Chain of Attack: Hide Your Intention through Multi-Turn Interrogation (2025)

Abstract: The latent knowledge of large language models (LLMs) contains harmful or unethical content, which introduces significant security risks upon their widespread deployment. Conducting jailbreak attacks on LLMs can proactively identify vulnerabilities to enhance their security measures. However, previous jailbreak attacks primarily focus on single-turn dialogue scenarios, leaving vulnerabilities in multi-turn dialogue contexts inadequately explored. This paper investigates the resilience of black-box LLMs in multi-turn jailbreak attack scenarios from a novel interrogation perspective. We propose an optimal interrogation principle to conceal the jailbreak intent and introduce a multi-turn attack chain generation strategy called CoA. By employing two effective interrogation strategies tailored for LLMs, coupled with an interrogation history record management mechanis, it achieves a significant optimization of the attack process. Our approach enables the iterative generation of attack chains, offering a powerful tool for LLM red team testing. Experimental results demonstrate that LLMs exhibit insufficient resistance under multi-turn interrogation, with our method shows more advantages(ASR, 83% vs 64%). This work offers new insights into improving the safety of LLMs.

## introduction as a significant breakthrough in the field of artificial intelligence, large language models (llms) have been extensively applied in areas such as chatbots, machine translation, and content creation due to their exceptional capabilities in understanding and processing complex logic @xcite @xcite . however, the knowledge space of llms encompasses a substantial amount of harmful or unethical content @xcite . misuse of such content not only undermines their reliability and performance but also poses severe threats to user safety and social stability @xcite . to address these risks, various security defense mechanisms @xcite are typically introduced into llms prior to their actual deployment, aiming to reduce the likelihood of harmful outputs. as a red team technique, jailbreaking attacks manipulate llms to bypass their security defenses and generate harmful outputs by using carefully designed prompts. given its effectiveness in identifying vulnerabilities and guiding the evolution of defense strategies, jailbreaking has garnered significant attention from the llm security research community in recent years @xcite @xcite . current research has seen a proliferation of jailbreaking attacks targeting single-turn conversations, while vulnerabilities in multi-turn dialogue scenarios remain underexplored. in practice, when an initial attack fails, attackers often adaptively refine jailbreaking prompts based on feedback from the victim model in a multi-turn process. furthermore, the contextual depth of multi-turn exchanges provides opportunities to conceal malicious intent, which, when strategically utilized, can facilitate bypassing llm defense mechanisms. for instance, cosafe @xcite successfully executed an attack on llms by employing mutual references in multi-turn dialogues. despite this, there remains a lack of theoretical guidance on maximizing the concealment of jailbreaking intent and inducing high-quality attacks in multi-turn contexts. in this paper, we explore the resistance of blackbox llms under multi-turn jailbreak attacks, by innovatively conceptualizing the attack process as a multi-turn interrogation on the llm. rationality comes from the extensive human-like alignment measures that llms undergo. the endeavor to elicit harmful outputs from llms through multiturn dialogues can be likened to the process of interrogating suspects who conceal illegal activities in human society. this analogy paves the way for leveraging the extensive expertise from the domain of interrogation techniques @xcite to refine the crafting of multi-turn jailbreaking prompts. specifically, we have designed two interrogation strategies for llm and proposed the optimal interrogation principles. on this basis, a multi-turn interrogation method coa is proposed, which iteratively generates optimized attack chains through the rational design of interrogator and a random walk based interrogation history record management mechanism, providing a new powerful method for llm red team testing. this paper offers the following contributions: llms from a novel view of interrogation, and propose the optimal multi-turn interrogation principle. ## multi-turn interrogation on llm we drew inspiration from interrogation techniques, treating the model as a suspect and employing a multi-turn interrogation to obscure jailbreak intentions and manipulate the llm into generating harmful content. ## method: chain of attack now we provide a high-quality multi-turn jailbreak attack method chain of attack (coa) guided by the principle of optimal interrogation. ## conclusion this paper explores the vulnerabilities of blackbox llms in multi-turn jailbreak attack scenarios. we propose a novel interrogation principle that effectively conceals the jailbreak intent and intro-duce a multi-turn attack chain generation strategy, coa, which combines two tailored interrogation techniques. our experiments demonstrate that our method outperforms existing approaches, achieving an asr of 83%, compared to 64%. this work provides valuable insights into llm safety and sets the stage for developing more robust defense mechanisms. future work will focus on reaching the upper bound of the optimal interrogation principle and exploring the use of reinforcement learning to optimize the multi-turn interrogation process, further enhancing llm safety testing.