A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks

TL;DR

This paper investigates how multi-turn jailbreak attacks exploit model representations to bypass safety defenses, revealing that such attacks often keep models in benign regions of representation space across multiple turns.

Contribution

It introduces a representation-level analysis of multi-turn jailbreaks, highlighting why existing defenses fail and suggesting the need for new mitigation strategies.

Findings

Multi-turn jailbreaks keep models in benign representation regions.

Safety-aligned models often misrepresent harmful responses as benign.

Single-turn defenses are ineffective against multi-turn attacks.

Abstract

Recent research has demonstrated that state-of-the-art LLMs and defenses remain susceptible to multi-turn jailbreak attacks. These attacks require only closed-box model access and are often easy to perform manually, posing a significant threat to the safe and secure deployment of LLM-based systems. We study the effectiveness of the Crescendo multi-turn jailbreak at the level of intermediate model representations and find that safety-aligned LMs often represent Crescendo responses as more benign than harmful, especially as the number of conversation turns increases. Our analysis indicates that at each turn, Crescendo prompts tend to keep model outputs in a "benign" region of representation space, effectively tricking the model into fulfilling harmful requests. Further, our results help explain why single-turn jailbreak defenses like circuit breakers are generally ineffective against multi-turn attacks, motivating the development of mitigations that address this generalization gap.