Title: Analogy-based Multi-Turn Jailbreak against Large Language Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Multi-turn jailbreak

large language models
Abstract: Large language models (LLMs) are inherently designed to support multi-turn interactions, which opens up new possibilities for jailbreak attacks that unfold gradually and potentially bypass safety mechanisms more effectively than single-turn attacks. However, current multi-turn jailbreak methods are still in their early stages and suffer from two key limitations. First, they all inherently require inserting sensitive phrases into the context, which makes the dialogue appear suspicious and increases the likelihood of rejection, undermining the effectiveness of the attack. Second, even when harmful content is generated, the response often fails to align with the malicious prompt due to semantic drift, where the conversation slowly moves away from its intended goal. To address these challenges, we propose an analogy-based black-box multi-turn jailbreak framework that constructs fully benign contexts to improve attack success rate while ensuring semantic alignment with the malicious intent. The method first guides the model through safe tasks that mirror the response structure of the malicious prompt, enabling it to internalize the format without exposure to sensitive content. A controlled semantic shift is then introduced in the final turn, substituting benign elements with malicious ones while preserving structural coherence. Experiments on six commercial and open-source LLMs, two benchmark datasets show that our method significantly improves attack performance, achieving an average attack success rate of 93.3\% and outperforming five competitive baselines. Our code is released at https://github.com/MM-WW55/AMA


Peer reviews:
comments: SUMMARY:
This paper proposes AMA, an analogy-based multi-turn jailbreak attack against large language models. The main idea is to use analogy to improve the stealthiness of the attack so that it won't be easily detected by the LLMs. Also, AMA shifts the semantics slowly so that the LLMs are more likely to stay on the right topic without drifting too much. The experiment shows that this attack method is effective on different closed-course models and two different benchmark datasets.

STRENGTHS AND WEAKNESSES:
Strength:
1. The paper is well-written, and the idea makes sense and is easy to follow.

2. The idea of using analogy to increase stealthiness is interesting.

3. The entropy judge is interesting, and it seems to be working via the results from the ablation study. 

Weakness:

1. Section 4.2.2 talks about controlling the semantic shift of models, which is a crucial part of the proposed method. However, it seems like the control is handed to the model and there seems to be no way to monitor or quantify this semantic shift. 

2. Using llama-3.1-70b as an attack model is okay but it may be too strong. The paper may be more convincing to show what will happen if you adopt a weaker model as an attacker.

QUESTIONS:
1. How is the semantic shift measured and quantified?

2. How is the semantic shift controlled during the attack?

3. What will happen if you use a weaker model as the attacker?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Analogy-based Multi-turn Attack (AMA), a black-box jailbreak framework that leverages multi-turn interactions to stealthily induce harmful behavior in LLMs. Unlike prior work that inserts sensitive content early in the dialogue, AMA separates structure and semantics. It uses analogical, benign proxy tasks to train the model on the response structure of the malicious prompt, followed by a final-turn semantic shift to malicious content.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The method is technically sound and well-motivated by prior limitations in multi-turn jailbreaks.\n- Experimental setup is rigorous, including six target models and five baselines.\n- The paper evaluates not just success rate but semantic consistency and harmfulness, which are often overlooked.\n- Feedback-driven optimization (EntropyJudge and JailbreakJudge) adds adaptivity and robustness to the attack.\n- Ablation and sensitivity studies are detailed and justify design choices.\n\nWeakness:\n- AMA relies on a domain-agnostic template (L191), but the paper does not clarify how this template is obtained. From my understanding, it is likely predefined by the authors. If this is not the case, clarification would be appreciated. The reliance on such specific templates may limit the generalizability of AMA to arbitrary harmful prompt structures, especially for non-procedural or unstructured queries.\n- The evaluation is conducted on two benchmarks: a 50-question subset of AdvBench and 100 instructions from JailbreakBench. While these are reasonable starting points, they may be insufficient to fully validate the method’s generality. Incorporating larger or more recent benchmarks—such as the full AdvBench (which contains 520 prompts) or the newly proposed StrongREJECT [1], SG-Bench[2]—could strengthen the empirical support and make the conclusions more convincing.\n\n[1] A StrongREJECT for Empty Jailbreaks. arXiv:2402.10260, 2024.\n\n[2] SG-Bench: Evaluating LLM Safety Generalization Across Diverse Tasks and Prompt Types\n\nQUESTIONS:\n- Can you provide more direct quantitative evidence (besides EntropyJudge) that structural features (e.g., procedural steps, list format) are preserved between proxy and final prompts?\n- AMA seems tailored to step-by-step or structured outputs (e.g., how-to guides). How would it perform on unstructured malicious prompts, like open-ended hate speech?\n- Could the analogy templates be automatically generated or learned to improve automation and adaptability across domains?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces an analogy-based black-box multi-turn jailbreak attack framework (AMA) that constructs benign contexts to improve attack success rate while ensuring semantic alignment with the malicious intent. Unlike prior methods, AMA separates structural learning and semantic injection, using analogy-based prompts and a final semantic shift to elicit malicious responses. AMA demonstrates high attack success rates on both commercial and open-source LLMs, achieving an average ASR of 93.3%, surpassing five competitive baselines.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- Trending topic\n- Efforts in experiments\n- Low detectability\n\nWeaknesses:\n- Dependence on predefined templates\n- Lack of experiments on more advanced LLM-based guardrails\n\nThere are several concerns to be addressed:\n- Despite automation claims, the framework still requires template abstraction, safe keyword sampling, and manual control over domain mappings.\n- Currently many LLM-based safety guardrails are proposed to mitigate potential risks such as jailbreak attacks, such as LlamaGuard series (1, 2, and 3) and WildGurad. These guardrails can be conducted in both input and output stages. For input stage, they would detect whether the input is harmful; while in the output stage, it will check the LLM's output and prevent it from generating harmful content. Thus I would doubt whether AMA could bypass such guardrails. It would be appreciated if the authors can conduct experiments on the guardrails such as LlamaGuard 3.\n- It would be interesting to know if there are potential ways to mitigate the attack. From which perspective do the authors think it might be possible?\n- Several references might be useful:\n  - Chu, Junjie, et al. \"JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs.\" arXiv preprint arXiv:2402.05668 (2024).\n  - Xu, Zhao, Fan Liu, and Hao Liu. \"Bag of tricks: Benchmarking of jailbreak attacks on llms.\" arXiv preprint arXiv:2406.09324 (2024).\n\nQUESTIONS:\nPlease see the weaknesses.\n\nLIMITATIONS:\nPlease see the weakness.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper identifies key limitations of existing multi-turn jailbreak methods, which are the rejection caused by suspicious malicious words and semantic shift in the last turn. Correspondingly, authors propose Analogy-based Multi-Turn Jailbreak (AMA) to achieve efficient and effective stealthy and controllable jailbreaks. Authors conduct experiments to demonstrate the superiority of the proposed AMA.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\nThis paper presents good motivation and insights. It identifies key limitations of previous works and proposes corresponding optimizations. Potentially, the proposed AMA can be an effective multi-turn jailbreak method.\nWeaknesses\nOverall, the methods are not delivered clearly, and some sections are missing important details, impacting the understanding.\nAbout the methods:\n1.\tThe overview of AMA (Figure 4) is unclear. Further improvement is needed to organize the functions and order of the different parts in the Figures rationally. For example, the notations in the figure ($f_i$ and $f^\\prime_i$) are not clear. \n2.\tAt line 192, how are the domain-keyword pairs being sampled? The sampling methods seem to be a core part of the proposed AMA methods.\n3.\tSection 4.2.3 is unclear. The main ambiguity is concentrated between line 227 and line 229. For example, what the “prompt optimization” means (at line 227), and how the attack model does analysis and regeneration (line 229)\nAbout the experiments:\n1.\tThe authors did not provide the efficiency analysis of the proposed AMA and benchmarks. For example, the time/token cost versus different hyperparameters like conversation turns $T$ can be included to see how efficient the AMA is. \n2.\tThe evaluation datasets are very limited. The authors evaluate their methods on only 50 questions of the Advbench Subset and 100 questions of the Jailbreakbench. It is recommended to present more extensive results on different datasets.\n\nQUESTIONS:\nSee weaknesses.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}