution of future multi-turn LLM safety failures from dual-scale trajectory evidence, catching 88.3% of failures 2.41 turns early at 12.3% false alarms.

  2. GFlowRL: Scaling Distribution-Matching RL to Large Language Models

    cs.CL 2026-07 conditional novelty 6.0 of 10

    Replacing the learned partition function in GFlowNet-style RL with an in-batch Monte Carlo estimate yields GFlowRL, a stable distribution-matching algorithm that beats GRPO/PPO/FlowRL on math, code, and red-teaming an...

  3. AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A phase-structured multi-turn red-team framework reports 97.6–100% lenient ASR but only 66.7–78.6% full actionable ASR on six frontier LLMs, with success strongly depth-dependent.

  4. Pigeonholing: how bad prompts hurt models, causing collapse and mistakes

    cs.CL 2026-06 unverdicted novelty 6.0 of 10

    Unintentionally bad contexts (user suggestions or prior wrong assistant answers) cause LLMs to repeat errors, lose diversity, and flip stances, worsening with turns; RLVR on synthetic errors recovers 43–60% of the drop.

  5. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0 of 10

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  6. SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

    cs.CR 2025-10 conditional novelty 6.0 of 10

    A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.

  7. ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistants

    cs.CR 2025-08 conditional novelty 6.0 of 10

    ASTRA is an automated red-teaming agent that uses knowledge-graph-guided spatial and temporal probing to find 11-66% more safety violations in AI coding assistants than existing tools.

  8. RedCoder: Automated Multi-Turn Red Teaming for Code LLMs

    cs.SE 2025-06 conditional novelty 6.0 of 10

    A multi-turn red-teaming agent trained on simulated attacker-defender conversations induces vulnerable code at higher rates than prior attack methods across several code LLMs.

  9. LLMs are Vulnerable to Malicious Prompts Disguised as Scientific Language

    cs.CL 2025-01 conditional novelty 6.0 of 10

    Scientific-sounding persuasion, using real or fabricated research summaries, reliably increases stereotypical bias and toxicity in multiple commercial LLMs.

  10. Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation

    cs.CL 2025-08 reject novelty 5.0 of 10

    Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.

  11. Towards terahertz nanomechanics

    physics.app-ph 2025-08 unverdicted novelty 5.0 of 10

    Suspended Lamb-wave resonators in lithium niobate films thinned from 300 nm to 67 nm reach 220 GHz, doubling the prior record.

  12. SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues

    cs.CL 2025-05 conditional novelty 5.0 of 10

    STREAM fine-tunes a small reasoning model on human-labeled, reason-annotated multi-turn dialogues and uses it to warn target LLMs, cutting average attack success rates by roughly half while keeping benchmark scores close.

  13. MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teaming

    cs.CR 2025-05 conditional novelty 5.0 of 10

    MTSA pairs a thought-guided red-team attacker with future-reward multi-turn reinforcement learning to make LLMs more robust against multi-round jailbreaks.

  14. The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Models

    cs.LG 2024-11 conditional novelty 5.0 of 10

    Fake authoritative citations matched to the type of harmful request can bypass safety alignment in several commercial and open LLMs.

Pith tools