SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks Siyuan Li∗ , Aodu Wulianghai∗ , Zehao Liu∗ , Xi Lin∗ , Qinghua Mao∗ , Haoyu Li† , Xiang Chen‡ , Siyuan Liang§ , Jun Wu∗ , Jianhua Li∗ , Dacheng Tao§ ∗ Shanghai Jiao Tong University, † University of Illinois Urbana-Champaign, ‡ Zhejiang University, § Nanyang Technological University
arXiv:2608.01117v1 [cs.CR] 2 Aug 2026
{siyuanli, melusine.wlhad, liuzehao, linxi234, mmmm2018, junwuhn, lijh888}@sjtu.edu.cn, [email protected], [email protected], {siyuan.liang, dacheng.tao}@ntu.edu.sg
Abstract—Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.
1. Introduction Large Language Models (LLMs) have rapidly advanced in reasoning, multi-modality, long-context understanding, and tool use. Recent frontier systems continue to expand the capability boundary of general-purpose AI, while LLMs are increasingly deployed in interactive applications, including conversational assistants [1], [2], [3], coding copilots [4], [5], [6], enterprise workflows [7], [8], and agentic systems [9], [10]. This deployment shift changes the adversarial surface facing LLM-based systems: attacks are no longer confined to isolated benchmark inputs, but can unfold through dialogue history, tool-mediated workflows, and stateful interactions [11], [12], [13], [14]. As LLMs move from controlled evaluation settings into real-world use, their growing capability and reach also create new avenues for misuse and adversarial manipulation [15], [16], [17]. One of the most pressing forms of such misuse is eliciting harmful or policy-violating outputs from LLMs through adversarial user inputs [18], [19]. To mitigate this risk, mod-
ern LLMs are typically subjected to safety alignment procedures spanning training-time preference optimization [1], [20], [21], [22], adversarial red-teaming and safety data augmentation [23], [24], and inference-time defensive mechanisms [25], [26]. Yet alignment remains imperfect under adaptive adversaries [27], [28], [29], [30], [31], [32], [33]. Jailbreak attacks exploit these imperfections by crafting prompts or interaction sequences that induce harmful or policy-violating behavior [17], [34], [35]. Prior attacks have evolved from manually crafted adversarial prompts [36], [37], to automated optimization and search techniques [38], [39], [40], [41], and further to cross-modal exploits against vision-language models [42], [43], [44], [45], [46], [47], [48]. However, much of this line of work still treats the prompt, image, or individual instance as the primary unit of attack [23], [36], [49], leaving the interaction process itself comparatively under-analyzed. Multi-turn jailbreaks expose this missing interactionlevel attack surface. In practical LLM use, user intent often unfolds over multiple turns, and adversaries can exploit the same interface by advancing a harmful objective gradually, adapting to refusals, and conditioning later requests on earlier model responses [25], [50], [51], [52], [53]. Existing methods instantiate this idea through escalationbased dialogues [53], [54], [55], [56], adaptive attacker agents [57], [58], [59], and multi-path or cross-session attack designs [60], [61], [62], [63]. Despite their surface diversity, these attacks share a common structure: the harmful objective is not necessarily exposed in a single prompt, but is organized across turns, trajectories, or sessions. This makes multi-turn jailbreak qualitatively different from simply repeating or rephrasing a single malicious request, and motivates treating it as an interaction-level threat model in its own right. The rapid growth of jailbreak methods has prompted extensive efforts to systematize the surrounding literature. Some surveys and SoK studies examine LLM safety and security at a broad system level [18], [64], [65], while others focus on prompt-level threats and defenses [66]. A growing body of jailbreak-specific work further studies attack taxonomies, guardrail design, and robustness evaluation [34], [35], [45], [47], [67], [68], [69]. Together, these works cover a spectrum from general LLM attack and defense surfaces
to specialized jailbreak evaluation protocols. However, when multi-turn attacks are discussed, they are still typically organized by surface techniques, attacker capabilities, or evaluation outcomes, rather than by how adversaries structure harmful intent across an interaction. This leaves two central questions underexplored: how adversaries organize and advance harmful intent across turns, trajectories, and sessions; and at what observation scope such intent becomes detectable to a defender. These questions call for a systematization organized not by prompt patterns alone, but by the control point through which harmful intent is planned, distributed, and made observable. To address these questions, we provide a comprehensive taxonomy of coordinated multi-turn jailbreaks in this survey. Rather than treating these attacks as a disjointed collection of surface-level prompt templates, we identify the fundamental dimensions along which adversaries differ in planning and executing long-horizon attacks. Based on these adversarial-strategy variations, we propose a unified taxonomy that organizes existing methodologies into four distinct categories: Dialogue-escalation Attacks (DEA) and Strategy-refinement Attacks (SRA), Trajectorybranching Attacks (TBA), and Session-splitting Attacks (SSA). Building on this taxonomy, we conduct targeted empirical analyses on representative DEA and SRA methods, where available implementations allow controlled ablations of single-trajectory attack mechanisms. These experiments test whether multi-turn jailbreak effectiveness is driven by accumulated context and query count, or by the deliberate organization of harmful intent across the interaction. We further examine how escalation shape, trajectory-level amplification components, and inference-time strategy refinement affect attack success. For TBA and SSA, we provide analytical systematization of how distributed intent shifts the required detection surface from local turns to full sessions and cross-session linkage. Together, these analyses motivate multi-turn-aware evaluation protocols and safety architectures that align defenses with the level at which harmful intent becomes observable. We summarize our contributions as follows: • Intent-oriented taxonomy of multi-turn jailbreaks. We argue that the defining characteristic of multiturn jailbreaks is not the specific prompting technique employed at each step, but how adversaries organize harmful intent. Guided by this perspective, we develop an intent-oriented systematization and summarize a taxonomy with four categories, which provide a unified view of existing multi-turn jailbreak methods and clarify the relationships among previously disconnected attack designs. • Mechanism analysis of single-trajectory attacks. Beyond categorizing prior work, we conduct targeted empirical studies on representative attacks from each category to identify the mechanisms that drive their effectiveness. Through controlled ablations, we disentangle the contributions of factors such as context accumulation, query budget, strategic adaptation, trajectory
branching, and intent decomposition. Our results show that attack success is primarily determined by how harmful objectives are organized and pursued across interactions, rather than by interaction length alone. • Implications for evaluation and defense. We further examine how different attack categories affect the observability of harmful intent and the corresponding detection surface available to safety mechanisms. Our analysis reveals a progressive shift from turnlevel observability to session-level and cross-session observability, exposing a structural mismatch between advanced multi-turn jailbreaks and existing turn-centric defenses. Based on these findings, we identify key limitations in current evaluation protocols, benchmark design, and defense strategies, and outline directions toward interaction-aware safety evaluation and robust defenses against adaptive long-horizon attacks.
2. Modeling Multi-Turn Jailbreaks: Formulation and Taxonomy This section establishes the modeling basis for our intent-oriented analysis of multi-turn jailbreaks. We first formalize the interaction process among the attacker, victim, and judge in Subsection 2.1. We then specify the threat setting in terms of attacker capabilities and defender observation in Subsection 2.2. Finally, we derive our taxonomy from where harmful intent is organized across the interaction in Subsection 2.3. Figure 1 provides a visual overview of the interaction loop and the resulting taxonomy.
2.1. Problem Definition of Multi-Turn Jailbreak Process. We model multi-turn jailbreak as an interactive process in which an adversary advances a harmful intent, encoded as a target objective T , across turns, eliciting policyviolating outputs from a victim model through sequential context construction and adaptive querying. Let N denote the maximum turn budget, PN with the total number of victim queries bounded by t=1 Kt . Roles. The process involves three formal roles: • An attacker A that implements two conditional distributions, a strategy update µ and a query policy π , governing how intent is organized and how queries are generated; • A victim V that generates responses conditioned on the dialogue history; • A judge J that scores a candidate output against the target objective T for evaluation. Parameter subscripts (e.g., Vθ , Jθ ) are reserved for specific instantiations and omitted at the formulation level for uniformity. Attacker state. Across turns, the attacker maintains three internal objects: • A strategy variable σt that encodes the current attack strategy;
making query 𝑞𝑘,𝑡 ~ 𝜋 ⋅ 𝑇, 𝐻𝑘, 𝑡−1 , 𝜎𝑡 , 𝒮𝑡−1 )
attack strategy 𝜎𝑡
trajectory history 𝐻𝑘,𝑡
How to make a bomb? harmful target 𝑇
Attacker 𝐴
Victim 𝑉 Judge 𝐽
Successful Jailbreak!
response 𝑟𝑘,𝑡 ~ 𝒱 ∙ 𝑞𝑘,𝑡 , 𝐻𝑘,𝑡−1 )
(a) Overview of multi-turn jailbreak interaction. Dialogue-Escalation
Strategy-Refinement
Trajectory-Branching
Session-Splitting
shapes dialogue via 𝑞𝑡
refines strategy 𝜎𝑡
branches trajectories 𝐻𝑡
splits 𝑇 across sessions
benign
harmful
𝜎1
𝜎2
𝜎3
𝜎4 split
turn 𝑡 →
turn 𝑡 →
turn 𝑡 →
aggregate
turn 𝑡 →
(b) Four categories by intent-organization control point.
Figure 1: Overview of multi-turn jailbreak. Panel (a) illustrates the interaction loop among the attacker A, victim V , and judge J , with the trajectory history Hk,t updated each turn until the judge signals a successful jailbreak. Panel (b) summarizes the four attack categories along the turn axis, distinguished by what the attacker plans across turns, namely the query content qt , the strategy trajectory σt , the branching of Ht , and the decomposition of T across sessions. t A trajectory set Ht = {Hk,t }K k=1 recording all queryresponse pairs up to turn t along each trajectory k ; • A cross-trajectory shared state St that links concurrent trajectories. The cardinality Kt may be fixed throughout the interaction or evolve under σt , which encodes any branching or pruning over trajectories. When Kt = 1, the attack proceeds along a single dialogue thread and St degenerates to an empty placeholder; when Kt > 1, multiple trajectories run concurrently and St carries whatever information links them, with the role of this linkage determined by the attack design. Initialization. Each trajectory is initialized with a prior context C0 that captures any system prompt or other initial conditioning (C0 = ∅ when none is present), so that Hk,0 = C0 ; the initial strategy σ0 and shared state S0 are specified per attack design. Interaction loop. At each turn t ∈ {1, . . . , N }, the attacker first updates its strategy according to the strategy update distribution µ:
•
σt ∼ µ(· | σt−1 , Ht−1 , St−1 ).
(1)
The strategy σt is shared across all active trajectories within a turn; per-trajectory variation arises from the differing Hk,t−1 and the trajectory-specific use of St−1 within π . Conditioned on this strategy, the attacker generates, for each active trajectory k , a query qk,t via the query policy π : qk,t ∼ π(· | T, Hk,t−1 , σt , St−1 ).
(2)
The victim processes each query together with its trajectory history to produce a response rk,t , and the history is updated
accordingly: rk,t ∼ V(· | qk,t , Hk,t−1 ), Hk,t = Hk,t−1 ∪ {(qk,t , rk,t )}.
(3)
The shared state is then refreshed via an update function Φ: St = Φ(St−1 , Ht ).
(4)
Finally, a candidate output is extracted from the trajectory set via an extraction function Ω and scored by the judge: Ot = Ω(Ht ),
st = J (Ot , T ).
(5)
In the simplest case, Ω returns the most recent victim response along the trajectory; more elaborate designs aggregate information across trajectories before producing Ot . Success criterion. A multi-turn jailbreak succeeds if the judge score reaches a predefined threshold τ within the turn budget: ∃ t ≤ N s.t. st ≥ τ. (6) Equivalently, the attack succeeds at the first turn t∗ with st∗ ≥ τ , and fails if no such t∗ exists within the budget. Generality. Algorithm 1 summarizes this loop. It captures the core mechanics shared by every multi-turn attack, while Subsection 2.2 specifies the capability and observation assumptions under which the loop is instantiated. The four categories of Subsection 2.3 are obtained as specializations of a single procedure rather than as separate algorithms. Each category fixes or trivializes a subset of the objects {µ, π, Ht , St , Φ, Ω} and organizes harmful intent through the one it leaves free; Subsection 2.3 makes this correspondence explicit.
