MEEA: Mere Exposure Effect-Driven Confrontational Optimization for LLM Jailbreaking

TL;DR

This paper introduces MEEA, a novel black-box framework inspired by psychology, that uses repeated low-toxicity prompts to gradually weaken LLM safety alignment through multi-turn interactions, revealing the dynamic nature of safety boundaries.

Contribution

MEEA is the first automated attack framework leveraging the mere exposure effect to evaluate multi-turn safety robustness of LLMs, demonstrating significant improvements over existing methods.

Findings

MEEA achieves over 20% higher attack success rates than baselines.

Safety boundaries of LLMs are dynamic and history-dependent.

Both annealing optimization and contextual exposure are crucial for effective attacks.

Abstract

The rapid advancement of large language models (LLMs) has intensified concerns about the robustness of their safety alignment. While existing jailbreak studies explore both single-turn and multi-turn strategies, most implicitly assume a static safety boundary and fail to account for how contextual interactions dynamically influence model behavior, leading to limited stability and generalization. Motivated by this gap, we propose MEEA (Mere Exposure Effect Attack), a psychology-inspired, fully automated black-box framework for evaluating multi-turn safety robustness, grounded in the mere exposure effect. MEEA leverages repeated low-toxicity semantic exposure to induce a gradual shift in a model's effective safety threshold, enabling progressive erosion of alignment constraints over sustained interactions. Concretely, MEEA constructs semantically progressive prompt chains and optimizes them using a simulated annealing strategy guided by semantic similarity, toxicity, and jailbreak effectiveness. Extensive experiments on both closed-source and open-source models, including GPT-4, Claude-3.5, and DeepSeek-R1, demonstrate that MEEA consistently achieves higher attack success rates than seven representative baselines, with an average Attack Success Rate (ASR) improvement exceeding 20%. Ablation studies further validate the necessity of both annealing-based optimization and contextual exposure mechanisms. Beyond improved attack effectiveness, our findings indicate that LLM safety behavior is inherently dynamic and history-dependent, challenging the common assumption of static alignment boundaries and highlighting the need for interaction-aware safety evaluation and defense mechanisms. Our code is available at: https://github.com/Carney-lsz/MEEA