ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack

TL;DR

This paper introduces ICON, a novel framework for multi-turn jailbreak attacks on LLMs that efficiently constructs adversarial contexts by leveraging intent-context coupling, significantly improving attack success rates.

Contribution

The paper proposes ICON, an automated multi-turn jailbreak method utilizing semantic routing and hierarchical optimization to enhance attack efficiency and effectiveness.

Findings

Achieves an average Attack Success Rate of 97.1% across eight SOTA LLMs.

Effectively constructs authoritative-style contexts to bypass safety constraints.

Demonstrates superior performance over existing methods in multi-turn jailbreak attacks.

Abstract

Multi-turn jailbreak attacks have emerged as a critical threat to Large Language Models (LLMs), bypassing safety mechanisms by progressively constructing adversarial contexts from scratch and incrementally refining prompts. However, existing methods suffer from the inefficiency of incremental context construction that requires step-by-step LLM interaction, and often stagnate in suboptimal regions due to surface-level optimization. In this paper, we characterize the Intent-Context Coupling phenomenon, revealing that LLM safety constraints are significantly relaxed when a malicious intent is coupled with a semantically congruent context pattern. Driven by this insight, we propose ICON, an automated multi-turn jailbreak framework that efficiently constructs an authoritative-style context via prior-guided semantic routing. Specifically, ICON first routes the malicious intent to a congruent context pattern (e.g., Scientific Research) and instantiates it into an attack prompt sequence. This sequence progressively builds the authoritative-style context and ultimately elicits prohibited content. In addition, ICON incorporates a Hierarchical Optimization Strategy that combines local prompt refinement with global context switching, preventing the attack from stagnating in ineffective contexts. Experimental results across eight SOTA LLMs demonstrate the effectiveness of ICON, achieving a state-of-the-art average Attack Success Rate (ASR) of 97.1\%. Code is available at https://github.com/xwlin-roy/ICON.