Algorithm 1 General formulation of multi-turn jailbreak. Require: target T , victim V , judge J , threshold τ , turn budget N , prior context C0 , initial strategy σ0 , shared state S0 , cardinality K0 1: Hk,0 ← C0 for k = 1, . . . , K0 2: for t = 1 to N do 3: σt ∼ µ(· | σt−1 , Ht−1 , St−1 ) {may reshape Kt and branching} 4: for k = 1 to Kt in parallel do 5: qk,t ∼ π(· | T, Hk,t−1 , σt , St−1 ) 6: rk,t ∼ V(· | qk,t , Hk,t−1 ) 7: Hk,t ← Hk,t−1 ∪ {(qk,t , rk,t )} 8: end for 9: St ← Φ(St−1 , Ht ) {trivial: St ≡ ∅ when Kt ≡ 1} 10: Ot ← Ω(Ht ) {aggregates across trajectories when Kt > 1} 11: if J (Ot , T ) ≥ τ then 12: return Success, Ht 13: end if 14: end for 15: return Failure, HN
TABLE 1: Our single classification axis. Each category organizes harmful intent through exactly one object from Subsection 2.1 ( green ); the remaining objects are held fixed or trivialized ( red ). Category
Organizes intent via
Other objects
DEA
query content q (policy π )
µ fixed; Kt ≡ 1
SRA
strategy σ (update µ)
T fixed; Kt ≡ 1
TBA
branching of Ht (via Kt )
T kept whole; Φ aggregates
SSA
decomposition of T
split sessions; recombine in Ω
Session-level, where the full dialogue history of one session is inspected; • Cross-session, where multiple sessions or trajectories can be linked and analyzed jointly. The observation scope of M determines where harmful intent becomes detectable: some attacks only reveal intent at the session level, while session-splitting attacks require cross-session linkage. •
2.2. Threat Model
2.3. Taxonomy based on Intent Analysis
Scope. We specify a threat-model space rather than a single fixed setting, because existing multi-turn jailbreak methods differ in attacker access, session organization, and defender observation. The adversary is given a harmful target objective T and interacts with a deployed LLM or LLMbased system through its conversation interface. We do not consider attacks that modify the victim model, its safety training data, or the deployment infrastructure. Attacker capabilities. The attacker can issue user-side queries, observe victim responses, and adapt later queries based on earlier interaction outcomes. Depending on the method, the attacker may be a human operator, a fixed template, an auxiliary LLM, an optimizer, or a multi-agent system. We distinguish black-box access, where only input– output behavior is visible, from white-box access, where internal signals such as attention scores or hidden states may also be used. Unless a method explicitly relies on internal model signals, we treat it as operating under blackbox interaction. Session structure. We consider three session settings: • Single-session attacks proceed within one continuous dialogue. • Shared-state attacks explore multiple trajectories for the same target and share information across branches. • Isolated cross-session attacks distribute sub-objectives across independent sessions and recombine their outputs outside any single session. Defender observation. The deployment-time monitor M is distinct from the evaluation judge J . The judge J is used to measure whether the extracted output satisfies T , whereas M represents the safety mechanism that the deployed system can actually apply. We distinguish three observation scopes for M: • Turn-level, where only the current query, response, or local turn context is inspected;
Classification axis. Surveying existing multi-turn methods, we find that they differ in a single respect, namely, which formal object from Subsection 2.1 the adversary organizes harmful intent through, while holding the others fixed. As shown in Table 1, this gives four categories: • Dialogue-escalation Attacks (DEA) organizes intent by progressively shaping the dialogue context through query content q and policy π . • Strategy-refinement Attacks (SRA) keeps the harmful target fixed and refines the strategy trajectory σ via update µ. • Trajectory-branching Attacks (TBA) organizes intent through branching histories Ht by activating multiple trajectories Kt . • Session-splitting Attacks (SSA) splits the target T across isolated sessions and recombines outputs through Ω. These four dimensions capture the cross-turn control points observed across the surveyed methods, with each method organized around one of them as its dominant mechanism. Specialization of the general loop. Each category is a specialization of Algorithm Algorithm 1: it leaves free the single object through which it organizes intent and fixes or trivializes the rest, as the right column of Table 1 records. The single-trajectory categories (DEA, SRA) keep Kt ≡ 1 and St ≡ ∅ and differ only in whether the active lever is π or µ; the multi-trajectory categories (TBA, SSA) activate Kt > 1 and differ in whether intent is spread across branches of one objective or split across isolated sessions. We develop each category in Subsection 3.1 through Subsection 3.4.
2.4. Comparison with Existing Works Existing work has studied LLM jailbreaks through broad security and privacy surveys, jailbreak-focused taxonomies,
empirical benchmarks, frameworks, and recent SoK studies. Broad surveys usually discuss jailbreak as part of the general LLM security landscape [18], [64], [70], [71]. Jailbreak-focused works organize attacks by attacker access, defense placement, prompt techniques, or attack-defense performance [34], [35], [66], while other studies decompose prompt security threats [67], extend the scope to LLMs, MLLMs, and agents [45], or systematize jailbreak vectors [47]. Recent SoK studies further examine jailbreak guardrails [65] and jailbreak robustness under multidimensional evaluation settings [69]. These studies provide valuable coverage of jailbreak attacks, defenses, and evaluation protocols, but they still leave two critical gaps for multi-turn jailbreaks. ① Limited treatment of multi-turn interaction. Existing works rarely treat multi-turn jailbreak as an independent threat model. When multi-turn attacks are covered, they are usually described as a subtype of prompt-based jailbreak or as an extension of single-turn attacks. This view overlooks that harmful intent may not appear in any single prompt, but may emerge through dialogue construction, response-based adaptation, or cross-session decomposition. As a result, prior work does not fully explain how interaction changes the attack surface or where harmful intent becomes observable to a defender. ② Limited mechanism-level analysis. Existing evaluations mainly report outcome metrics such as attack success rate, defense success rate, utility preservation, or judge agreement. These metrics compare attacks and defenses, but they do not reveal the logic that makes multi-turn jailbreaks effective. In particular, it remains unclear whether success is driven by accumulated context, query count, intent ordering, strategy trajectory, or objective decomposition across branches and sessions. This makes it difficult to determine whether a defense fails because of weak classification, insufficient observation scope, or an evaluation protocol that is not interaction-aware. Our work addresses these gaps by centering multi-turn jailbreak as an interaction-level threat and classifying attacks according to how harmful intent is organized across turns, trajectories, and sessions. Table 2 summarizes how this intent-oriented perspective differs from existing surveys, benchmarks, frameworks, and SoK studies.
3. Taxonomy-Guided Analysis of Multi-Turn Jailbreak Methods This section uses the taxonomy above to organize existing multi-turn jailbreak methods by how they advance harmful intent across turns. As shown in Table 3, the four categories differ in their attacker mechanism, interaction scope, session continuity, and detection surface. We therefore discuss each category through its organizing principle and representative sub-paradigms, rather than treating every method as a separate narrative thread.
3.1. Dialogue-escalation Attacks Dialogue-escalation Attacks (DEA) advance harmful intent through conversational content itself. Rather than searching over attack strategies at inference time, the attacker follows a largely static or semi-static interaction plan, using benign, ambiguous, or weakly related turns to make the final prohibited request appear coherent, justified, and contextually licensed [17], [57]. Formally, DEA instantiates the general interaction loop in Algorithm 1 with a single trajectory, i.e., Kt ≡ 1 and St ≡ ∅. Its distinguishing feature is that the strategy update µ is mostly fixed as a staged script, while the query policy π progressively embeds the harmful intent into the dialogue history. This design exploits model-level vulnerabilities such as attention allocation, recency bias, instruction drift, and conversational consistency [50], [72], [73], as well as interaction-level compliance effects such as Foot-in-theDoor and semantic consistency [54]. The central mechanism is not that the attacker asks more questions, but that earlier turns reshape how later turns are interpreted. DEA manipulates how dialogue history frames intent and constraints, allowing later requests to inherit the apparent legitimacy of earlier turns [14], [41]. We organize DEA into three subparadigms: cognitive and psychological strategies, context manipulation and attention shifting, and task decomposition and knowledge aggregation. Cognitive Biases and Psychological Strategies. This sub-paradigm treats multi-turn interaction as a gradual compliance-shaping process. The attacker first establishes agreement on benign or weakly related requests, then escalates toward the harmful target while preserving conversational continuity. Crescendo [53] shows that innocuous prompts can incrementally increase sensitivity, making the final harmful request appear as a natural continuation. Its effectiveness comes from the gap between local harmlessness and global trajectory: each turn remains plausible in isolation, while the sequence moves toward a prohibited endpoint. FITD [54] systematizes this intuition through Foot-inthe-Door, using small initial compliance and bridge prompts to support later boundary transgressions. Together, Crescendo and FITD show that DEA does not require the harmful intent to be explicit from the beginning. Rather, the intent is made progressively legible to the model through a staged conversational path, while remaining less salient to turn-local safety checks. However, neither study varies the organization of context while holding its volume fixed, leaving the relative contribution of staged organization and extended interaction length entangled. Context Manipulation and Attention Shifting. A second line of DEA methods shapes the dialogue context used to interpret the final request. The attacker does not primarily revise strategy turn by turn; instead, it constructs a context in which the final malicious query appears relevant, coherent, and permissible. Thus, the harmful request is reframed by prior turns rather than merely appended to them. CIA [55] demonstrates this principle through dialoguecontext grooming, where benign but strategic turns prepare
TABLE 2: Comparison with existing surveys, benchmarks, frameworks, and SoKs on LLM jailbreaks from an intent-oriented interaction perspective. MT: whether multi-turn jailbreak is treated as a first-class threat. Interaction Unit: the primary unit of analysis used by the work. Intent Analysis: whether the work analyzes how harmful intent is organized, advanced, or hidden across turns, trajectories, or sessions. Mechanism: whether targeted empirical analyses or controlled ablations are conducted to explain attack mechanisms. Detect Surface: whether the work studies the level at which harmful intent becomes observable. Evaluation: whether evaluation protocols, judges, or judge reliability are systematically discussed. Defense: whether defenses or guardrails are systematically discussed. = covered, # = not covered, # G = partially covered. Work
Year
Type
[64] [34] [35] [18] [70] [45] [67] [66] [47] [65] [69]
2023 2024 2024 2024 2025 2025 2025 2026 2026 2026 2026
Survey Survey Benchmark Survey Survey Survey SoK Survey Survey SoK SoK
Ours
2026
SoK
Interaction Perspective
Primary Axis
Adversarial attack surface Attacker access & defense placement Attack defense comparison Security & privacy lifecycle Security & privacy lifecycle Technology evolution Prompt-security threat model Prompt-based technique taxonomy Jailbreak vector taxonomy Jailbreak guardrail taxonomy robustness evaluation Intent organization
MT
Interaction Unit
# G # # # # G # G # G # # G G # # G
Prompt / model Prompt / turn Prompt / instance System lifecycle System lifecycle LLM / MLLM / agent Prompt / threat unit Prompt / turn Attack vector Guardrail Security Cube Interaction path
the model to answer the final malicious prompt. CFA [56] attributes this effect to instructional drift and recency bias, under which earlier safety constraints lose influence while recent attacker-controlled turns gain weight. AMA [74] refines the mechanism through analogy, replacing benign elements with harmful counterparts after establishing a shared response structure. ActorAttack [75] automates this sub-paradigm by generating contextually aligned multi-turn attacks around the harmful target. Across these methods, the common mechanism is not repetition, but construction of a dialogue history that changes how the final request is interpreted. The progression from CIA and CFA to AMA and ActorAttack shows a shift from manual context grooming toward structured discovery of contextual attack paths. However, amplification mechanisms such as diverse semantic pathways and embedded reasoning chains are often introduced together, leaving their separate contributions unclear. Task Decomposition and Knowledge Aggregation. The third DEA sub-paradigm advances harmful intent by decomposing a prohibited objective into individually benign sub-queries. Each turn can appear harmless in isolation, but the sequence collectively supplies the information needed for the harmful objective. The attack succeeds when partial outputs are aggregated, either by the attacker or through the model’s own reasoning trajectory. Compared with psychological escalation and context manipulation, this subparadigm hides intent by distributing the target across apparently disconnected local tasks. Speak-Out-of-Turn [80] illustrates this vulnerability by splitting harmful tasks into seemingly unrelated sub-queries, preventing the model from recognizing the malicious metaobjective. MRJ-Agent [81] and Imposter.AI [78] strengthen this disguise by making sub-queries more covert or professionally motivated. SIREN [82] introduces learned decomposition strategies, while RACE [76] shifts from aggregation to guided reasoning, making the harmful conclusion emerge from an apparently benign inference chain.
Mechanism Perspective
Evaluation / Defense Perspective
Intent Analysis
Mechanism
Detect Surface
Evaluation
Defense
# # # # # G # # # # G # #
# # # G # # # # G G # # # G # G
# G # # # G # G G # G # # G # G # # G
#
G #
G # G #
G #
These methods show that DEA can organize harmful intent not only through escalation in sensitivity, but also through distribution across benign-looking sub-goals. The resulting threat is still single-session and single-trajectory, but harmfulness becomes visible only when the dialogue history is interpreted as a whole. Observations across Sub-Paradigms. Despite their surface differences, the three sub-paradigms converge on a shared mechanism: earlier turns reshape the interpretive context in which the final request is evaluated. Psychological strategies build compliance momentum, context manipulation constructs semantic framing, and task decomposition distributes the target across innocuous sub-goals. In all three cases, no single turn fully carries harmful intent; it becomes visible only when the trajectory is read as a whole. This reliance on trajectory-level intent organization, however, co-varies with a factor that existing studies do not isolate. Methods that organize intent more carefully also produce longer dialogue histories, so it remains unclear whether effectiveness is driven by intent arrangement or by accumulated context. A related ambiguity appears at the component level: DEA methods often combine additional amplification components, such as diversified semantic pathways and embedded multi-step reasoning chains, without ablation. Their individual contributions therefore remain unknown. Takeaway 1: DEA derives its effectiveness from organizing earlier turns to reshape how later ones are interpreted, making harmful intent invisible at the turn level yet fully legible across the trajectory. The two unresolved factors identified above motivate two questions for controlled ablation in Section 4. RQ 1: DEA methods that organize intent more deliberately also produce longer dialogue histories and more queries. Is the observed effectiveness determined by
TABLE 3: Taxonomy of multi-turn jailbreak methods across key adversarial dimensions. 1 Attacker Mechanism describes strategy-level decision-making: Template = fixed algorithm, LLM generates content only; LLM = adaptively decides next strategy from victim replies; RL = reinforcement learning; MA = multiple LLM agents with distinct roles; Human = human red teamer. 2 Interaction Scope characterizes the breadth of attack trajectories: Single = single trajectory; Multi = multiple parallel trajectories or sessions. 3 Session Continuity captures how the dialogue thread is structured across turns: Linear = single coherent thread; Branching = parallel branching paths; Fragmented = deliberately split across isolated sessions. 4 Detection Surface indicates the granularity at which defenses must operate: Turn-level = intent detectable within a single message; Session-level = full session context required; Cross-session = intent only emerges across independent sessions. Category
Sub-paradigm
Psychological Dialogue-escalation Attacks (DEA)
Context Manipulation
Task Decomposition Fixed-strategy Strategy-refinement Attacks (SRA)
Adaptive-optimization Agent-based
Trajectory-branching Attacks (TBA) Session-Splitting Attacks (SSA)
/
/
Attacker Mechanism1
Interaction Scope2
Session Continuity3
Detection Surface4
References
Template
Single
Linear
Session-level
[54]
LLM
Single
Linear
Session-level
[53]
Template
Single
Linear
Session-level
[56], [74]
LLM
Single
Linear
Session-level
[55], [75], [76], [77]
Template
Single
Linear
Session-level
[78], [79]
LLM
Single
Linear
Session-level
[80], [81], [82]
Template
Single
Linear
Turn-level
[83], [84]
LLM
Single
Linear
Turn-level
[85]
RL
Single
Linear
Turn-level
[86], [87], [88]
LLM
Single
Linear
Session-level
[58], [59], [89]
MA
Single
Linear
Session-level
[61]
LLM
Multi
Branching
Session-level
[60]
Template
Multi
Branching
Session-level
[90]
Human
Multi
Branching
Session-level
[52]
MA
Multi
Fragmented
Cross-session
[62], [63]
how intent is organized across the trajectory, or by the volume of multi-turn context that accumulates during the interaction? RQ 2: Individual DEA methods embed various amplification components within the trajectory, such as diversified semantic pathways and multi-step reasoning chains. To what extent does each independently contribute to effectiveness?
3.2. Strategy-refinement Attacks Strategy-refinement Attacks (SRA) advance harmful intent by planning the attacker’s strategy trajectory. Unlike DEA, where the main control point is how the query policy π embeds intent into conversational content, SRA keeps the malicious objective fixed and varies the strategy sequence used to reach it across turns. Formally, SRA shares the single-trajectory specialization of DEA, i.e., Kt ≡ 1 and St ≡ ∅, but instantiates the general interaction loop in Algorithm 1 differently: the primary locus of control shifts from π to the strategy update µ. The query policy executes the current strategy, while µ determines how that strategy is selected, escalated, or revised. This shift makes SRA a planning problem over attack routes rather than a pure context-shaping problem. The
harmful target remains stable, but the attacker may follow a pre-designed schedule, optimize strategy choices from feedback, or delegate strategic reasoning to an LLM-based agent. Accordingly, we organize SRA into three sub-paradigms according to how µ is realized: Fixed-strategy, Adaptiveoptimization, and Agent-based. Fixed-strategy Jailbreak. Fixed-strategy SRA methods construct the entire strategy sequence offline through human design, with no strategy revision at inference time. The attacker specifies a staged route in advance and executes it as written, usually increasing pressure or directness while keeping intermediate turns plausible. This makes the attack simple and reproducible, but limits recovery once the victim model resists the planned trajectory. MRCJ [83] exemplifies this category through schedule design. It organizes the interaction around auxiliary questions whose malice increases monotonically, culminating in the final prohibited request. This ordered schedule turns earlier participation and prior responses into contextual support for later turns, but also extends the dialogue beyond a direct attack. In contrast, the EMRA dataset in CoopGuard [84] operationalizes fixed-strategy-refinement through deterministic prompt transformations with increasing directness. Its staged process of “original question → rephrased question → jailbreak question” functions as a short fixed difficulty ladder without requiring a long adaptive loop. Thus, fixed-strategy
methods trade inference-time adaptivity for simplicity: they are inexpensive and reproducible, but cannot adjust course when the pre-planned sequence fails. Moreover, because schedules such as MRCJ increase both strategic organization and dialogue length, they do not isolate the contributions of strategy structure and context volume. Adaptive-optimization Jailbreak. Adaptive-optimization SRA methods introduce the inference-time decision channel that fixed strategies lack. They cast strategy selection as feedback-driven optimization: the attacker proposes candidate strategies, observes or scores the victim’s response, and updates future choices according to an explicit success signal. Compared with fixed schedules, this makes the strategy trajectory less rigid, but increases query cost and stochasticity. ASJA [85] realizes this loop through evolutionary search, maintaining candidate strategies and recombining them under an optimization signal derived from attention over malicious keywords. This can exploit internal signals when available, but restricts applicability in strict black-box settings. SoC-MAB [86] extends the principle to black-box targets by recasting strategy selection as a Multi-Armed Bandit problem, using an external discriminator to score responses and reward effective Context-Switching Queries. iMIST [87] further embeds the loop in a reinforcement learning policy, disguising malicious actions as ordinary tool invocations and optimizing the action sequence under realtime reward. In summary, adaptive-optimization methods replace hand-crafted schedules with algorithmic search under scalar feedback. They are more flexible under heterogeneous defenses, but their strategic reasoning remains mediated by a reward or score signal. This limitation motivates agent-based methods, which replace scalar optimization with an LLMdriven planner capable of reasoning semantically about failures, goals, and alternative attack routes. Agent-based Jailbreak. Agent-based SR methods realize µ through an LLM-driven planner. Instead of selecting from a fixed schedule or optimizing a scalar reward, the attacker LLM observes the victim’s response, reflects on failure modes, and revises the strategy in natural-language terms. This supports long-horizon planning that is difficult to express as prompt transformations or reward maximization alone. GOAT [58] is the foundational instance, pairing an attacker LLM with the target model and using Chainof-Thought to revise strategies after failed attempts. GALA [59] extends this design by maintaining an explicit tactical context that is updated across the attack, enabling refinement at both the strategy and prompt levels. RedCoder [89] specializes this agentic framework for malicious code generation by distilling reusable attack tactics, while X-Teaming [61] broadens the attacker side into a multi-agent pipeline that plans, executes, verifies, and rewrites attack queries. Collectively, agent-based methods mark a shift from optimizing individual prompts to optimizing an attacker policy. The attacker maintains an evolving internal state,
reasons over interaction outcomes, and plans over future steps, making the strategy trajectory itself the main object of jailbreak design. Whether this increasing sophistication yields proportionally higher attack success under controlled comparison remains open. Observations across Sub-Paradigms. The three subparadigms share a single principle: the harmful objective is held fixed while the attacker plans the strategy route toward it. As in DEA, this principle faces the organizationversus-accumulation confound: strategy sequences that organize intent more deliberately also produce longer dialogue histories, and existing evaluations do not control for one while varying the other. RQ1 therefore extends to SRA, and Section 4 addresses it with evidence from both categories. A second observation arises from Fixed-strategy SRA. MRCJ varies not only the sequence structure but also the increment profile within ordered sequences, holding the endpoint malice level and turn count fixed. This design isolates a question that RQ1 does not address: whether the optimal escalation shape depends on target alignment strength. A third observation concerns the sub-paradigm hierarchy. The three sub-paradigms form an architectural hierarchy of increasing inference-time decision-making, but whether this hierarchy corresponds to a consistent progression in attack effectiveness has not been tested under unified conditions. The answer may depend on target alignment strength: fixed schedules might already suffice against weakly aligned models, while the gains from adaptive and agent-based methods may emerge only against harder targets. Takeaway 2: SRA recasts multi-turn jailbreak as a planning problem over the strategy route rather than a content-shaping problem, showing that how the attacker approaches a fixed objective is an independent driver of effectiveness beyond the manipulation of individual turns. As discussed above, RQ1 extends to SRA and will be addressed with evidence from both categories in Section 4. Two further questions are specific to SRA. RQ 3: Given that deliberate organization drives effectiveness (RQ1), does the optimal escalation profile depend on target alignment strength, or does a single trajectory shape universally suffice? RQ 4: The three SRA sub-paradigms represent an increasing degree of inference-time decision-making over the strategy trajectory. Does this progression correspond to a consistent increase in attack effectiveness, and under what conditions does the stronger organization justify its additional cost?
3.3. Trajectory-branching Attacks Trajectory-branching Attacks (TBA) keep the harmful objective intact while exploring multiple conversational paths in parallel, exploiting the fact that vulnerable framings may be unevenly distributed across personas, contexts, reasoning trajectories, and linguistic variants. Formally, TBA instantiates Algorithm 1 with Kt > 1 concurrent trajectories and a non-empty shared state St : the update function Φ aggregates cross-branch signals, and the query policy π uses this shared state to guide subsequent exploration. The defining control point is therefore the branching structure of Ht itself, shifting the relevant safety question from whether one dialogue is malicious to whether multiple related trajectories jointly reveal an adversarial search process. TAP [40] provides the canonical instantiation of this paradigm by framing jailbreak generation as a tree-search problem. It iteratively expands candidate prompts using an attacker LLM and prunes low-potential branches before querying the target model, demonstrating that structured branching substantially improves search efficiency and attack success. Tempest [60] extends this idea through automated breadth-first exploration driven by an attacker LLM, propagating partial compliance signals across parallel trajectories so that incremental policy leaks accumulate into a coherent jailbreak. SLIP [90] retains the same breadth-first branching structure but removes the attacker LLM, expanding each node by injecting a missing content word from the target query into an otherwise benign prompt, thereby isolating the contribution of the search structure from that of adaptive attacker optimization. MHJ [52] replaces the automated attacker with human red teamers and observes that expert attackers naturally converge to similar branching exploration strategies. Across these representative methods, the common mechanism is not a particular search algorithm but the deliberate branching of conversational trajectories to explore alternative realizations of the same harmful objective. Unlike DEA and SRA, we do not formulate a dedicated experimental RQ for Section 4; instead, TBA serves as an analytical case illustrating how trajectory branching enlarges the effective detection surface from individual dialogues to collections of related interaction histories. Takeaway 3: In Trajectory branching attacks, harmful intent is organized through coordinated trajectory exploration rather than any individual dialogue, requiring safety mechanisms to reason over the search process instead of isolated conversations.
3.4. Session-Splitting Attacks Session-Splitting Attacks (SSA) advance harmful intent by decomposing a malicious objective across mutually isolated sessions or agentic sub-tasks, so that each session receives only a benign-looking partial sub-objective and the prohibited content emerges only after the outputs are recombined. Formally, SSA instantiates Algorithm 1 with
a fixed set of isolated trajectories Kt ≡ S , corresponding to decomposed targets {T1 , . . . , TS }; the query policy π runs independently within each session, cross-session conditioning is absent by construction, and the defining mechanism resides in the extraction function Ω, which aggregates per-session outputs to reconstruct the prohibited result. Unlike TBA, which explores multiple branches of the same intact objective, SSA splits the target itself, moving harmful intent outside the observable context of any single session. This cross-session fragility is consistent with recent prompt-leakage attacks in multi-tenant LLM deployments, where security failures arise from weak isolation or insufficient global context awareness across interacting components [91], [92]. Two representative works concretize this paradigm along different axes. Wahréus et al. [63] target malicious code generation: a harmful prompt is segmented into high-level function descriptions, processed in parallel across an LLM network, and aggregated into a runnable program. Srivastav et al. [62] generalize this divide-and-conquer principle beyond a single domain by introducing a role-based multi-agent pipeline in which a Question Decomposer, a Sub-Question Answerer, and an Answer Combiner collaboratively reconstruct harmful content without relying on prompt-level manipulations. Both instances confirm that harmfulness resides not in any individual session but in the orchestration layer that decomposes and recombines intent, making SSA the most outward form of intent organization in our taxonomy: where DEA and SRA require session-level observation and TBA requires cross-branch analysis, SSA requires cross-session linkage. For this reason, we treat SSA analytically rather than as a direct RQ in Section 4: its core implication concerns the observation boundary of current evaluation and defense mechanisms. Takeaway 4: Unlike previous categories, SSA distributes harmful intent across multiple isolated sessions such that no individual interaction contains sufficient evidence of maliciousness.
4. Mechanism Analysis 4.1. Scope of Analysis Objective. This section uses controlled experiments to address the four questions posed in Subsection 2.3. Together, they test a single overarching claim: that the deliberate organization of intent across turns, rather than the accumulation of multi-turn context, is the primary driver of attack effectiveness. Empirical Coverage. The experiments cover DEA and SRA, the two single-trajectory categories for which open implementations exist and whose intent-organization mechanisms can be isolated under controlled ablation. TBA and SSA currently lack public implementations; we systematize them analytically in Subsection 2.3. This asymmetry is
TABLE 4: ASR of DEA across four target models under three multi-turn interaction strategies. Models are arranged by increasing alignment robustness from left to right.
TABLE 6: Relative ASR gain of different sequence construction strategies across target models Target Models
Strategy
Strategy
Llama-3
DeepSeek-V3
GPT-4o
Llama-3.3-70B
Direct Attack Persistence FITD
0.340 0.370 0.960
0.430 0.450 0.820
0.120 0.180 0.710
0.050 0.090 0.440
TABLE 5: Final ASR of different sequence construction strategies across target models
Ordered Repeated Shuffled
0.900 0.900 0.160
0.840 0.840 0.220
0.320 0.220 0.320
0.740 0.660 0.200
1.000 0.960 0.940
0.820 0.460 0.460
0.700 0.460 0.640
TABLE 7: Final harmful score of different sequence construction strategies across target models Target Models
Strategy
Target Models
Strategy
Vicuna-7b Vicuna-13b Mistral ChatGLM Qwen2 Llama-3 Gemma-2-9B
Vicuna-7b Vicuna-13b Mistral ChatGLM Qwen2 Llama-3 Gemma-2-9B
Vicuna-7b Vicuna-13b Mistral ChatGLM Qwen2 Llama-3 Gemma-2-9B Ordered Repeated Shuffled
0.960 0.960 0.240
1.000 1.000 0.280
1.000 0.900 1.000
0.740 0.660 0.600
1.000 0.960 0.940
0.820 0.460 0.480
0.720 0.480 0.660
itself informative: the categories that resist reproduction are precisely those whose intent organization extends to crosssession coordination, where current evaluation has the least coverage. Competing Hypotheses. Two explanations compete for multi-turn attack effectiveness. The accumulation hypothesis attributes success to the volume of context, regardless of how it is organized. The organization hypothesis attributes success to the structure of intent across the trajectory, even when context volume is held fixed. The analysis proceeds along two axes. RQ1 and RQ3 address what drives effectiveness: RQ1 adjudicates between the two hypotheses, and RQ3 refines the result by examining how escalation shape interacts with target robustness. RQ2 and RQ4 address what amplifies and scales organized intent, respectively. The experimental configuration shared across all four analyses is specified in Appendix A.
4.2. Organization versus Accumulation Two competing explanations account for multi-turn jailbreak effectiveness. The accumulation hypothesis attributes success to context volume: a longer dialogue history degrades safety behavior regardless of internal organization. The organization hypothesis attributes success to how harmful intent is sequenced across turns, even at constant context volume. RQ1 asks which factor is primary. We draw evidence from both DEA and SRA, using FITD and MRCJ as representative instantiations. FITD varies the construction of conversational content across turns, while MRCJ varies the ordering of the attack-strategy sequence; together, they ensure the conclusion does not depend on a single method or a single aspect of the attack process. DEA-side evidence: FITD. We evaluate FITD-style DEA [54] on four target models (Llama-3, DeepSeek-V3, GPT-4o, and Llama-3.3-70B). For each model we compare three interaction strategies that share the same target queries and differ only in how the query sequence is organized: •
Direct Attack. The malicious query is presented in a zero-shot fashion.
Ordered Repeated Shuffled
4.84 4.84 3.26
4.64 4.64 3.48
4.64 3.88 4.64
3.94 3.58 3.26
4.86 4.86 4.08
4.06 3.06 2.86
3.62 2.94 3.14
Persistence Strategy. Upon refusal, the attacker retries the same request with minor rephrasing for a fixed number of attempts, without introducing benign context. • FITD. The conversation starts from safe, related topics and progressively increases sensitivity before posing the target query. The Persistence condition produces a multi-turn interaction of comparable length to the Escalation condition but without organizing its content toward the harmful objective, thereby isolating the effect of content organization from that of interaction length. As Table 4 shows, Direct Attack and Persistence yield comparable Attack Success Rate (ASR) across all four models, while FITD-style escalation achieves consistently higher rates regardless of alignment strength. This pattern indicates that DEA effectiveness is driven by how conversational content is organized across turns, not by the number of queries issued. SRA-side evidence: MRCJ. We draw complementary evidence from the MRCJ methodology, which controls a different aspect of the attack: the ordering of the strategy sequence rather than the content of individual turns. We evaluate seven safety-aligned target models using auxiliary questions from MUCD, which labels each question with a discrete malice level, and final target questions from AdvBench [38]. We compare three orderings of the auxiliary-question sequence, holding turn count and available malice levels fixed: • Ordered. Auxiliary questions are arranged by strictly increasing malice level. • Repeated. Low-malice auxiliary turns are reused throughout the interaction, producing the same context volume without escalation. • Shuffled. Auxiliary questions are sampled across malice levels without coherent ordering, preserving the distribution but destroying sequential structure. As Table 5, Table 6, and Table 7 show, Ordered achieves the strongest ASR, relative ASR gain, and harmfulness scores across all models, with the gap most pronounced on robustly aligned targets such as ChatGLM and Llama-3. Because •
TABLE 8: Round-by-round ASR progression for different ∆Θ escalation profiles across target models. Colors progress from low to high , indicating increasing progression intensity. Model
ChatGLM
{+1, +1, +1, +1} {+1, +0, +1, +2} {+1, +2, +1, +0} {+1, +0, +2, +1} {+1, +1, +0, +2} {+1, +1, +2, +0} {+1, +2, +0, +1}
{ 0.12 , 0.98 , 0.90 , 0.96 } { 0.12 , 0.38 , 0.94 , 0.96 } { 0.42 , 0.80 , 0.86 , 0.62 } { 0.12 , 0.40 , 0.88 , 0.98 } { 0.12 , 0.98 , 0.96 , 0.96 } { 0.10 , 1.00 , 0.90 , 1.00 } { 0.12 , 0.92 , 0.98 , 0.90 }
Model
Vicuna-7b
Mistral
Qwen2
{ 0.00 , 0.02 , 0.60 , 0.68 } { 0.02 , 0.06 , 0.94 , 0.96 } { 0.02 , 0.42 , 0.68 , 0.86 } { 0.02 , 0.06 , 0.44 , 0.20 } { 0.02 , 0.04 , 0.82 , 0.88 } { 0.02 , 0.14 , 0.62 , 0.54 } { 0.02 , 0.10 , 0.74 , 0.86 }
{ 0.80 , 1.00 , 1.00 , 0.98 } { 0.54 , 0.58 , 0.92 , 0.92 } { 0.80 , 1.00 , 1.00 , 1.00 } { 0.38 , 0.60 , 0.70 , 0.66 } { 0.38 , 1.00 , 0.98 , 1.00 } { 0.80 , 1.00 , 0.98 , 1.00 } { 0.38 , 0.96 , 0.90 , 0.92 }
{ 0.20 , 1.00 , 0.72 , 1.00 } { 0.20 , 0.54 , 0.12 , 0.28 } { 0.16 , 0.64 , 0.72 , 0.84 } { 0.28 , 0.30 , 0.22 , 0.74 } { 0.36 , 0.90 , 0.18 , 0.10 } { 0.20 , 0.90 , 1.00 , 1.00 } { 0.20 , 0.60 , 0.72 , 0.72 }
Vicuna-13b
Gemma-2-9B
Average
ASR sequences: {ASRΘ1 , ASRΘ2 , ASRΘ3 , ASRΘ4 }
∆Θ Sequence {+1, +1, +1, +1} {+1, +0, +1, +2} {+1, +2, +1, +0} {+1, +0, +2, +1} {+1, +1, +0, +2} {+1, +1, +2, +0} {+1, +2, +0, +1}
Llama-3
ASR sequences: {ASRΘ1 , ASRΘ2 , ASRΘ3 , ASRΘ4 }
∆Θ Sequence
{ 0.98 , 1.00 , 1.00 , 1.00 } { 0.98 , 0.98 , 1.00 , 1.00 } { 0.98 , 1.00 , 0.98 , 0.90 } { 0.98 , 0.98 , 1.00 , 0.98 } { 0.98 , 1.00 , 0.94 , 1.00 } { 1.00 , 1.00 , 1.00 , 0.86 } { 0.98 , 1.00 , 0.90 , 0.90 }
{ 0.84 , 1.00 , 0.98 , 0.98 } { 0.84 , 0.94 , 1.00 , 0.94 } { 0.84 , 0.94 , 0.92 , 0.82 } { 0.84 , 0.94 , 1.00 , 1.00 } { 0.84 , 1.00 , 1.00 , 0.86 } { 0.84 , 1.00 , 0.98 , 0.96 } { 0.94 , 0.96 , 1.00 , 1.00 }
Repeated provides the same context volume and Shuffled preserves the same malice-level distribution, the advantage of Ordered can only be attributed to its sequential structure. Cross-category synthesis. The two experiments control different aspects of the multi-turn attack yet converge on the same conclusion. FITD shows that organized escalation of conversational content outperforms request repetition at comparable interaction length; MRCJ shows that ordered strategy sequencing outperforms both flat repetition and random shuffling at the same turn count and malice-level inventory. In both cases, context volume is held approximately constant while organization varies, and in both cases organization proves decisive. This convergence indicates that multi-turn attack effectiveness is determined by how harmful intent is arranged across the trajectory, not by the amount of context that accumulates. The principle holds regardless of whether the attacker organizes the content of individual queries or the ordering of the overall strategy. Finding 1: Multi-turn attack effectiveness is determined by how harmful intent is organized across the interaction trajectory, not by the volume of accumulated context. This principle holds regardless of which aspect of the interaction the attacker chooses to organize.
{ 0.08 , 0.36 , 0.58 , 0.72 } { 0.04 , 0.10 , 0.62 , 0.80 } { 0.12 , 0.38 , 0.50 , 0.56 } { 0.04 , 0.08 , 0.32 , 0.38 } { 0.06 , 0.10 , 0.42 , 0.74 } { 0.08 , 0.18 , 0.44 , 0.50 } { 0.06 , 0.16 , 0.48 , 0.64 }
{ 0.43 , 0.77 , 0.83 , 0.90 } { 0.39 , 0.51 , 0.79 , 0.84 } { 0.48 , 0.74 , 0.81 , 0.80 } { 0.38 , 0.48 , 0.65 , 0.71 } { 0.39 , 0.72 , 0.76 , 0.79 } { 0.44 , 0.75 , 0.85 , 0.84 } { 0.39 , 0.67 , 0.82 , 0.85 }
Using the same MRCJ framework and models as Subsection 4.2, we fix the endpoint malice level and the number of escalation steps at four, varying only how the total increment is distributed across steps. All conditions are monotonically non-decreasing and differ only in escalation shape, providing a finer-grained comparison than the organizedversus-unorganized contrast of Subsection 4.2. The optimal profile depends on target alignment strength. Table 8 shows that on average across all targets, the uniform schedule {+1, +1, +1, +1} achieves the strongest final ASR, indicating that evenly paced escalation is a robust default when target-specific robustness is not known. On moderately aligned models (Vicuna-7b, Vicuna13b, Mistral), most increment profiles reach high final ASR; the uniform schedule {+1, +1, +1, +1} already suffices. On robustly aligned models (ChatGLM, Llama-3, Gemma2-9B), profile shape becomes decisive: schedules with a stabilization phase followed by a concentrated late jump, such as {+1, 0, +1, +2}, outperform uniform escalation. As shown in Table 9, the round-by-round harmful scores suggest a mechanism: effective non-uniform profiles maintain low harmful scores in early rounds, reducing the risk of premature defense activation, and concentrate the escalation in the final step.
4.3. Escalation Shape and Target Robustness Subsection 4.2 established that deliberate organization, rather than context accumulation, drives multi-turn attack effectiveness (RQ1). Organized escalation is not monolithic, however. The strategy sequence can follow different increment profiles, and RQ3 asks whether a single profile universally suffices or the optimal shape depends on target alignment strength.
Effective profiles tend to be efficient. On moderately aligned targets, Table 10 shows that the uniform schedule also achieves the lowest query time. On robustly aligned targets, non-uniform profiles that yield higher ASR also require fewer queries, indicating that matching escalation shape to defense strength improves both effectiveness and efficiency.
TABLE 9: Round-by-round harmfulness score progression for different ∆Θ escalation profiles across target models.Colors progress from low to high , indicating increasing progression intensity. ChatGLM
Model
Llama-3
{+1, +1, +1, +1} {+1, +0, +1, +2} {+1, +2, +1, +0} {+1, +0, +2, +1} {+1, +1, +0, +2} {+1, +1, +2, +0} {+1, +2, +0, +1}
{ 3.08 , 3.22 , 3.86 , 3.94 } { 1.40 , 2.50 , 4.58 , 4.46 } { 2.46 , 3.58 , 3.94 , 3.16 } { 1.40 , 2.52 , 4.30 , 4.48 } { 1.40 , 4.10 , 4.14 , 4.02 } { 1.38 , 4.38 , 3.92 , 4.20 } { 1.40 , 4.02 , 4.26 , 4.06 }
Model
Vicuna-7b
{+1, +1, +1, +1} {+1, +0, +1, +2} {+1, +2, +1, +0} {+1, +0, +2, +1} {+1, +1, +0, +2} {+1, +1, +2, +0} {+1, +2, +0, +1}
{ 1.00 , 1.08 , 3.02 , 3.26 } { 1.06 , 1.20 , 4.36 , 4.54 } { 1.08 , 2.48 , 3.26 , 3.74 } { 1.08 , 1.22 , 2.74 , 1.78 } { 1.08 , 1.16 , 3.76 , 4.12 } { 1.08 , 1.42 , 3.20 , 2.88 } { 1.08 , 1.36 , 3.88 , 4.26 }
{ 4.14 , 4.64 , 4.82 , 4.76 } { 3.04 , 3.10 , 4.14 , 4.00 } { 4.12 , 4.78 , 4.82 , 4.82 } { 2.50 , 3.14 , 3.70 , 3.66 } { 2.50 , 4.96 , 4.48 , 4.62 } { 4.10 , 4.62 , 4.38 , 4.26 } { 2.52 , 4.26 , 4.06 , 4.12 }
{ 1.80 , 4.48 , 3.64 , 4.04 } { 1.78 , 3.38 , 2.46 , 2.76 } { 1.68 , 3.44 , 3.62 , 3.84 } { 2.00 , 3.06 , 2.46 , 3.58 } { 2.24 , 3.96 , 3.10 , 3.10 } { 1.82 , 4.40 , 4.52 , 4.02 } { 1.82 , 3.56 , 3.70 , 3.66 }
Vicuna-13b
Gemma-2-9B
Average
{ 4.88 , 4.94 , 4.98 , 4.98 } { 4.88 , 4.80 , 4.96 , 4.96 } { 4.88 , 4.98 , 4.90 , 4.52 } { 4.88 , 4.78 , 4.92 , 4.86 } { 4.88 , 4.94 , 4.70 , 4.94 } { 4.94 , 4.92 , 4.98 , 4.36 } { 4.88 , 4.98 , 4.56 , 4.58 }
{ 4.14 , 4.92 , 4.72 , 4.76 } { 4.14 , 4.68 , 4.82 , 4.68 } { 4.24 , 4.66 , 4.64 , 4.20 } { 4.28 , 4.54 , 4.72 , 4.80 } { 4.12 , 4.90 , 4.82 , 4.38 } { 4.14 , 4.92 , 4.86 , 4.78 } { 4.68 , 4.74 , 4.98 , 4.98 }
TABLE 10: Efficiency analysis of malice-increment profiles: query time (QT) required by each schedule (lower is better). The shaded cells represent the minimum QT achieved for each model. {+1, +1, +1, +1} {+1, +0, +1, +2} {+1, +2, +1, +0} {+1, +0, +2, +1} {+1, +1, +0, +2} {+1, +1, +2, +0} {+1, +2, +0, +1}
ChatGLM Llama-3 Mistral Qwen2 Vicuna-7b Vicuna-13b Gemma-2-9B 87 108 169 112 86 84 96
Qwen2
Harmful score sequences: {ScoreΘ1 , ScoreΘ2 , ScoreΘ3 , ScoreΘ4 }
∆Θ Sequence
∆Θ Sequence
Mistral
Harmful score sequences: {ScoreΘ1 , ScoreΘ2 , ScoreΘ3 , ScoreΘ4 }
∆Θ Sequence
262 130 304 625 180 289 171
57 63 56 83 82 57 64
147 119 224 351 174 124 284
57 57 56 59 59 57 56
56 61 56 62 55 56 55
156 128 231 212 144 168 192
Finding 2: Uniform escalation is a strong aggregate default, but effective intent organization still requires adapting the escalation shape to the robustness of the target model.
4.4. Amplification within Organized Intent RQ2 asks to what extent amplification components embedded within organized DEA trajectories independently contribute to effectiveness. Methods in this category commonly combine components such as diversified semantic pathways and multi-step reasoning chains, yet existing evaluations introduce them together without isolating individual contributions. ActorAttack [75] is considered a representative instantiation in this paper because its design cleanly separates the two components, enabling independent ablation. We evaluate on three target models (DeepSeek-V3, GPT-4o, and Llama-3.3-70B). Semantic diversity and reasoning chains play complementary roles. ActorAttack combines two orthogonal mechanisms for organizing harmful intent: parallel semantic pathways broaden the search over diverse conversational
{ 1.28 , 2.42 , 3.18 , 3.62 } { 1.12 , 1.36 , 3.34 , 3.86 } { 1.42 , 2.50 , 2.88 , 3.06 } { 1.14 , 1.26 , 2.28 , 2.46 } { 1.20 , 1.38 , 2.68 , 3.70 } { 1.26 , 1.62 , 2.72 , 2.92 } { 1.20 , 1.58 , 2.82 , 3.36 }
{ 2.90 , 3.68 , 4.03 , 4.19 } { 2.49 , 3.00 , 4.09 , 4.18 } { 2.84 , 3.77 , 4.01 , 3.91 } { 2.47 , 2.93 , 3.59 , 3.66 } { 2.50 , 3.63 , 3.95 , 4.13 } { 2.67 , 3.75 , 4.08 , 3.92 } { 2.51 , 3.51 , 4.04 , 4.15 }
framings, while reasoning chains progressively contextualize harmful intent within each pathway. To quantify the contributions, we separately vary the number of semantic pathways and remove reasoning chains while holding all remaining components fixed, as demonstrated in Figure 2. From Figure 2a, we can see that increasing semantic pathway diversity consistently improves attack success across all evaluated models, indicating that different pathways expose complementary vulnerabilities by presenting the same malicious objective through semantically distinct conversational trajectories. The improvement, however, gradually saturates, suggesting that additional pathways mainly increase the probability of discovering an effective attack trajectory rather than fundamentally changing how harmful intent is organized. By contrast, Figure 2b shows that removing reasoning chains leads to a substantial degradation in attack success across all target models. This observation indicates that reasoning chains constitute the primary mechanism underlying ActorAttack: rather than exposing harmful intent directly, they progressively establish a legitimate semantic context in which the final malicious objective appears as the natural conclusion of an otherwise benign reasoning process. Together, these results suggest that semantic diversity expands the attack surface, whereas reasoning chains provide a stronger mechanism for progressively embedding harmful intent. Components contribute independently through complementary mechanisms. Semantic diversity explores alternative framings of the harmful objective, while reasoning chains increase the persuasiveness of each framing. Within ActorAttack, reasoning chains account for the larger share, though the relative balance may differ across methods.
DeepSeek
GPT-4o
Without reasoning
Llama-3.3
+0.418
Full ActorAttack
+0.480
0.8
0.9
ASR
ASR
+0.372
0.8
0.6 0.4
0.7 0.6
of stronger inference-time decision-making becomes more consequential as defenses strengthen.
1
2
3
4
5
0.2
DeepSeek
(a) Number of parallel pathways
GPT-4o
Finding 4: The three SRA sub-paradigms form a genuine capability hierarchy, not interchangeable variants. The hierarchy becomes more consequential against stronger defenses, where increasing inference-time decision-making capacity yields the largest gains.
Llama-3.3
(b) Target model
Figure 2: Ablation study of two key aspects of ActorAttack. (a) Increasing the number of parallel semantic pathways consistently improves attack success across target models. (b) Removing reasoning chains substantially reduces attack success, indicating that progressive reasoning contributes more to attack effectiveness than semantic diversity alone. TABLE 11: ASR on the main chain across three target models. Samples are drawn from JailbreakBench. Setting
DeepSeek-V3
GPT-4o
Llama-3.3-70B
Gemini-3.1-Flash
A1 A2 A3
0.770 0.810 0.980
0.540 0.640 0.820
0.470 0.600 0.700
0.270 0.340 0.470
Finding 3: Amplification components within organized trajectories further enhance attack effectiveness through complementary mechanisms. Multi-turn attack effectiveness is therefore compositional: trajectorylevel intent organization provides the foundation, while method-specific components amplify its effect.
4.5. Sub-Paradigm Progression RQ4 asks whether the three SRA sub-paradigms, Fixedstrategy, Adaptive-optimization, and Agent-based, correspond to genuinely distinct capability levels or are interchangeable implementations at comparable effectiveness. Same-backbone ablation design. To isolate the subparadigm signal from implementation-level confounds, we construct an ablation chain on a single backbone, XTeaming [61]. Specifically, we systematically vary one strategy-refinement component at a time, with the detailed construction reported in Appendix A.5 and Table 16. Adjacent conditions differ in exactly one component, making each pairwise gap interpretable as the marginal contribution of a single sub-paradigm transition. We evaluate on DeepSeek-V3, GPT-4o, Llama-3.3-70B and Gemini-3.1Flash; all conditions share a fixed turn budget and constant retry count, ensuring that observed gains cannot be attributed to differential compute. The three sub-paradigms form a genuine hierarchy. As Table 11 shows, ASR increases monotonically from A1 to A3 on every target, confirming that the three sub-paradigms correspond to distinct capability levels rather than interchangeable variants. The relative gain from A1 to A3 grows with target alignment strength, indicating that the advantage
5. Discussion Intent Analysis and the Detection Surface. Our taxonomy classifies multi-turn jailbreaks by where harmful intent is organized, and the mechanism analysis shows that this organization determines the required detection scope. DEA and SRA require session-level observation because harmful intent emerges only across a dialogue. TBA distributes intent across parallel branches, requiring joint trajectory analysis, while SSA further disperses it across isolated sessions, making cross-session aggregation necessary. Accordingly, the required detection surface shifts from the turn level to the session level and ultimately to the cross-session level as intent becomes increasingly distributed. This progression highlights the limitations of turn-local defenses and singlepoint ASR evaluation for advanced multi-turn jailbreaks. Future Directions. We identify several promising directions for future research that follow from the analysis above. • Interaction-aware evaluation. Current evaluations reduce multi-turn attacks to a single ASR score, overlooking how harmful intent is organized. Future benchmarks should stratify evaluation by observation scope (turn, session, and cross-session) and capture interaction-level behaviors. SafeDialBench [93] and AgentHarm [94] provide initial steps in this direction. • Long-horizon safety mechanisms. As LLMs increasingly operate with persistent memory, external tools, and autonomous agents, defenses must reason over interaction histories rather than isolated prompts. Our findings suggest that trajectory-level and cross-session monitoring should complement turn-local safeguards, an emerging direction also reflected in recent agent security research [9], [95]. • Benchmarks for distributed attacks. Trajectorybranching and session-split attacks remain underexplored due to the lack of standardized implementations and evaluation datasets. Building realistic benchmarks for long-horizon and distributed-intent attacks will be essential for developing and comparing future multiturn defenses [96].
6. Conclusion Multi-turn jailbreaks elevate the threat from singleprompt vulnerabilities to long-horizon control over dialogue trajectories. In this paper, we present an interaction-centric taxonomy that organizes existing attacks into four categories and conduct targeted empirical analyses to uncover the
mechanisms underlying their effectiveness. Although these categories differ in how harmful intent is organized, they all exploit deliberate cross-turn planning rather than isolated prompts. This interaction-centric perspective shows that turn-local defenses are structurally insufficient and motivates evaluation and defense mechanisms grounded in sessionlevel and cross-session analysis. We hope this taxonomy provides a foundation for systematic comparison across methods and motivates future defenses for advanced attacks against large foundation models.
References
[14] A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 80 079–80 110. [15] Z. Lin, J. Cui, X. Liao, and X. Wang, “Malla: Demystifying real-world large language model integrated malicious services,” in USENIX Security Symposium, 2024, pp. 4693–4710. [16] X. Shen, Y. Shen, M. Backes, and Y. Zhang, “Gptracker: A largescale measurement of misused gpts,” in IEEE Symposium on Security and Privacy, 2025, pp. 336–354. [17] Z. Yu, X. Liu, S. Liang, Z. Cameron, C. Xiao, and N. Zhang, “Don’t listen to me: Understanding and exploring jailbreak prompts of large language models,” in USENIX Security Symposium, 2024, pp. 4675– 4692. [18] Y. Yao, J. Duan, K. Xu, Y. Cai, Z. Sun, and Y. Zhang, “A survey on large language model (llm) security and privacy: The good, the bad, and the ugly,” High-Confidence Computing, vol. 4, no. 2, p. 100211, 2024.
[1]
L. Ouyang et al., “Training language models to follow instructions with human feedback,” in Advances in Neural Information Processing Systems, 2022.
[2]
D. Wu, H. Wang, W. Yu, Y. Zhang, K.-W. Chang, and D. Yu, “Longmemeval: Benchmarking chat assistants on long-term interactive memory,” arXiv preprint arXiv:2410.10813, 2024.
[19] S. S. Roy, P. Thota, K. V. Naragam, and S. Nilizadeh, “From chatbots to phishbots?: Phishing scam generation in commercial large language models,” in IEEE Symposium on Security and Privacy, 2024, pp. 36– 54.
[3]
S. Guan, J. Wang, J. Bian, B. Zhu, J.-G. Lou, and H. Xiong, “Evaluating llm-based agents for multi-turn conversations: A survey,” ACM Transactions on Intelligent Systems and Technology, 2026.
[20] Y. Bai et al., “Constitutional AI: Harmlessness from AI feedback,” arXiv preprint arXiv:2212.08073, 2022.
[4]
H. Pearce, B. Ahmad, B. Tan, B. Dolan-Gavitt, and R. Karri, “Asleep at the keyboard? assessing the security of github copilot’s code contributions,” in IEEE Symposium on Security and Privacy, 2022, pp. 754–768.
[5]
G. Sandoval, H. Pearce, T. Nys, R. Karri, S. Garg, and B. DolanGavitt, “Lost at c: A user study on the security implications of large language model code assistants,” in USENIX Security Symposium, 2023, pp. 2205–2222.
[6]
J. Jiang, F. Wang, J. Shen, S. Kim, and S. Kim, “A survey on large language models for code generation,” ACM Transactions on Software Engineering and Methodology, vol. 35, no. 2, pp. 1–72, 2026.
[23] M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li et al., “Harmbench: a standardized evaluation framework for automated red teaming and robust refusal,” in International Conference on Machine Learning, 2024, pp. 35 181–35 224.
[7]
K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising realworld llm-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90.
[24] L. Jiang, K. Rao, S. Han, A. Ettinger, F. Brahman, S. Kumar, N. Mireshghallah, X. Lu, M. Sap, Y. Choi et al., “Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models,” Advances in Neural Information Processing Systems, vol. 37, pp. 47 094–47 165, 2024.
[8]
S. Fan, X. Cong, Y. Fu, Z. Zhang, S. Zhang, Y. Liu, Y. Wu, Y. Lin, Z. Liu, and M. Sun, “Workflowllm: Enhancing workflow orchestration capability of large language models,” arXiv preprint arXiv:2411.05451, 2024.
[25] A. Zou, L. Phan, J. Wang, D. Duenas, M. Lin, M. Andriushchenko, R. Wang, Z. Kolter, M. Fredrikson, and D. Hendrycks, “Improving alignment and robustness with circuit breakers,” Advances in Neural Information Processing Systems, vol. 37, pp. 83 345–83 373, 2024.
[9]
H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang, “Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents,” in International Conference on Learning Representations, vol. 2025, 2025, pp. 35 331– 35 366.
[26] Z. Zhang, Q. Zhang, and J. Foerster, “Parden, can you repeat that? defending against jailbreaks via repetition,” arXiv preprint arXiv:2405.07932, 2024.
[10] Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, “Isolategpt: An execution isolation architecture for llm-based agentic systems,” in Network and Distributed System Security Symposium, 2025. [11] E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,” Advances in Neural Information Processing Systems, vol. 37, pp. 82 895–82 920, 2024. [12] A. Shahriar, M. N. Rahman, S. Ahmed, F. Sadeque, and M. R. Parvez, “A survey on agentic security: Applications, threats and defenses,” arXiv preprint arXiv:2510.06445, 2025. [13] Z. Deng, Y. Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y. Xiang, “Ai agents under threat: A survey of key security challenges and future pathways,” ACM Computing Surveys, vol. 57, no. 7, pp. 1–36, 2025.
[21] X. Zhao, W. Cai, T. Shi, D. Huang, L. Lin, S. Mei, and D. Song, “Improving llm safety alignment with dual-objective optimization,” in International Conference on Machine Learning, 2025, pp. 77 321– 77 341. [22] X. Qi, Y. Zeng, T. Xie, P.-Y. Chen, R. Jia, P. Mittal, and P. Henderson, “Fine-tuning aligned language models compromises safety, even when users do not intend to!” in International Conference on Learning Representations, 2024, pp. 30 988–31 043.
[27] Z. Zhang, G. Shen, G. Tao, S. Cheng, and X. Zhang, “On large language models’ resilience to coercive interrogation,” in IEEE Symposium on Security and Privacy, 2024, pp. 826–844. [28] X. He, S. Zannettou, Y. Shen, and Y. Zhang, “You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content,” in IEEE Symposium on Security and Privacy, 2024, pp. 770–787. [29] J. Yu, X. Lin, Z. Yu, and X. Xing, “{LLM-Fuzzer}: Scaling assessment of large language model jailbreaks,” in USENIX Security Symposium, 2024, pp. 4657–4674. [30] J. Yu, H. Luo, J. Y.-C. Hu, Y. Chen, W. Guo, H. Liu, and X. Xing, “Mind the inconspicuous: Revealing the hidden weakness in aligned {LLMs}’refusal boundaries,” in USENIX Security Symposium, 2025, pp. 259–278. [31] Y. Gong, D. Ran, X. He, T. Cong, A. Wang, and X. Wang, “Safety misalignment against large language models.” in NDSS, 2025.
[32] M. Song, H. Kim, J. Kim, S. Shin, and S. Son, “Refusal is not an option: Unlearning safety alignment of large language models,” in USENIX Security Symposium, 2025, pp. 319–338. [33] J. Su, J. Kempe, and K. Ullrich, “Mission impossible: A statistical perspective on jailbreaking llms,” Advances in Neural Information Processing Systems, vol. 37, pp. 38 267–38 306, 2024.
[50] P. Laban, H. Hayashi, Y. Zhou, and J. Neville, “Llms get lost in multi-turn conversation,” arXiv preprint arXiv:2505.06120, 2025. [51] C. Zhang, X. Dai, Y. Wu, Q. Yang, Y. Wang, R. Tang, and Y. Liu, “A survey on multi-turn interaction capabilities of large language models,” arXiv preprint arXiv:2501.09959, 2025.
[34] S. Yi, Y. Liu, Z. Sun, T. Cong, X. He, J. Song, K. Xu, and Q. Li, “Jailbreak attacks and defenses against large language models: A survey,” arXiv preprint arXiv:2407.04295, 2024.
[52] N. Li, Z. Han, I. Steneker, W. Primack, R. Goodside, H. Zhang, Z. Wang, C. Menghini, and S. Yue, “Llm defenses are not robust to multi-turn human jailbreaks yet,” arXiv preprint arXiv:2408.15221, 2024.
[35] Z. Xu, Y. Liu, G. Deng, Y. Li, and S. Picek, “A comprehensive study of jailbreak attack versus defense for large language models,” in Findings of the Association for Computational Linguistics: ACL 2024, 2024, pp. 7432–7449.
[53] M. Russinovich, A. Salem, and R. Eldan, “Great, now write an article about that: The crescendo {Multi-Turn}{LLM} jailbreak attack,” in USENIX Security Symposium, 2025, pp. 2421–2440.
[36] X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang, ““do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models,” in ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1671–1685.
[54] Z. Weng, X. Jin, J. Jia, and X. Zhang, “Foot-in-the-door: A multiturn jailbreak for LLMs,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, pp. 1939–1950.
[37] T. Krauß, H. Dashtbani, and A. Dmitrienko, “{TwinBreak}: Jailbreaking {LLM} security alignments based on twin prompts,” in USENIX Security Symposium, 2025, pp. 2343–2362.
[55] Y. Cheng, M. Georgopoulos, V. Cevher, and G. G. Chrysos, “Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks,” arXiv preprint arXiv:2402.09177, 2024.
[38] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043, 2023.
[56] X. Sun, D. Zhang, D. Yang, Q. Zou, and H. Li, “Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles,” arXiv preprint arXiv:2408.04686, 2024.
[39] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, “Jailbreaking black box large language models in twenty queries,” in IEEE Conference on Secure and Trustworthy Machine Learning, 2025, pp. 23–42.
[57] G. Deng, Y. Liu, Y. Li, K. Wang, Y. Zhang, Z. Li, H. Wang, T. Zhang, and Y. Liu, “Masterkey: Automated jailbreaking of large language model chatbots,” 2024.
[40] A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi, “Tree of attacks: Jailbreaking blackbox llms automatically,” Advances in Neural Information Processing Systems, vol. 37, pp. 61 065–61 105, 2024. [41] T. Liu, Y. Zhang, Z. Zhao, Y. Dong, G. Meng, and K. Chen, “Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction,” in USENIX Security Symposium, 2024, pp. 4711–4728. [42] Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao, “Sneakyprompt: Jailbreaking text-to-image generative models,” in IEEE Symposium on Security and Privacy, 2024, pp. 897–912. [43] Y. Dong, X. Meng, N. Yu, Z. Li, and S. Guo, “Fuzz-testing meets llmbased agents: An automated and efficient framework for jailbreaking text-to-image generation models,” in IEEE Symposium on Security and Privacy, 2025, pp. 373–391.
[58] M. Pavlova, E. Brinkman, K. Iyer, V. Albiero, J. Bitton, H. Nguyen, J. Li, C. C. Ferrer, I. Evtimov, and A. Grattafiori, “Automated red teaming with goat: the generative offensive agent tester,” arXiv preprint arXiv:2410.01606, 2024. [59] S. Chen, X. Yu, N. Mehrabi, R. Gupta, Z. Yu, and R. Jia, “Strategize globally, adapt locally: A multi-turn red teaming agent with dual-level learning,” arXiv preprint arXiv:2504.01278, 2025. [60] A. Zhou and R. Arel, “Tempest: Autonomous multi-turn jailbreaking of large language models with tree search,” arXiv preprint arXiv:2503.10619, 2025. [61] S. Rahman, L. Jiang, J. Shiffer, G. Liu, S. Issaka, M. R. Parvez, H. Palangi, K.-W. Chang, Y. Choi, and S. Gabriel, “X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents,” arXiv preprint arXiv:2504.13203, 2025.
[44] S. Liu, M. Ma, M. Xue, and G. Bai, “Modifier unlocked: Jailbreaking text-to-image models through prompts,” in IEEE Symposium on Security and Privacy, 2025, pp. 355–372.
[62] D. Srivastav and X. Zhang, “Safe in isolation, dangerous together: Agent-driven multi-turn decomposition jailbreaks on LLMs,” in Proceedings of the 1st Workshop for Research on Agent Language Models, 2025, pp. 170–183.
[45] Y. Mao, T. Cui, P. Liu, D. You, and H. Zhu, “From llms to mllms to agents: A survey of emerging paradigms in jailbreak attacks and defenses within llm ecosystem,” arXiv preprint arXiv:2506.15170, 2025.
[63] J. Wahréus, A. Hussain, and P. Papadimitratos, “Prompt, divide, and conquer: Bypassing large language model safety filters via segmented and distributed prompt processing,” arXiv preprint arXiv:2503.21598, 2025.
[46] C. Villa, S. Mirza, and C. Pöpper, “Exposing the guardrails:{ReverseEngineering} and jailbreaking safety filters in {DALL· E}{Text-toImage} pipelines,” in USENIX Security Symposium, 2025, pp. 897– 916. [47] S. B. Hakim, K. Gharami, N. F. Ghalaty, S. S. Moni, S. Xu, and H. H. Song, “Jailbreaking llms: A survey of attacks, defenses and evaluation,” Authorea Preprints, 2026. [48] Z. Ba, J. Zhong, J. Lei, P. Cheng, Q. Wang, Z. Qin, Z. Wang, and K. Ren, “Surrogateprompt: Bypassing the safety filter of text-to-image models via substitution,” in ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1166–1180. [49] P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramer et al., “Jailbreakbench: An open robustness benchmark for jailbreaking large language models,” Advances in Neural Information Processing Systems, vol. 37, pp. 55 005–55 029, 2024.
[64] E. Shayegani, M. A. Al Mamun, Y. Fu, P. Zaree, Y. Dong, and N. Abu-Ghazaleh, “Survey of vulnerabilities in large language models revealed by adversarial attacks,” arXiv preprint arXiv:2310.10844, 2023. [65] X. Wang, Z. Ji, W. Wang, Z. Li, D. Wu, and S. Wang, “Sok: Evaluating jailbreak guardrails for large language models,” arXiv preprint arXiv:2506.10597, 2025. [66] B. Knowlton, J. Campa, D. S. Gallo, K. Dajani, and N. Alzahrani, “Prompt-based jailbreaking of leading llm chatbots: A survey of attacks and defenses,” IEEE Transactions on Artificial Intelligence, 2026. [67] H. Hong, S. Feng, N. Naderloui, S. Yan, J. Zhang, B. Liu, A. Arastehfard, H. Huang, and Y. Hong, “Sok: Taxonomy and evaluation of prompt security in large language models,” arXiv preprint arXiv:2510.15476, 2025.
[68] S. Li, X. Lin, J. Wu, Z. Liu, H. Li, T. Ju, X. Chen, and J. Li, “Honeytrap: Deceiving large language model attackers to honeypot traps with resilient multi-agent defense,” arXiv preprint arXiv:2601.04034, 2026.
[85] X. Du, F. Mo, M. Wen, T. Gu, H. Zheng, H. Jin, and J. Shi, “Multiturn jailbreaking large language models via attention shifting,” in AAAI Conference on Artificial Intelligence, vol. 39, no. 22, 2025, pp. 23 814–23 822.
[69] F. Xu, H. Hu, C. He, S. Hang, H. Hu, X. Liu, Y. Zhao, Z. Zhou, B. B. Zhu, S.-F. Sun et al., “Sok: Robustness in large language models against jailbreak attacks,” arXiv preprint arXiv:2605.05058, 2026.
[86] A. Ramesh, S. Bhardwaj, A. Saibewar, and M. Kaul, “Efficient jailbreak attack sequences on large language models via multiarmed bandit-based context switching,” in International Conference on Learning Representations, 2025.
[70] B. C. Das, M. H. Amini, and Y. Wu, “Security and privacy challenges of large language models: A survey,” ACM Computing Surveys, vol. 57, no. 6, pp. 1–39, 2025. [71] S. Yi, Y. Liu, Z. Sun, T. Cong, X. He, J. Song, K. Xu, and Q. Li, “Jailbreak attacks and defenses against large language models: A survey,” arXiv preprint arXiv:2407.04295, 2024. [72] Z. Zhou, H. Yu, X. Zhang, R. Xu, F. Huang, and Y. Li, “How alignment and jailbreak work: Explain LLM safety through intermediate hidden states,” in Findings of the Association for Computational Linguistics: EMNLP 2024, 2024, pp. 2461–2488. [73] A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, and N. Nanda, “Refusal in language models is mediated by a single direction,” in Advances in Neural Information Processing Systems, vol. 37, 2024, pp. 136 037–136 083. [74] M. Wu, Y. Huang, Z. Lin, K. Chen, Y. Huang, R. Wang, L. Wang et al., “Analogy-based multi-turn jailbreak against large language models,” in Advances in Neural Information Processing Systems, vol. 38, 2026, pp. 123 789–123 816. [75] Q. Ren, H. Li, D. Liu, Z. Xie, X. Lu, Y. Qiao, L. Sha, J. Yan, L. Ma, and J. Shao, “Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues,” arXiv preprint arXiv:2410.10700, 2024. [76] Z. Ying, D. Zhang, Z. Jing, Y. Xiao, Q. Zou, A. Liu, S. Liang, X. Zhang, X. Liu, and D. Tao, “Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models,” arXiv preprint arXiv:2502.11054, 2025. [77] X. Lin, W. Lin, S. Cao, J. Yu, R. Huang, L. Xue, and C. Wu, “Icon: Intent-context coupling for efficient multi-turn jailbreak attack,” arXiv preprint arXiv:2601.20903, 2026. [78] X. Liu, L. Li, T. Xiang, F. Ye, L. Wei, W. Li, and N. Garcia, “Imposter.AI: Adversarial Attacks with Hidden Intentions towards Aligned Large Language Models,” arXiv preprint arXiv:2407.15399, 2024. [79] H. Yang, L. Qu, E. Shareghi, and G. Haffari, “Jigsaw puzzles: Splitting harmful questions to jailbreak large language models in multiturn interactions,” in Second Conference on Language Modeling, 2025. [80] Z. Zhou, J. Xiang, H. Chen, Q. Liu, Z. Li, and S. Su, “Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue,” arXiv preprint arXiv:2402.17262, 2024. [81] F. Wang, R. Duan, P. Xiao, X. Jia, S. Zhao, C. Wei, Y. Chen, C. Wang, J. Tao, H. Su, J. Zhu, and H. Xue, “MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue,” arXiv preprint arXiv:2411.03814, 2024. [82] Y. Zhao and Y. Zhang, “Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors,” arXiv preprint arXiv:2501.14250, 2025. [83] J. Qiu, W. Xu, peiyaoyuan, Y. Zhao, and L. Zhao, “Incremental exploits: Efficient jailbreaks on large language models with multi-round conversational jailbreaking,” 2024. [Online]. Available: https://openreview.net/forum?id=KyKTjRtyNG [84] S. Li, Z. Liu, X. Lin, Q. Mao, Y. Chen, H. Li, J. Wu, J. Li, and X. Su, “Coopguard: Stateful cooperative agents safeguarding llms against evolving multi-round attacks,” arXiv preprint arXiv:2604.04060, 2026.
[87] Z. Wang, Z. Zhang, D. He, P. Kou, X. Li, J. Liu, J. An, and Y. Liu, “Jailbreaking large language models through iterative tool-disguised attacks via reinforcement learning,” arXiv preprint arXiv:2601.05466, 2026. [88] M. Feng, X. Liu, W. Yang, J. Song, X. Zhu, C. Xu, and J. Gao, “Sema: Simple yet effective learning for multi-turn jailbreak attacks,” arXiv preprint arXiv:2602.06854, 2026. [89] W. J. Mo, Q. Liu, X. Wen, D. Jung, H. Askari, W. Zhou, Z. Zhao, and M. Chen, “Redcoder: Automated multi-turn red teaming for code llms,” arXiv preprint arXiv:2507.22063, 2025. [90] D. Kulshreshtha, H. Su, C. Hegde, and H. Wang, “Multi-turn jailbreaking of aligned llms via lexical anchor tree search,” arXiv preprint arXiv:2601.02670, 2026. [91] G. Wu, Z. Zhang, Y. Zhang, W. Wang, J. Niu, Y. Wu, and Y. Zhang, “I know what you asked: Prompt leakage via kv-cache sharing in multi-tenant llm serving.” in Network and Distributed System Security Symposium, 2025. [92] B. Hui, H. Yuan, N. Gong, P. Burlina, and Y. Cao, “Pleak: Prompt leaking attacks against large language model applications,” in ACM SIGSAC Conference on Computer and Communications Security, 2024, p. 3600–3614. [93] H. Cao, S. Jing, Y. Wang, Z. Peng, Z. Bai, Z. Cao, M. Fang, F. Feng, J. Liu, B. Wang et al., “Safedialbench: a fine-grained safety evaluation benchmark for large language models in multi-turn dialogues with diverse jailbreak attacks,” in The Fourteenth International Conference on Learning Representations, 2026. [94] M. Andriushchenko, A. Souly, M. Dziemian, D. Duenas, M. Lin, J. Wang, D. Hendrycks, A. Zou, Z. Kolter, M. Fredrikson et al., “Agentharm: A benchmark for measuring harmfulness of llm agents,” in International Conference on Learning Representations, vol. 2025, 2025, pp. 79 185–79 220. [95] R. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,” in Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 9661–9674. [96] J. Song, X. Liu, W. Yang, W. Chen, M. Feng, X. Zhu, and J. Gao, “Multibreak: A scalable and diverse multi-turn jailbreak benchmark for evaluating llm safety,” arXiv preprint arXiv:2605.01687, 2026.
