Pattern Enhanced Multi-Turn Jailbreaking

Description

Pattern Enhanced Chain of Attack (PE-CoA) shows that safety controls can be bypassed gradually across a conversation. The paper evaluates five recurring conversational patterns and finds that resistance to one pattern does not reliably generalize to others, creating a black-box, multi-turn jailbreak risk even when individual turns appear benign.

Examples

A defensive reproduction can use inert goals and vary only the conversational framing (for example, educational discussion, personal experience, or a hypothetical scenario) across several turns. The primary evaluation covers twelve language models and ten harm categories: arXiv:2510.08859 (opens in a new tab).

Impact

An attacker can accumulate conversational context to bypass refusal behavior and elicit policy-violating responses. Shared failure patterns across related model families also make these attacks more transferable than single-pattern evaluations suggest.

Affected Systems

• Conversational LLM deployments that retain multi-turn context, including the Claude, DeepSeek, Gemini, GPT, Llama, Mistral, and Vicuna variants listed in the entry metadata.

Mitigation Steps

• Evaluate complete conversations with multiple attack patterns and inert test goals; do not rely on single-turn refusal rates as the sole safety signal.
• Reassess intent and policy compliance using the full conversation state before responding or invoking tools, and reset or constrain context when risk escalates.
• Add pattern-aware regression tests and rate limits for repeated refusal-reframing attempts.

Evidence

Primary source: Pattern Enhanced Multi-Turn Jailbreaking (opens in a new tab).