HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models

• URL: http://arxiv.org/abs/2510.18728v1
• Date: Tue, 21 Oct 2025 15:28:20 GMT
• Title: HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models
• Abstract summary: Large Language Models (LLMs) remain vulnerable to multi-turn jailbreak attacks.<n>HarmNet is a modular framework comprising ThoughtNet, a hierarchical semantic network.<n>HarmNet systematically explores and refines the adversarial space to uncover stealthy, high-success attack paths.
• Score: 8.210113765535338
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Language Models (LLMs) remain vulnerable to multi-turn jailbreak attacks. We introduce HarmNet, a modular framework comprising ThoughtNet, a hierarchical semantic network; a feedback-driven Simulator for iterative query refinement; and a Network Traverser for real-time adaptive attack execution. HarmNet systematically explores and refines the adversarial space to uncover stealthy, high-success attack paths. Experiments across closed-source and open-source LLMs show that HarmNet outperforms state-of-the-art methods, achieving higher attack success rates. For example, on Mistral-7B, HarmNet achieves a 99.4% attack success rate, 13.9% higher than the best baseline. Index terms: jailbreak attacks; large language models; adversarial framework; query refinement.

Related papers

• Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models [25.860894697929737]
  We propose Meta-Adaptive Multimodal Jailbreaking (MAMJ) to optimize the attacker itself along two axes: an attack strategy prompt (ASP) governing attack iteration and attacker model weights determining attack effectiveness.<n>On MM-SafetyBench, MAMJ achieves 81.0%, 78.9%, and 82.3% ASR against GPT-4o, Gemini-3-Pro-adaptive, and Seed 2.0, respectively, outperforming the strongest sample-level baseline by up to 24.1 percentage points.
  arXiv  Detail & Related papers  (2026-08-27T15:23:22Z)
• MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models [53.05463623673949]
  MaskForge is a fully black-box adaptive attack that casts dLLM red-teaming as optimized search over a growing library of structural patterns.<n>It achieves an average attack success rate of 79.3%, a 17.6% improvement over the strongest competing dLLM baseline.
  arXiv  Detail & Related papers  (2026-06-01T18:10:21Z)
• Adversarial Reframing: A Framework for Targeted Generation in Language Models [4.231181719953953]
  Large Language Models (LLMs) are widely deployed in diverse real-world settings, yet remain vulnerable to jailbreaking, where prompt-based attacks safety filters.<n>We present THREAT (edversa bypass generation via Reframing) as a tool for proactively strengthening the safety of foundation models.
  arXiv  Detail & Related papers  (2026-05-20T19:31:07Z)
• RL-MTJail: Reinforcement Learning for Automated Black-Box Multi-Turn Jailbreaking of Large Language Models [60.201244463046784]
  Large language models are vulnerable to jailbreak attacks.<n>This paper studies black-box multi-turn jailbreaks, aiming to train attacker LLMs to elicit harmful content from black-box models.
  arXiv  Detail & Related papers  (2025-12-08T17:42:59Z)
• NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks [8.210113765535338]
  Large Language Models (LLMs) have revolutionized natural language processing but remain vulnerable to jailbreak attacks.<n>We present NEXUS, a modular framework for constructing, refining, and executing optimized multi-turn attacks.
  arXiv  Detail & Related papers  (2025-10-03T18:24:14Z)
• GuardNet: Graph-Attention Filtering for Jailbreak Defense in Large Language Models [5.550877102788988]
  Large Language Models (LLMs) are increasingly susceptible to jailbreak attacks.<n>These attacks undermine the safety, reliability, and trustworthiness of LLM outputs.<n>We propose GuardNet, a hierarchical filtering framework that detects and filters jailbreak prompts prior to inference.
  arXiv  Detail & Related papers  (2025-09-27T01:21:12Z)
• Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models [17.860698041523918]
  Contextual priming, where earlier stimuli covertly bias later judgments, offers an unexplored attack surface for large language models (LLMs)<n>We propose Response Attack, which uses an auxiliary LLM to generate a mildly harmful response to a paraphrased version of the original malicious query.<n> RA consistently outperforms seven state-of-the-art jailbreak techniques, achieving higher attack success rates.
  arXiv  Detail & Related papers  (2025-07-07T17:56:05Z)
• MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs [14.530593083777502]
  We propose MetaCipher, a low-cost, multi-agent jailbreak framework.<n>Within as few as 10 queries, MetaCipher achieves state-of-the-art attack success rates on recent malicious prompt benchmarks.
  arXiv  Detail & Related papers  (2025-06-27T18:15:56Z)
• Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models [53.580928907886324]
  Reasoning-Augmented Conversation is a novel multi-turn jailbreak framework.<n>It reformulates harmful queries into benign reasoning tasks.<n>We show that RACE achieves state-of-the-art attack effectiveness in complex conversational scenarios.
  arXiv  Detail & Related papers  (2025-02-16T09:27:44Z)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks [87.64278063236847]
  In this work, we propose a unified threat model for the principled comparison of jailbreak attacks.<n>Our threat model checks if a given jailbreak is likely to occur in the distribution of text.<n>We adapt popular attacks to this threat model, and, for the first time, benchmark these attacks on equal footing with it.
  arXiv  Detail & Related papers  (2024-10-21T17:27:01Z)
• Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation [71.92055093709924]
  We propose a novel method that "translates" garbled adversarial prompts into coherent and human-readable natural language adversarial prompts.<n>It also offers a new approach to discovering effective designs for jailbreak prompts, advancing the understanding of jailbreak attacks.<n>Our method achieves over 90% attack success rates against Llama-2-Chat models on AdvBench, despite their outstanding resistance to jailbreak attacks.
  arXiv  Detail & Related papers  (2024-10-15T06:31:04Z)
• RED QUEEN: Safeguarding Large Language Models against Concealed Multi-Turn Jailbreaking [28.95203269961824]
  We propose a new jailbreak approach, RED QUEEN ATTACK, that constructs a multi-turn scenario, concealing the malicious intent under the guise of preventing harm.<n>Our experiments reveal that all LLMs are vulnerable to RED QUEEN ATTACK, reaching 87.62% attack success rate on GPT-4o and 75.4% on Llama3-70B.<n>To prioritize safety, we introduce a straightforward mitigation strategy called RED QUEEN GUARD, which aligns LLMs to effectively counter adversarial attacks.
  arXiv  Detail & Related papers  (2024-09-26T01:24:17Z)
• h4rm3l: A language for Composable Jailbreak Attack Synthesis [48.5611060845958]
  h4rm3l is a novel approach that addresses the gap with a human-readable domain-specific language.<n>We show that h4rm3l's synthesized attacks are diverse and more successful than existing jailbreak attacks in literature.
  arXiv  Detail & Related papers  (2024-08-09T01:45:39Z)
• Weak-to-Strong Jailbreaking on Large Language Models [92.52448762164926]
  Large language models (LLMs) are vulnerable to jailbreak attacks.<n>Existing jailbreaking methods are computationally costly.<n>We propose the weak-to-strong jailbreaking attack.
  arXiv  Detail & Related papers  (2024-01-30T18:48:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.