Pith. sign in

REVIEW 11 cited by

Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.09177 v2 pith:XB7WOUGW submitted 2024-02-14 cs.LG cs.AIcs.CL

Yixin Cheng , Markos Georgopoulos , Volkan Cevher , Grigorios G. Chrysos This is my paper · ORCID
classification cs.LGcs.AIcs.CL
keywords attackcontextllmsattacksinformationjailbreakingharmfulquery
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Large Language Models (LLMs) are susceptible to Jailbreaking attacks, which aim to extract harmful information by subtly modifying the attack query. As defense mechanisms evolve, directly obtaining harmful information becomes increasingly challenging for Jailbreaking attacks. In this work, inspired from Chomsky's transformational-generative grammar theory and human practices of indirect context to elicit harmful information, we focus on a new attack form, called Contextual Interaction Attack. We contend that the prior context\u2014the information preceding the attack query\u2014plays a pivotal role in enabling strong Jailbreaking attacks. Specifically, we propose a first multi-turn approach that leverages benign preliminary questions to interact with the LLM. Due to the autoregressive nature of LLMs, which use previous conversation rounds as context during generation, we guide the model's question-response pair to construct a context that is semantically aligned with the attack query to execute the attack. We conduct experiments on seven different LLMs and demonstrate the efficacy of this attack, which is black-box and can also transfer across LLMs. We believe this can lead to further developments and understanding of security in LLMs.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 11 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks

    cs.CR 2026-08 conditional novelty 7.0 of 10

    Multi-turn LLM jailbreaks succeed based on how harmful intent is organized across turns, not on interaction length, and detection should shift to session and cross-session scope.

  2. Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines

    cs.AI 2026-06 conditional novelty 6.0 of 10

    Disguising unsafe operations as routine software-engineering tests makes coding agents execute them at high verified rates, revealing a gap between language-layer refusal and execution-layer harm.

  3. Robust Critics: Defending LLMs Against Multi-Turn Attacks

    cs.AI 2026-05 conditional novelty 6.0 of 10

    Critic-weighted sampling over inferred user intents improves multi-turn LLM defense success while preserving helpfulness, with an expected-Q improvement guarantee and transfer to frontier models.

  4. SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

    cs.CR 2025-10 conditional novelty 6.0 of 10

    A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.

  5. Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation

    cs.CL 2025-08 reject novelty 5.0 of 10

    Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.

  6. Linearly Decoding Refused Knowledge in Aligned Language Models

    cs.CL 2025-06 conditional novelty 5.0 of 10

    Linear probes recover jailbreak-only answers from aligned models' hidden states, sometimes transfer from base models, and correlate with pairwise preference rankings.

  7. A Conceptual Framework for AI Capability Evaluations

    cs.AI 2025-06 conditional novelty 5.0 of 10

    A descriptive conceptual framework with seven elements (target, task, subject, inputs, instance, measurement, result analysis) for systematizing analysis of AI capability evaluations.

  8. A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination

    cs.CR 2026-08 conditional novelty 4.0 of 10

    A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...

  9. Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents

    cs.AI 2024-11 conditional novelty 4.0 of 10

    A survey proposing a source-and-impact taxonomy (input, model, combined; security, privacy, ethics) for threats to LLM-based agents, with feature analysis and four case studies.

  10. Large Language Model Safety: A Holistic Survey

    cs.AI 2024-12 conditional novelty 3.0 of 10

    A broad survey of LLM safety that groups the literature into four risk areas and four related areas, with a taxonomy and a public repository of papers, but no new empirical results.

  11. Preventing Jailbreak Prompts as Malicious Tools for Cybercriminals: A Cyber Defense Perspective

    cs.CR 2024-11 conditional novelty 2.0 of 10

    A structured survey of jailbreak prompts and layered defenses for large language models, with six illustrative case studies and no empirical evaluation.

Pith tools