Research map / Large language models / Language, safety and interpretability
Multi-Turn Jailbreaking Large Language Models via Attention Shifting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Analyzes attention in multi-turn jailbreaks and proposes ASJA, a genetic-algorithm attack that fabricates dialogue history (queries and responses) to shift LLM attention away from harmful keywords.
Problem
Multi-turn jailbreaks are effective, but the reasons are unclear and existing attacks only optimize queries while following single-turn strategies; the paper asks why multi-turn jailbreaks succeed and how to exploit it.
Approach
Attention analysis shows successful multi-turn jailbreaks dilute attention on harmful keywords in the final query, especially in historical responses. ASJA therefore co-optimizes queries and responses in the dialogue history with a genetic algorithm, using the attention score on the last query as fitness, to shift attention and elicit harmful output.
Key results
- ASJA improves ASR-1 by 44.91% and ASR-2 by 34.02% on average over the best baseline PAIR across LLaMA-2, LLaMA-3.1, and Qwen-2 on QuestionList and AdvBench.
- On QuestionList, ASJA reaches 81.33 average ASR-1 versus 51.67 for PAIR.
- Transferred to GPT-3.5 and GPT-4o, ASJA achieves 56% and 57% ASR-1 respectively, with 40.38 and 37.33 PPL.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ASJA instead of the best baseline, PAIR | Multi-turn jailbreak attacks · AdvBench | ASR-1: 63.40 vs 48.21 | Helped |
| Use ASJA instead of the best baseline, PAIR | Multi-turn jailbreak attacks · AdvBench | ASR-2: 53.72 vs 40.83 | Helped |
| Use ASJA instead of the best baseline, PAIR | Multi-turn jailbreak attacks · QuestionList | ASR-1: 81.33 vs 51.67 | Helped |
| Use ASJA instead of the best baseline, PAIR | Multi-turn jailbreak attacks · QuestionList | ASR-2: 62.67 vs 46.00 | Helped |
| Use ASJA instead of the best baseline, PAIR | Transfer attacks on GPT-3.5 · QuestionList transfer from LLaMA-2 | ASR-1: 56.00 vs 61.00 | Mixed |
| Use ASJA instead of the best baseline, PAIR | Transfer attacks on GPT-4o · QuestionList transfer from LLaMA-2 | ASR-2: 63.00 vs 59.00 | Helped |
| Use ASJA instead of PAIR | Jailbreak prompt stealthiness · AdvBench | PPL: 37.30 vs 22.65 | Hurt |
Surprising findings
- Successful multi-turn jailbreaks give lower attention to harmful keywords in the final query than failed ones, and intermediate responses receive more attention than queries.
Limitations
- ASR-2 is consistently lower than ASR-1 because rewritten queries drift from the original harmful intent.
- Attack relies on an uncensored model and white-box attention access to the target for fitness, which limits use on closed-source models.
Experimental setup
Datasets: QuestionList AdvBench
Benchmarks: QuestionList AdvBench
Metrics: ASR-1 ASR-2 Sentence perplexity (GPT-2) query efficiency
Baselines: AutoDAN ReNeLLM PAIR
Builds on: PAIR AutoDAN ReNeLLM Crescendo
Closest papers by meaning
- MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks (NeurIPS 2026 · similarity 0.91)
- Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.91)
- Multilingual Jailbreak Challenges in Large Language Models (ICLR 2024 · similarity 0.90)
- Look Before You Leap: Enhance Attention and Vigilance Regarding Harmful Content with GuidelineLLM (AAAI 2025 · similarity 0.90)
- Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs (ICML 2025 · similarity 0.90)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.