Multi-Turn Jailbreaks Are Simpler Than They Seem

Multi-turn jailbreaks are not as sophisticated as they appear: The paper finds that multi-turn attacks—where attackers make multiple requests to gradually manipulate an AI into harmful behavior—work primarily because attackers can learn from rejections and retry, making them roughly equivalent to simply trying single-turn attacks many times rather than employing genuinely novel strategies.

Current defenses have a critical gap: While AI companies have made significant progress defending against single-turn jailbreak attempts, multi-turn attacks still succeed over 70% of the time against models optimized for single-turn protection, indicating that existing safety measures are incomplete.

Vulnerabilities transfer between similar models: The research reveals that attack success is correlated among similar models, meaning that jailbreaks discovered on one model often work on newly released competitors, which has implications for how quickly new AI systems become vulnerable after release.

More reasoning capability can paradoxically increase vulnerability: For reasoning-focused models, the paper found a surprising result: when models are given higher reasoning effort settings, attack success rates actually increase, suggesting that enhanced reasoning capabilities may introduce new safety vulnerabilities that weren't present in simpler models.

AI safety evaluation needs to account for multi-turn scenarios: The findings suggest that current benchmarks and safety testing may be insufficient because they often focus on single-turn interactions, missing a major class of attacks that persist in real-world usage where users can engage in extended conversations.