SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks
This SoK reframes multi-turn LLM jailbreaks around how an attacker decomposes and advances harmful intent across a dialogue, proposing a four-part intent-oriented taxonomy and showing via ablations that attack success depends more on deliberate intent organization than on raw context length or number of queries. Its useful insight is that different intent structures shift detection from per-turn to whole-session or even cross-session analysis, making turn-local safety and single-shot evaluations look fundamentally inadequate, though the work’s claims appear bounded by its chosen taxonomy, experimental attack set, and the practical difficulty of deploying broader-session monitoring without privacy and scalability tradeoffs.
Abstract
Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.