The LMVD-ID is an internal research identifier, not an official CVE identifier.
Multi-Round LLM Jailbreak
A multi-round attack against Large Language Models (LLMs) allows bypassing safety mechanisms by iteratively refining prompts to elicit undesired behavior. The attack leverages the LLM's tendency to adjust its response…
Paper-evaluated models
No paper-evaluated models are recorded for this entry.
Description
A multi-round attack against Large Language Models (LLMs) allows bypassing safety mechanisms by iteratively refining prompts to elicit undesired behavior. The attack leverages the LLM's tendency to adjust its response based on preceding interactions, circumventing single-round prompt filtering defenses.
Examples
Unavailable due to paper withdrawal.
Impact
LLMs can be manipulated to generate harmful content, such as hate speech, misinformation, or instructions for illegal activities, despite safety protocols. This undermines trust and safety features implemented in LLM applications.
Affected Systems
All LLMs that employ iterative prompt-response mechanisms and rely solely on single-round prompt filtering for safety.
Paper note: the original mitigation discussion is unavailable because the paper was withdrawn.
Mitigation Steps
- Reassess the full input and conversation intent before responding or invoking tools, combine model-level alignment with independent input and output policy checks, and avoid relying on a single signature or refusal heuristic.
- Add a targeted regression using inert data and actions, measure both safety and utility regressions, and monitor production for repeated or adaptive attempts.
Research context and confidence
- Evidence and verification
- Paper-reported; independent reproduction is not documented.
- Primary research source linked.
- Severity
- Not rated by this catalog.
- Source and publication type
- arXiv · Research preprint.
- Peer-review status is not provided by this source.
- Author and publication status
- Author metadata is not stored; see the primary paper.
- Threat model and attacker access
- Black-box model, service, or application access.
- Related deployment categories
- No related deployment category is classified.
- Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
- Affected systems
- All LLMs that employ iterative prompt-response mechanisms and rely solely on single-round prompt filtering for safety. Paper note: the original mitigation discussion is unavailable because the paper was withdrawn.
Research Paper
Multi-round jailbreak attack on large language models
Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.
View PaperEvidence
This entry is based on a primary research source. Its findings are paper-reported; independent reproduction and verification are not claimed.
https://arxiv.org/abs/2410.11533Related research
- Information-Overloading Jailbreaks in Vision-Language Models
Published July 3, 2026 · model-layer, jailbreak, vision
- Multilingual Flowchart Jailbreaks in Vision-Language Models
Published June 5, 2026 · model-layer, jailbreak, vision
- Visual-Modality Jailbreaks Bypass VLM Safety Alignment
Published May 1, 2026 · model-layer, jailbreak, vision