SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks

2026-08-02

AI Summary

This work addresses multi-turn jailbreak attacks against large language models, wherein malicious intent is concealed across dialogue turns to evade existing defenses. It presents the first systematic modeling of such attacks from the perspective of intent structure, introducing a four-dimensional taxonomy tailored to adversarial intent. The study demonstrates that the organization and evolution of intent are pivotal determinants of both attack efficacy and detectability. Through controlled ablation studies, intent structure analysis, and cross-conversation detection modeling, the research reveals that intent organization strategies exert a significantly greater influence on attack success than contextual length or query frequency. These findings underscore the necessity of developing novel safety mechanisms operating at the intra- or inter-conversation level to effectively counter such sophisticated threats.

Abstract

Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.

Problem

• multi-turn jailbreaks
• adversarial intent
• LLM safety
• intent organization
• dialogue-based attacks

Innovation

• intent-oriented taxonomy
• multi-turn jailbreaks
• adversarial intent structure
• session-level detection
• LLM safety evaluation