Elamur Research⌕
☰
home / papers / 2026 / Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models

Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models

Paper · 2026 · Ragib Amin Nihal, Rui Wen, Kazuhiro Nakadai et al.

Summary

Multi-turn jailbreaks gradually steer a chatbot past its safety guardrails over several conversational exchanges. Existing methods mostly explore dialogue space ad hoc, so they reveal little about why models fail. The authors present Pattern Enhanced Chain of Attack (PE-CoA), which builds on the semantic-feedback Chain of Attack (CoA) method. PE-CoA organizes attacks around five natural conversation patterns, each with defined stages and a progress metric. The framework is intended mainly as a vulnerability-analysis tool rather than only a success-rate optimizer. The authors tested it on twelve LLMs across ten harm categories, using English-only, black-box, text-output access. PE-CoA reaches state-of-the-art attack success. Each model shows its own weakness profile, and resistance to one pattern does not carry over to the others. Models from the same family tend to fail in similar ways. The results suggest that current content-focused safety training misses structural, dialogue-level weaknesses, and the authors argue that defenses should explicitly account for conversation patterns.

Key points

  • Five patterns: The framework uses Problem Solving, Hypothetical Scenario, Technical Educational, Information Seeking and Personal Experience as its conversation patterns. Combined with 10 harm categories, they yield 50 attack vectors. Overall success rates range from 75% to 100% across architectures.
  • Pattern-specific weaknesses: Deepseek-chat is most vulnerable to Problem-Solving (84%). GPT-4o-mini is weakest against Information Seeking (73.6%), compared with 68.4% for Problem-Solving. Gemini-1.5-Flash's Personal pattern succeeds 93.3% of the time on Disinformation but 56.7% on Harassment (p = 0.0023).
  • Family similarity: Gemini model versions show nearly identical vulnerability profiles, with correlation above 0.9 for most pattern–category pairs.
  • Defenses: LoRA fine-tuning gives the most narrowly targeted protection. Gradient Ascent Unlearning and SelfDefend are less targeted but broader, which illustrates a trade-off between specificity and breadth.
  • Limitations and release: The study covers only English text and controlled settings, and the authors do not claim full coverage of possible patterns. Code is released for research use only at github.com/Ragib-Amin-Nihal/PE-CoA.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🔬RIKEN Center for Advanced Intelligence ProjectTokyo · Japan15 works · 957 citations🎓Institute of Science TokyoTokyo · Japan10 works · 20 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Ragib Amin Nihal, Rui Wen, Kazuhiro Nakadai and Jun Sakuma. 2026. Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1113

@inproceedings{nihal2026pattern,
  title = {{Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models}},
  author = {Ragib Amin Nihal, Rui Wen, Kazuhiro Nakadai and Jun Sakuma},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1113},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1113}
}

References

71 references, 26 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Nicholas Asher and Alex Lascarides. 2003. Logics of Conversation. Cambridge University Press. find
  2. J. L. Austin. 1962. How to Do Things with Words. Harvard University Press, Cambridge, MA. Second edition, 1975. find
  3. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, and 1 others. 2022. Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073.
  4. Emily M Bender, Timnit Gebru, Angelina McMillan-Major, and Shmargaret Shmitchell. 2021. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pages 610–623. find
  5. Erving Goffman. 1974. Frame Analysis: An Essay on the Organization of Experience. Harper & Row, New York. find
  6. Jerome Bruner. 1991. The Narrative Construction of Reality, volume 18. University of Chicago Press. find
  7. Erving Goffman. 1981. Forms of Talk. University of Pennsylvania Press, Philadelphia. find
  8. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, and 1 others. 2024. JailbreakBench: An open robustness benchmark for jailbreaking large language models. Advances in Neural…
  9. Christopher Hadnagy. 2010. Social Engineering: The Art of Human Hacking. Wiley, Indianapolis, IN. find
  10. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE.
  11. Si Chen, Xiao Yu, Ninareh Mehrabi, