SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks

• URL: http://arxiv.org/abs/2608.01117v1
• Date: Sun, 02 Aug 2026 09:24:08 GMT
• Title: SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks
• Abstract summary: Multi-turn jailbreaks exploit a pattern by advancing a harmful intent across turns, so that no single message exposes the full objective.<n>We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure.
• Score: 69.08780911753102
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.

Related papers

• INTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignment [27.025430116180477]
  We study agentic misalignment, where agents take harmful actions under goal conflicts and pressures.<n>Using chain-of-thought (CoT) monitoring, we find that harmful execution is often preceded by intent signals in reasoning.<n>We introduce INTENT-AS-A-TOOL, an approach that adds intent-targeted tools to give the model a dedicated channel for expressing commitment to a target behavior.
  arXiv  Detail & Related papers  (2026-08-27T16:47:19Z)
• Can Segmentation Models Understand the World? Towards Proactive Affordance Reasoning via Visual Chain-of-Thought [61.69802853759301]
  We introduce SegWorld, where the model reasons about the scene through a multi-level visual chain-of-thought.<n>We formalize SegWorld as probabilistic inference, in which proactive observation supplies a linguistic scene context.<n>Experiments show SegWorld matches instruction-driven baselines on target-referential instructions and improves substantially on intent-level ones.
  arXiv  Detail & Related papers  (2026-05-26T23:26:52Z)
• One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue [55.98008208209856]
  Hidden malicious intent in multi-turn dialogue poses a growing threat to large language models (LLMs)<n>Recent studies show that even modern commercial models with advanced guardrails remain vulnerable to such attacks despite advances in safety alignment and external guardrails.<n>In this work, we address this challenge by detecting the earliest turn at which delivering the candidate response would make the accumulated interaction sufficient to enable harmful action.
  arXiv  Detail & Related papers  (2026-05-07T03:35:31Z)
• SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks [53.97948802255959]
  We propose a framework that trains a multi-turn attacker without relying on any existing strategies or external data.<n>Prefilling self-tuning enables usable rollouts by fine-tuning on non-refusal, well-structured, multi-turn adversarial prompts.<n>We anchor harmful intent in multi-turn jailbreaks via an intent-drift-aware reward that combines intent alignment, compliance risk, and level of detail.
  arXiv  Detail & Related papers  (2026-02-06T16:44:57Z)
• Analysis of Utterance Embeddings and Clustering Methods Related to Intent Induction for Task-Oriented Dialogue [8.07809100513473]
  This work investigates unsupervised approaches to overcome challenges in designing task-oriented dialog schema. We postulate there are two salient factors for automatic induction of intents: (1) clustering algorithm for intent labeling and (2) user utterance embedding space. Pretrained MiniLM with Agglomerative clustering shows significant improvement in NMI, ARI, F1, accuracy and example coverage in intent induction tasks.
  arXiv  Detail & Related papers  (2022-12-05T04:37:22Z)
• Discovering New Intents with Deep Aligned Clustering [19.11073686645496]
  We propose an effective method, Deep Aligned Clustering, to discover new intents with the aid of limited known intent data. With an unknown number of new intents, we predict the number of intent categories by eliminating low-confidence intent-wise clusters. Experiments on two benchmark datasets show that our method is more robust and achieves substantial improvements over the state-of-the-art methods.
  arXiv  Detail & Related papers  (2020-12-16T14:32:06Z)
• Learning with Weak Supervision for Email Intent Detection [56.71599262462638]
  We propose to leverage user actions as a source of weak supervision to detect intents in emails. We develop an end-to-end robust deep neural network model for email intent identification.
  arXiv  Detail & Related papers  (2020-05-26T23:41:05Z)
• AGIF: An Adaptive Graph-Interactive Framework for Joint Multiple Intent Detection and Slot Filling [69.59096090788125]
  In this paper, we propose an Adaptive Graph-Interactive Framework (AGIF) for joint multiple intent detection and slot filling. We introduce an intent-slot graph interaction layer to model the strong correlation between the slot and intents. Such an interaction layer is applied to each token adaptively, which has the advantage to automatically extract the relevant intents information.
  arXiv  Detail & Related papers  (2020-04-21T15:07:34Z)
• Automatic Inference of High-Level Network Intents by Mining Forwarding Patterns [0.6980076213134384]
  There is a semantic gap between the high-level intents of network operators and the low-level configurations that achieve the intents. This paper discusses an alternative approach for bridging the gap, namely to infer the high-level intents from the low-level network behavior.
  arXiv  Detail & Related papers  (2020-02-06T18:06:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.