Derail Yourself: Multi-turn LLM Jailbreak Attack through self-discovered clues
LLM jailbreak;LLM safety alignment;Multi-turn attack
Yes
No ethics review needed.
1、	Limited novelty: The overall idea is basically consistent with crescendo: a) the generation of the initial clue, even if the actor theory is mentioned here, it actually only works in assigning a role to LLM for generating the initial clue; no strict theory or inspiration； b) In the initial generation process, the attack model in crescendo is simply replaced by the victim model; the benefits and reasons are unclear to confidently support the advantage; c) The dynamic multi-turn prompt modification action only involves repeated generation to reduce toxicity; no heuristic strategy guidance.
2、	Limited Contribution: As for multi-turn attack, this paper only contributes a point - designated clue
3、	Root cause analysis: Why multi-turn surpasses single-turn? Please give in-depth mechanism analysis and corresponding experiment support.
4、	Baseline Comparison: only one multi-turn baseline for comparison is not convincing, consider Yang, Xikang, et al. "Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM." arXiv preprint arXiv:2405.05610 (2024). 
5、	Persuasive Experiment: a) only 50 instances and two LLMs (GPT-4o, Claude-3.5) in ablation study cannot support that your multi-turn attack – ActorAttack surpasses Crescendo, please add more results; b) only use GPT-4O to judge ASR is single-minded, consider human, Llama-guard model, and moderation API
6、	Explanation: Is it a common practice to use the embedding function of MiniLMv2 for diversity evaluation of the prompts? Give more evidence.
7、	kind Suggestion:
1)	Actor- involved in the multi-turn dialogue generation and update
2)	Add more strategical method to choose the most helpful clue
3)	The intuitive defense method could be improved
1、The paper is well-arranged and readable
2、It provides reasonable experiment
This paper proposes a multi-turn attack – ActorAttack, which is an improvement from the existing work. The main difference with previous multi-turn papers is the pre-set helpful clue, which is obtained by using LLM under diverse actors. With the designated clue, ActorAttack could generate the diverse attack paths towards the same harmful target.
1、	The innovation is limited
2、	Lack of in-depth root cause analysis
3、	The experiment result is not unconvincing enough
Yes
No ethics review needed.
1. What is the time required to generate a jailbreak attack sequence using ActorAttack method? Since, it is using 4 different models, how can it be used in practical use cases?
2. How to interpret the results shown in figures 4(a) and 4(b)? Please add additional details in caption.
1. Novel adaptation of actor network theory in multi-turn jailbreak prompt sequence generation.
2. Attack method is suitable for both black-box and white-box LLMs.
Summary:
This paper proposes a multi-turn LLM attack method and addresses two challenges in this method: (1) conceal of harmful intent (2) generating multiple attack paths for the same harmful target. This work adapts the actor-network theory to generate attack clues, which in turn are used to generate concrete prompts which when input to LLMs lead to jailbreak. These carefully generated prompts are designed in a manner that lead to the LLM answering the original harmful query. The work develops a dataset with multi-turn adversarial prompts and safety-alignment data, which can be used for fine-tuning.
1. Method section 3 could have been written in a better way. Actor network adaptation to the generation of attack clues could be explained in a better way.
2. Uses 4 LLMs as per the algorithm pseudocode. However, clear description of all the 4 models is missing.
3. In Table 1, ASR comparison is done against single turn attacks only. Need to compare with recent related work on Multi-turn attacks like Crescendo, etc.
4. Notations used in algorithm have not been explained in text. This needs to be done for better understanding of the method.
5. Missing experiments for comparison of state-of-the-art defense mechanisms. Experiments section needs to be refined.
Yes
No ethics review needed.
See weaknesses. While my current evaluation is negative, I would reconsider the score if the author addresses my concerns, especially by clearly explaining the importance of the attack clues.
- The proposed method demonstrates a better attack success rate. 
- The manuscript discusses its helpfulness, and further fine-tuning indicates that the proposed method is effective in enhancing model security.
This paper introduces ActorAttack, a method that utilizes actor-network theory to generate diverse attack paths while concealing harmful intents. Unlike existing methods, ActorAttack automates the discovery of attack clues using LLM knowledge, enhancing both the effectiveness and diversity of attacks. The research also presents the SafeMTData dataset, which improves LLM robustness through safety tuning, revealing a trade-off between utility and safety. This work emphasizes the need for addressing safety risks in multi-turn conversations with LLMs.
- Weak Technical Contribution. From my perspective, the primary contribution of the proposed attack is the identification of attack clues derived from LLMs. However, there is a lack of quantitative analysis regarding the superiority of these clues compared to existing works, such as CFA [1] and CoA [2]. Why are these attack clues more effective? Is it due to their ability to introduce a greater range of possibilities into the attack chain? It is important to note that existing works also leverage related problems to enhance their attack chains, allowing for the incorporation of additional possibilities as they evolve.
- Datasets: The number of samples in the dataset is unclear. I only see that the ablation study used 50 samples. This raises concerns about the generalizability of the proposed method.
- Baseline: The proposed method involves multi-turn jailbreaking, so the comparison should focus on multi-turn attacks as well. However, the baseline presented only includes one multi-tuen jailbreaking method, Crescendo, while other methods like CFA and CoA are not compared. In addition, the chosen single-turn jailbreak methods are not state-of-the-art, as more effective attacks (such as AutoDAN, ReNeLLM, and MultiLingual) are not compared. For details, see: http://easyjailbreak.org/leader-board.
- Incomplete Evaluation. I am particularly interested in the comparison between the proposed method and multi-turn jailbreaking. However, the authors have limited the evaluation of victim models to only GPT-4o and Claude-3.5. Why not conduct a comprehensive evaluation across all five victim models listed in Table 1? This suggests a potential selective presentation of results by the authors.
- Efficiency Evaluation. The proposed method relies on LLMs to generate multiple attack clues, which may be time-consuming. I am concerned that it may be less efficient than existing methods, so the authors should discuss the time costs associated with the attacks.

[1] Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles.  
[2] Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM.
we presents ActorAttack, a multi-turn jailbreak method revealing LLM vulnerabilities through self-discovered attack clues.
@inproceedings{
anonymous2024derail,
title={Derail Yourself: Multi-turn {LLM} Jailbreak Attack through self-discovered clues},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=kvvvUPDAPt},
note={under review}
}
This study exposes the safety vulnerabilities of Large Language Models (LLMs) in multi-turn interactions, where malicious users can obscure harmful intents across several queries. We introduce ActorAttack, a novel multi-turn attack method inspired by actor-network theory, which models a network of semantically linked actors as attack clues to generate diverse and effective attack paths toward harmful targets. ActorAttack addresses two main challenges in multi-turn attacks: (1) concealing harmful intents by creating an innocuous conversation topic about the actor, and (2) uncovering diverse attack paths towards the same harmful target by leveraging LLMs' knowledge to specify the correlated actors as various attack clues. In this way, ActorAttack outperforms existing single-turn and multi-turn attack methods across advanced aligned LLMs, even for GPT-o1. We will publish a dataset called SafeMTData, which includes multi-turn adversarial prompts and safety alignment data, generated by ActorAttack. We demonstrate that models safety-tuned using our safety dataset are more robust to multi-turn attacks.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
LLM jailbreak LLM safety alignment Multi-turn attack
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/c3441fc56a2792dd1d2a2d3f93a99da61ac333c1.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Derail Yourself: Multi-turn LLM Jailbreak Attack through self-discovered clues
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission