Derail Yourself: Multi-turn LLM Jailbreak Attack through self-discovered clues

Authors: Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, Jing Shao
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: llm jailbreak, llm safety alignment, multi-turn attack

Abstract:
This study exposes the safety vulnerabilities of Large Language Models (LLMs) in multi-turn interactions, where malicious users can obscure harmful intents across several queries. We introduce ActorAttack, a novel multi-turn attack method inspired by actor-network theory, which models a network of semantically linked actors as attack clues to generate diverse and effective attack paths toward harmful targets. ActorAttack addresses two main challenges in multi-turn attacks: (1) concealing harmful intents by creating an innocuous conversation topic about the actor, and (2) uncovering diverse attack paths towards the same harmful target by leveraging LLMs' knowledge to specify the correlated actors as various attack clues. In this way, ActorAttack outperforms existing single-turn and multi-turn attack methods across advanced aligned LLMs, even for GPT-o1. We will publish a dataset called SafeMTData, which includes multi-turn adversarial prompts and safety alignment data, generated by ActorAttack. We demonstrate that models safety-tuned using our safety dataset are more robust to multi-turn attacks.

Decision: withdrawn
Reviewer scores: 5, 6, 5

Reviews and discussion:
<thread>
creation date:
1730279259255

thread_type:
official_review

<thread_object>
creator: reviewer_2ps2

<content>
summary:
This paper introduces ActorAttack, a method that utilizes actor-network theory to generate diverse attack paths while concealing harmful intents. Unlike existing methods, ActorAttack automates the discovery of attack clues using LLM knowledge, enhancing both the effectiveness and diversity of attacks. The research also presents the SafeMTData dataset, which improves LLM robustness through safety tuning, revealing a trade-off between utility and safety. This work emphasizes the need for addressing safety risks in multi-turn conversations with LLMs.

strengths:
- The proposed method demonstrates a better attack success rate. 
- The manuscript discusses its helpfulness, and further fine-tuning indicates that the proposed method is effective in enhancing model security.

weaknesses:
- Weak Technical Contribution. From my perspective, the primary contribution of the proposed attack is the identification of attack clues derived from LLMs. However, there is a lack of quantitative analysis regarding the superiority of these clues compared to existing works, such as CFA [1] and CoA [2]. Why are these attack clues more effective? Is it due to their ability to introduce a greater range of possibilities into the attack chain? It is important to note that existing works also leverage related problems to enhance their attack chains, allowing for the incorporation of additional possibilities as they evolve.
- Datasets: The number of samples in the dataset is unclear. I only see that the ablation study used 50 samples. This raises concerns about the generalizability of the proposed method.
- Baseline: The proposed method involves multi-turn jailbreaking, so the comparison should focus on multi-turn attacks as well. However, the baseline presented only includes one multi-tuen jailbreaking method, Crescendo, while other methods like CFA and CoA are not compared. In addition, the chosen single-turn jailbreak methods are not state-of-the-art, as more effective attacks (such as AutoDAN, ReNeLLM, and MultiLingual) are not compared. For details, see: http://easyjailbreak.org/leader-board.
- Incomplete Evaluation. I am particularly interested in the comparison between the proposed method and multi-turn jailbreaking. However, the authors have limited the evaluation of victim models to only GPT-4o and Claude-3.5. Why not conduct a comprehensive evaluation across all five victim models listed in Table 1? This suggests a potential selective presentation of results by the authors.
- Efficiency Evaluation. The proposed method relies on LLMs to generate multiple attack clues, which may be time-consuming. I am concerned that it may be less efficient than existing methods, so the authors should discuss the time costs associated with the attacks.

[1] Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles.  
[2] Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM.

questions:
See weaknesses. While my current evaluation is negative, I would reconsider the score if the author addresses my concerns, especially by clearly explaining the importance of the attack clues.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730284539034

thread_type:
official_review

<thread_object>
creator: reviewer_uleg

<content>
summary:
Summary:
This paper proposes a multi-turn LLM attack method and addresses two challenges in this method: (1) conceal of harmful intent (2) generating multiple attack paths for the same harmful target. This work adapts the actor-network theory to generate attack clues, which in turn are used to generate concrete prompts which when input to LLMs lead to jailbreak. These carefully generated prompts are designed in a manner that lead to the LLM answering the original harmful query. The work develops a dataset with multi-turn adversarial prompts and safety-alignment data, which can be used for fine-tuning.

strengths:
1. Novel adaptation of actor network theory in multi-turn jailbreak prompt sequence generation.
2. Attack method is suitable for both black-box and white-box LLMs.

weaknesses:
1. Method section 3 could have been written in a better way. Actor network adaptation to the generation of attack clues could be explained in a better way.
2. Uses 4 LLMs as per the algorithm pseudocode. However, clear description of all the 4 models is missing.
3. In Table 1, ASR comparison is done against single turn attacks only. Need to compare with recent related work on Multi-turn attacks like Crescendo, etc.
4. Notations used in algorithm have not been explained in text. This needs to be done for better understanding of the method.
5. Missing experiments for comparison of state-of-the-art defense mechanisms. Experiments section needs to be refined.

questions:
1. What is the time required to generate a jailbreak attack sequence using ActorAttack method? Since, it is using 4 different models, how can it be used in practical use cases?
2. How to interpret the results shown in figures 4(a) and 4(b)? Please add additional details in caption.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730428946447

thread_type:
official_review

<thread_object>
creator: reviewer_8h4v

<content>
summary:
This paper proposes a multi-turn attack – ActorAttack, which is an improvement from the existing work. The main difference with previous multi-turn papers is the pre-set helpful clue, which is obtained by using LLM under diverse actors. With the designated clue, ActorAttack could generate the diverse attack paths towards the same harmful target.

strengths:
1、The paper is well-arranged and readable
2、It provides reasonable experiment

weaknesses:
1、	The innovation is limited
2、	Lack of in-depth root cause analysis
3、	The experiment result is not unconvincing enough

questions:
1、	Limited novelty: The overall idea is basically consistent with crescendo: a) the generation of the initial clue, even if the actor theory is mentioned here, it actually only works in assigning a role to LLM for generating the initial clue; no strict theory or inspiration； b) In the initial generation process, the attack model in crescendo is simply replaced by the victim model; the benefits and reasons are unclear to confidently support the advantage; c) The dynamic multi-turn prompt modification action only involves repeated generation to reduce toxicity; no heuristic strategy guidance.
2、	Limited Contribution: As for multi-turn attack, this paper only contributes a point - designated clue
3、	Root cause analysis: Why multi-turn surpasses single-turn? Please give in-depth mechanism analysis and corresponding experiment support.
4、	Baseline Comparison: only one multi-turn baseline for comparison is not convincing, consider Yang, Xikang, et al. "Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM." arXiv preprint arXiv:2405.05610 (2024). 
5、	Persuasive Experiment: a) only 50 instances and two LLMs (GPT-4o, Claude-3.5) in ablation study cannot support that your multi-turn attack – ActorAttack surpasses Crescendo, please add more results; b) only use GPT-4O to judge ASR is single-minded, consider human, Llama-guard model, and moderation API
6、	Explanation: Is it a common practice to use the embedding function of MiniLMv2 for diversity evaluation of the prompts? Give more evidence.
7、	kind Suggestion:
1)	Actor- involved in the multi-turn dialogue generation and update
2)	Add more strategical method to choose the most helpful clue
3)	The intuitive defense method could be improved
</content>
</thread_object>

</thread>


Metareview: