TLDR: AutoAdv is a training-free framework for automated multi-turn jailbreaking of Large Language Models (LLMs). It uses a pattern manager, a temperature manager, and a two-phase rewriting strategy to adaptively refine adversarial prompts over multiple conversational turns. AutoAdv achieved up to 95% attack success rate on Llama-3.1-8B, significantly outperforming single-turn baselines and revealing persistent vulnerabilities in current LLM safety mechanisms, emphasizing the need for multi-turn-aware defenses.
Large Language Models (LLMs) have become incredibly powerful, but they still have a significant weakness: they can be “jailbroken.” This means that carefully designed prompts can trick them into generating harmful or restricted content. While many evaluations focus on single, isolated prompts, real-world attacks are often more sophisticated, unfolding over multiple turns in a conversation where attackers adapt their requests until the model complies.
Addressing this critical gap, researchers Aashray Reddy, Andrew Zagula, and Nicholas Saban have introduced AutoAdv, a novel framework designed for automated multi-turn jailbreaking. This training-free system aims to simulate realistic, adaptive attacks to expose vulnerabilities in LLM safety mechanisms. You can read the full research paper here: AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models.
Understanding AutoAdv’s Approach
AutoAdv operates in a black-box setting, meaning it doesn’t need access to the LLM’s internal workings or training data. It breaks down the attack process into two main phases: an initial disguise and adaptive refinement.
- Initial Disguise: The harmful request is first reframed into a prompt that appears benign and harmless.
- Adaptive Refinement: In subsequent turns, AutoAdv learns from previous interactions and refines its follow-up attempts.
Two core modules drive this adaptive behavior:
- Pattern Manager: This module learns from successful attacks, recording effective strategies (like role-playing or educational framing) and reusing them to enhance future prompts. It dynamically updates the attacker LLM’s system prompt with insights from top-performing techniques.
- Temperature Manager: This component dynamically adjusts the sampling temperature of the attacker LLM. By varying the temperature, it introduces controlled randomness, helping to discover new phrasing and tones that can better evade defenses, especially after failed attempts.
The framework also uses a two-phase rewriting strategy. The first phase focuses on disguising the harmful request, while the second iteratively refines it based on the target model’s responses.
Evaluation and Key Findings
AutoAdv was rigorously evaluated on a pool of 700 harmful prompts from AdvBench and HarmBench, targeting both commercial and open-source LLMs, including Llama-3.1-8B, GPT-4o-mini, Qwen3-235B, and Mistral-7B. Grok 3 Mini was chosen as the attacker LLM due to its high task compliance and relatively weaker safety alignment.
The results were striking:
- AutoAdv achieved an impressive attack success rate (ASR) of up to 95% on Llama-3.1-8B within just six turns.
- Multi-turn interactions consistently outperformed single-turn attacks, with ASR improving by as much as 24% compared to single-turn baselines. This highlights that current alignment strategies, often optimized for single-turn interactions, struggle to maintain robustness over extended conversations.
- Vulnerability varied significantly across models. Qwen3-235B showed the highest susceptibility with a 99% ASR over six turns, while GPT-4o-mini demonstrated stronger resilience with an 86% ASR.
- Ablation studies confirmed the critical role of each AutoAdv component: removing the pattern manager, temperature manager, or initial prompt generation guidelines (few-shot examples, seed strategies) all led to a notable drop in ASR.
Also Read:
- Advanced LLM Jailbreaking: Co-Evolving Prompts and Evaluation for Robustness
- Assessing LLM Defenses Against Prompt Injection: A New Evaluation Framework
Implications for LLM Safety
The findings from AutoAdv demonstrate that current LLM safety mechanisms are persistently vulnerable to adaptive multi-turn attacks. This research underscores an urgent need for the development of multi-turn-aware defenses that can maintain robustness throughout extended conversations. AutoAdv is not just a tool for exposing weaknesses but also a foundation for building more adaptive and resilient AI safety systems in the future.
