Search papers, labs, and topics across Lattice.
This paper introduces a four-part taxonomy for organizing multi-turn jailbreaks of Large Language Models (LLMs) based on adversarial intent structure, addressing the gap in understanding how harmful intent is propagated across dialogue turns. The authors demonstrate that the effectiveness of these jailbreaks is significantly influenced by the deliberate organization of intent rather than merely the length of context or number of queries. Their findings reveal that current turn-local safety mechanisms are inadequate, necessitating a shift in evaluation protocols to account for intent visibility at broader interaction levels, including session and cross-session contexts.
Multi-turn jailbreaks exploit user intent in ways that traditional safety measures fail to detect, revealing a critical vulnerability in LLM interactions.
Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.
