GRAF: Multi-turn Jailbreaking via Global Refinement and Active Fabrication

TL;DR

This paper introduces GRAF, a novel multi-turn jailbreaking method for large language models that refines attack strategies globally and fabricates responses to better induce harmful outputs, outperforming existing methods.

Contribution

GRAF is the first approach to globally refine attack trajectories and actively fabricate responses in multi-turn jailbreaking, enhancing effectiveness against state-of-the-art LLMs.

Findings

GRAF outperforms existing jailbreaking methods across six LLMs.

Global refinement improves attack success rate.

Active fabrication increases likelihood of harmful output elicitation.

Abstract

Large Language Models (LLMs) have demonstrated remarkable performance across diverse tasks. Nevertheless, they still pose notable safety risks due to potential misuse for malicious purposes. Jailbreaking, which seeks to induce models to generate harmful content through single-turn or multi-turn attacks, plays a crucial role in uncovering underlying security vulnerabilities. However, prior methods, including sophisticated multi-turn approaches, often struggle to adapt to the evolving dynamics of dialogue as interactions progress. To address this challenge, we propose \ours (JailBreaking via \textbf{G}lobally \textbf{R}efining and \textbf{A}daptively \textbf{F}abricating), a novel multi-turn jailbreaking method that globally refines the attack trajectory at each interaction. In addition, we actively fabricate model responses to suppress safety-related warnings, thereby increasing the likelihood of eliciting harmful outputs in subsequent queries. Extensive experiments across six state-of-the-art LLMs demonstrate the superior effectiveness of our approach compared to existing single-turn and multi-turn jailbreaking methods. Our code will be released at https://github.com/Ytang520/Multi-Turn_jailbreaking_Global-Refinment_and_Active-Fabrication.