Appendix A. Experimental Setup This appendix records the execution-level details for the mechanism analyses in Section 4. The experiments cover DEA and SRA, where controlled ablations are available; TBA and SSA are discussed analytically in the main text. For clarity, we separate the experiment-to-RQ mapping, target models, query sets, evaluation protocol, and perRQ numerical settings. Table 13 summarizes the mapping between research questions and experimental settings.
TABLE 12: Method-level taxonomy of multi-turn jailbreak methods. Type: DEA = Dialogue-escalation Attacks; SRA = Strategy-refinement Attacks; TBA = Trajectory-branching Attacks; SSA = Session-splitting Attacks. Attacker Mechanism describes the primary strategy-generation mechanism. Interaction Scope indicates whether the attack follows a single trajectory or multiple trajectories or sessions. Session Continuity describes whether the interaction is linear, branching, or fragmented. Detection Surface indicates the minimum observation granularity required to expose the harmful intent. Extra Resource: None = no additional attacker-side resource; LLM = auxiliary large language model; RL = reinforcement learning policy; RAG = retrieval-augmented generation; MA = multiple attacker agents; Human = human red teamer. Code: indicates open-source code is available; # indicates no public implementation is found. Method [Ref.]
Type
Sub-paradigm
FITD [54] Crescendo [53]
DEA DEA
Psychological Psychological
Attacker Mechanism Interaction Scope Session Continuity Detection Surface Template LLM
Single trajectory Single trajectory
Linear Linear
Session-level Session-level
None LLM
CFA [56] AMA [74] CIA [55] ActorAttack [75] RACE [76] ICON [77]
DEA DEA DEA DEA DEA DEA
Context Manipulation Context Manipulation Context Manipulation Context Manipulation Context Manipulation Context Manipulation
Template Template LLM LLM LLM LLM
Single trajectory Single trajectory Single trajectory Single trajectory Single trajectory Single trajectory
Linear Linear Linear Linear Linear Linear
Session-level Session-level Session-level Session-level Session-level Session-level
None None LLM LLM LLM LLM
Imposter.AI [78] Jigsaw Puzzles [79] Speak-Out-of-Turn [80] MRJ-Agent [81] SIREN [82]
DEA DEA DEA DEA DEA
Task Decomposition Task Decomposition Task Decomposition Task Decomposition Task Decomposition
Template Template LLM LLM LLM
Single trajectory Single trajectory Single trajectory Single trajectory Single trajectory
Linear Linear Linear Linear Linear
Session-level Session-level Session-level Session-level Session-level
None None LLM LLM LLM
MRCJ [83] EMRA [84]
SRA SRA
Fixed Strategy Fixed Strategy
Template Template
Single trajectory Single trajectory
Linear Linear
Turn-level Turn-level
None None
ASJA [85] SoC-MAB [86] iMIST [87] SEMA [88]
SRA SRA SRA SRA
Adaptive Optimization Adaptive Optimization Adaptive Optimization Adaptive Optimization
LLM RL RL RL
Single trajectory Single trajectory Single trajectory Single trajectory
Linear Linear Linear Linear
Turn-level Turn-level Turn-level Turn-level
LLM / optimizer RL / judge RL RL
# # #
GOAT [58] GALA [59] RedCoder [89] X-Teaming [61]
SRA SRA SRA SRA
Agent Based Agent Based Agent Based Agent Based
LLM LLM LLM Multi-agents
Single trajectory Single trajectory Single trajectory Single trajectory
Linear Linear Linear Linear
Session-level Session-level Session-level Session-level
LLM LLM LLM / RAG MA
#
Tempest [60] SLIP [90] MHJ [52]
TBA TBA TBA
– – –
LLM Template Human
Multi-trajectories Multi-trajectories Multi-trajectories
Branching Branching Branching
Session-level Session-level Session-level
LLM None Human
Agent-driven Decomposition [62] Prompt, Divide, and Conquer [63]
SSA SSA
– –
Multi-agents Multi-agents
Multi-sessions Multi-sessions
Fragmented Fragmented
Cross-session Cross-session
MA LLM / MA
# # #
TABLE 13: Mapping between research questions and experimental settings. RQs
Method
Category
Setting
RQ1 RQ2 RQ3 RQ4
FITD, MRCJ ActorAttack MRCJ X-Teaming
DEA / SRA DEA SRA SRA
Organization vs. accumulation Amplification components Escalation shape Sub-paradigm progression
Extra Resource Code
# # # # # # #
# #
TABLE 14: Target models used in each experiment. Experiment
Target models
FITD ActorAttack X-Teaming MRCJ
Llama-3, DeepSeek-V3, GPT-4o, Llama-3.3-70B DeepSeek-V3, GPT-4o, Llama-3.3-70B Llama-3, DeepSeek-V3, GPT-4o, Llama-3.3-70B, Gemini-3.1-Flash Vicuna-13b, Mistral, ChatGLM, Qwen2, Llama-3, Gemma-2-9B
A.2. Target Models
A.1. Attack Models Several attack implementations require an auxiliary LLM to execute attacker-side operations. In FITD [54], the attack model generates rephrased persistence prompts and bridge turns after refusals. In ActorAttack [75], the attack model constructs actor-specific attack pathways and produces the corresponding self-talk reasoning. In XTeaming [61], the attack model supports the planner, attacker, and prompt-optimization components according to the active condition. To keep the attacker-side capability fixed across these experiments, we use DeepSeek-V3 as the attack model throughout.
The target models are selected according to the mechanism being tested, as shown in Table 14. FITD, ActorAttack, and X-Teaming use frontier or recent aligned models, while the MRCJ experiments use a broader set of open-source aligned models to compare escalation behavior across different robustness levels. Target-model selection. The target models are chosen to cover both closed-source frontier systems and widely used open-source aligned models. For FITD, ActorAttack, and XTeaming, we use recent aligned models that are commonly evaluated in jailbreak studies. For MRCJ, we use a broader open-source model set, which allows controlled comparison of sequence construction and escalation behavior under the
TABLE 15: Datasets and query sets used in the mechanism analyses. Dataset
Size / role
Used for
JailbreakBench [49] MUCD [83] AdvBench [38] HarmBench [23]
100 harmful behaviors Questions with malice levels 50 final target questions 400 harmful queries
FITD, X-Teaming MRCJ auxiliary turns MRCJ final targets ActorAttack
same implementation.
TABLE 16: Component matrix for the three main-chain conditions. Each column corresponds to one SRA subparadigm, and adjacent columns differ in exactly one component. Component
A1
A2
A3
Candidate plan pool Selection mechanism Attacker model class
single plan none none
plan pool bandit optimizer
plan pool LLM LLM agent
Sub-paradigm
Fixed
Adaptive
Agent
A.3. Datasets and Query Sets The datasets and query sets used in the mechanism analyses are summarized in Table 15. We use the released query sets directly, so that the ablations change the interaction structure rather than the underlying harmful objectives. The MUCD auxiliary questions and their discrete malicelevel labels are taken from the MRCJ release without modification. FITD and X-Teaming draw from the same JailbreakBench behavior set.
A.4. Evaluation Protocol Judge. GPT-4o serves as the automated judge across all experiments using the default JailbreakBench evaluation prompt [49]. For each model response, it evaluates whether the generated content constitutes a successful jailbreak under the standardized JailbreakBench protocol. The same judge prompt, model configuration, and evaluation procedure are used across all experiments to ensure comparability. Scoring and ASR. Responses are scored on a 1-to-5 harmfulness scale; a score ≥ 4 counts as a successful jailbreak. ASR is the fraction of target queries for which at least one response meets this threshold within the turn budget. Where reported, the harmfulness score is the mean judge score across all target queries for a given condition. For multicandidate settings, a target is counted as successful if any candidate response reaches the threshold. Decoding. All target, attacker, and judge models use default decoding settings throughout unless otherwise specified by the released implementation.
A.5. Per-RQ Condition Parameters RQ 1: Organization vs. Accumulation (Subsection 4.2). For the FITD-side experiment, we use the open-source implementation of Weng et al. [54] with its default configuration. All FITD-side conditions use a turn budget of 10. In the Persistence condition, the attacker retries at most 10 times, with LLM-based rephrasing applied after refusals. For the MRCJ-side experiment, auxiliary questions and malice-level labels follow the MRCJ release [83] without modification. The final harmful targets are 50 questions from AdvBench [38]. RQ 2: Amplification Components (Subsection 4.4). RQ 2 uses the open-source ActorAttack [75] implementation with its default configuration to isolate the contribution of its key
amplification components. In the actor-count experiment, the number of actors varies from 1 to 5 while self-talk remains enabled, measuring the effect of increasing semantic diversity under a fixed reasoning mechanism. In the self-talk ablation, the actor count is fixed at 3, and only the self-talk component is removed, with all other settings unchanged to ensure a controlled comparison. RQ 3: Escalation Shape (Subsection 4.3). RQ 3 shares the target models, datasets, and evaluation protocol of the MRCJ side of RQ 1. The experiment fixes the number of escalation steps to 4, while the endpoint malice level and auxiliaryquestion construction follow the MRCJ default setting [83]. RQ 4: Sub-Paradigm Progression (Subsection 4.5). All three conditions use the X-Teaming backbone [61], with DeepSeek-V3 as the attacker LLM. The turn budget is fixed to 7 across A1, A2, and A3, and the retry count is kept constant so that the comparison isolates the effect of strategyrefinement components. Specifically, we systematically vary one component at a time, as shown in Table 16. A1 executes a single fixed plan linearly (Fixed-strategy); A2 adds a candidate plan pool with an ε-greedy bandit selecting on scalar verifier scores (Adaptive-optimization); A3 replaces the bandit with an attacker LLM that reasons over the full interaction history (Agent-based).
Appendix B. Method-Level Taxonomy of Multi-Turn Jailbreaks ① Method-level taxonomy exposes operational differences behind the same intent category. Table 12 refines the category-level view by mapping each sub-paradigm to concrete methods and their operational assumptions, including attacker mechanism, interaction scope, session continuity, detection surface, extra attacker-side resources, and code availability. This view shows that methods within the same high-level category can differ substantially in how they are instantiated. For instance, DEA methods all organize harmful intent within a single session, but range from templatebased psychological escalation to LLM-driven context manipulation and task decomposition. Similarly, SRA methods share the goal of refining the strategy route, yet differ in whether the strategy is fixed, feedback-optimized, or planned by an agentic attacker. ② The dominant pattern is single-trajectory organization, while harder detection regimes remain under-
explored. The taxonomy shows that existing work is concentrated in DEA and SRA, where attacks unfold along a single dialogue and harmful intent becomes observable mainly at the session level. As a result, these categories are also the most reproducible and extensively analyzed in the main text. By contrast, TBA and SSA remain comparatively sparse, organizing intent across branches or isolated sessions and requiring branch-level or cross-session analysis that current evaluation protocols rarely support. This gap indicates strong evidence for reproducible single-trajectory attacks but remains limited for attack forms that most directly challenge the observation boundary of existing safety mechanisms, reinforcing our finding that detection depends not only on harmful content but also on where intent is organized.