Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models (2025)

Abstract: Multi-turn jailbreak attacks simulate real-world human interactions by engaging large language models (LLMs) in iterative dialogues, exposing critical safety vulnerabilities. However, existing methods often struggle to balance semantic coherence with attack effectiveness, resulting in either benign semantic drift or ineffective detection evasion. To address this challenge, we propose Reasoning-Augmented Conversation (RACE), a novel multi-turn jailbreak framework that reformulates harmful queries into benign reasoning tasks and leverages LLMs’ strong reasoning capabilities to compromise safety alignment. Specifically, we introduce an attack state machine framework to systematically model problem translation and iterative reasoning, ensuring coherent query generation across multiple turns. Building on this framework, we design gain-guided exploration, self-play, and rejection feedback modules to preserve attack semantics, enhance effectiveness, and sustain reasoning-driven attack progression. Extensive experiments on multiple LLMs demonstrate that RACE achieves state-of-the-art attack effectiveness in complex conversational scenarios, with attack success rates (ASRs) increasing by up to 96%. Notably, our approach achieves average ASR of 83.3% against leading commercial models, including Gemini 2.0 Flashing Thinking and OpenAI o1, underscoring its potency.

## introduction llms have garnered widespread attention due to their remarkable ability to perform diverse tasks @xcite @xcite . however, studies have shown that llms can also generate unsafe or harmful content when prompted in certain ways @xcite . this vulnerability can be exploited through jailbreak attacks-carefully crafted prompts that bypass alignment constraints and elicit unintended responses @xcite . although harmful, jailbreak attacks @xcite serve as a key red-teaming approach for assessing the risk of llms generating unsafe content. currently, these attacks can be broadly categorized into single-turn and multi-turn jailbreaks. single-turn attacks attempt to bypass safety mechanisms within a single interaction @xcite @xcite @xcite , whereas multi-turn jailbreaks exploit the interactive nature of llms by engaging them in iterative dialogues that lead to unsafe outputs @xcite @xcite . compared to single-turn attacks, multi-turn jailbreaks simulate real-world human interactions and can expose critical safety blind spots, thereby attracting extensive interest @xcite . however, existing multiturn jailbreak methods often struggle to maintain a balance between semantic coherence and attack effectiveness. in other words, they either cause benign semantic drift (where the conversation deviates from the original harmful objective) or fail to bypass alignment constraints, thereby limiting their overall attack performance. to address this, we propose reasoning-augmented conversation (race), a jailbreak framework that exploits llms' strong reasoning capabilities @xcite by reformulating harmful queries into benign reasoning tasks. these benign and complex reasoning tasks are carefully designed such that their completion inherently leads the model to generate harmful content, effectively compromising safety alignment. to structure this process, we introduce an attack state machine (asm) reasoning framework based on a finite state machine @xcite , which organizes jailbreaks into a sequence of reasoning states and transitions, ensuring semantic alignment and coherence. building on this framework, we design gain-guided exploration, self-play, and rejection feedback modules to preserve attack semantics, enhance effectiveness, and sustain reasoning-driven attack progression. specifically, gain-guided exploration selects queries that remain semantically aligned with the target while extracting useful information to ensure steady progress. self-play simulates rejection responses within a shadow model, refining queries in advance and increasing success rates against the victim model. rejection feedback adapts failed queries into alternative reasoning tasks, enabling rapid recovery and sustained attack stability. by combining these modules, race enables a structured and adaptive jailbreak method that is both highly effective yet challenging to mitigate. fig. 1 illustrates the attack diagram of race. we conducted extensive experiments on multiple llms to evaluate the effectiveness of race in multi-turn jailbreak scenarios. the results demonstrate that race achieves attack success rates (asrs) of up to 96%, highlighting its capability in complex conversational settings. notably, our approach attained average asr of 83.3% against the leading commercial models. these findings underscore the potency of reasoning-driven jailbreak attacks and the pressing need for stronger safety mechanisms. we hope our work will contribute to advancing llm safety research and improving awareness of the potential misuse of llms' reasoning capabilities. while the reasoning capabilities of llms have contributed to their impressive performance across various downstream tasks, their potential exploitation in jailbreak attacks remains largely unexplored. in this study, we focus on leveraging reasoning capabilities to facilitate jailbreak attacks. multi-turn jailbreak attack. typical multiturn jailbreak methods follow the principle of starting with harmless conversations and gradually making the queries more harmful in subsequent turns. different methods have designed specific strategies based on this principle, including applying cognitive psychology theories to gradually modify subsequent queries @xcite , using actor networks to expand the attack range of subsequent queries @xcite , extracting harmful keywords from original queries to construct semantically equivalent ones @xcite , and breaking down the target query into multiple subqueries and merging the corresponding answers to achieve the final jailbreak @xcite . existing multi-turn jailbreak methods often suffer from semantic drift or fail to generate effective attacks. in contrast, our approach leverages llms' reasoning capabilities to ensure a stable and effective jailbreak process. ## threat model the target llm m has undergone safety alignment prior to release and is expected to avoid generat-ing unsafe responses even when presented with a harmful target query q. in this study, we investigate self-jailbreaking, where both the querying and response-generating models originate from the same model. for clarity, we instantiate the target model m as two distinct roles: a shadow model m s , responsible for generating queries, and a victim model m v , tasked with providing responses. the goal of the shadow model is to generate a sequence of queries {q 1 , q 2 , ..., q n } during its interaction with the victim model to induce unsafe responses. given practical deployment scenarios, the attack is conducted in a black-box setting where the shadow model can only access the victim model's responses during its interactions. however, the shadow model can adaptively adjust the current query q i (where i denotes the current conversation turn) based on the context c i-1 , which includes the query-response pairs [(q 1 , r 1 ) , ... (q i-1 , r i-1 )] from all preceding conversation turns. ## conclusion we propose a reasoning-driven jailbreak framework that exploits llms' reasoning abilities to bypass safety alignment. by modeling the attack as a state machine, our method reframes harmful intent as complex but benign-looking reasoning tasks. it integrates gain-guided exploration, self-play, and rejection feedback to steer reasoning, refine queries, and recover from failures. experiments show our approach effectively breaks safety alignments, exposing critical llm vulnerabilities.