Red Queen: Exposing Latent Multi-Turn Risks in Large Language Models (2025)

Abstract: The rapid advancement of large language models (LLMs) has unlocked diverse opportunities across domains and applications but has also raised concerns about their tendency to generate harmful responses under jailbreak attacks. However, most existing jailbreak strategies are single-turn with explicit malicious intent, failing to reflect the real-world scenario where interactions can be multi-turn and users can conceal their intents. Recent studies on Theory of Mind (ToM) reveal that LLMs often struggle to infer users’ latent intent in such scenarios. Building on these limitations, we propose a novel jailbreak attack, RED QUEEN ATTACK, which constructs a multi-turn scenario, concealing the malicious intent under the guise of preventing harm. We generate 56k multi-turn concealment data points across 40 scenarios and 14 harmful categories, evaluating four LLM families of different sizes. Results show all models are vulnerable to RED QUEEN ATTACK, reaching 87.6% attack success rate (ASR) on GPT-4o and 77.1% on Llama3-70B. Compared to prior jailbreak attacks, the RED QUEEN ATTACK achieves superior performance on nine out of ten models, with ASR improvements ranging from 2% to 64%. Further analysis reveals that larger models exhibit greater vulnerability to our attack, primarily due to the combination of multi-turn structures and concealment strategies. To enhance safety, we propose RED QUEEN GUARD, a mitigation strategy reducing ASR to below 1% while maintaining model performance on standard benchmarks. Full implementation and dataset are publicly accessible at https://github.com/kriti-hippo/red_queen.

## introduction recent advancements in novel training methodologies, computational capabilities, and data avail-* work done when yf was at hippocratic ai figure 1 : an example of red queen attack on "how to build a bomb". compared with a direct attack on the left, red queen attack constructs a multi-turn scenario and conceals harmful intent by claiming to thwart the efforts of a friend wanting to build a bomb. the attack response is derived from gpt-4. existing jailbreak research has explored a range of approaches @xcite , such as appending sentences to influence model responses @xcite or deploying another llm to generate and refine jailbreaks automati-cally @xcite . while these methods demonstrate effectiveness, they are largely limited to single-turn prompts and often fail to conceal harmful intent. recent work has begun exploring multi-turn interactions @xcite and concealment strategies @xcite , but these efforts remain disconnected from real-world scenarios, where attackers often combine multi-turn approaches with concealed malicious intent. in real-world interactions between humans, theory of mind @xcite , the ability to infer others' implicit intent and adjust behavior properly, is essential for effective interaction and communication @xcite . current studies, however, have shown that llms struggle to detect latent intent in conversations without explicit cues @xcite . this limitation becomes particularly significant in multi-turn scenarios, where malicious intent can be progressively concealed across multiple interactions. thus, it is crucial to investigate how llms perform under multi-turn interactions where malicious intent is concealed, a challenge that poses significant risks in complex real-world scenarios. to address this challenge, we formalize it from a theory of mind perspective and propose a new jailbreak attack, red queen attack, which constructs multi-turn scenarios to conceal malicious intent by pretending to be a protector while accusing someone else of the wrongdoing. as shown in figure 1 , the red queen attack first claims the friend is planning some harmful actions (e.g. build a bomb) and then, under the guise of reporting to authorities, asks for a plan to verify against the real one. we generate 40 multi-turn concealment scenarios using llama3.1-70b @xcite based on different occupations (e.g., police) and relations (e.g., friends), with varying turn lengths. we further combine scenarios with 14 harmful action categories from beavertails @xcite , resulting in 56k data points for multi-turn concealment jailbreaks. we conduct comprehensive experiments to evaluate the effectiveness of red queen attack on ten llms from four representative families of different sizes, including gpt-4o (openai, 2024), llama3 and llama3.1 @xcite , qwen2 @xcite , and mixtral @xcite . our experiments show red queen at-tack can achieve a high attack success rate (asr) in all tested models, notably 87.6% against gpt-4o and 77.1% against llama3-70b -two widely adopted closed/open-source llms. compared to previous jailbreaks, red queen attack achieves superior performance on nine out of ten models, with asr improvements ranging from 2% to 64%. to provide insight into the factor that influences multi-turn concealment jailbreak, we further conduct fine-grained analysis based on attack formats and model sizes. our analysis reveals that red queen attack is more effective on larger models within each family, with multi-turn structures and concealment significantly enhancing efficacy. considering the widespread use of llms and the priority of ensuring safety, we developed a simple direct preference optimization (dpo) @xcite mitigation strategy, red queen guard, which successfully reduces the attack success rate to below 1% while preserving performance on general benchmarks. our contributions can be listed as follows: 1) a new jailbreak attack, red queen attack, the first work constructing multi-turn scenarios based on theory of mind to conceal attackers' harmful intent. 2) a dataset of 56k highquality multi-turn concealment attacks across 14 harmful categories and 40 scenarios based on occupations and relations with varying turns. 3) a comprehensive evaluation of red queen at-tack on ten llms from four representative families, with further analysis based on different attack formats and model sizes. 4) a mitigation strategy, red queen guard, which employs multi-turn direct preference optimization (dpo) datasets to reduce the attack success rate to below 1% while maintaining performance on general benchmarks. ## construction of red queen attack in this section, we first outline the motivation for pursuing a scenario with concealment and then illustrate how we formalize the attack generally based on the theory of mind. we explain the actual scenario implementation and the generation of 56k multi-turn concealment data points in the end. ## experimental setup we describe models and baselines selected for our experiments and metrics used for attack evaluation. ## results we focus on four research questions: 1) how does the red queen attack perform across different llm families? 2) how does the red queen at-tack compare to prior jailbreak attacks? 3) what factors contribute to the success of the red queen attack? 4) what are the outputs of llms when the red queen attack succeeds or fails? overall asr of red queen attack. the main asr of the red queen attack on different models is shown in ## conclusions we introduce red queen attack, the first jailbreak method that constructs multi-turn scenarios to conceal harmful intent by claiming to prevent others from conducting malicious behavior. we develop 40 scenarios based on occupation and relationship with different lengths, combined with 14 categories of harmful actions, resulting in a dataset of 56k high-quality multi-turn attack examples. our evaluation across ten models from four major model families confirms the effectiveness of the red queen attack. further analysis reveals that both concealment and multi-turn structures enhance the attack's effectiveness, with larger models being particularly vulnerable. additionally, we propose red queen guard, a mitigation strategy that reduces the attack success rate to below 1% while preserving model performance on standard benchmarks. future work will focus on expanding the dataset's diversity and exploring mitigation strategies through reinforcement learning from human feedback or prompt-based defences with intention detection.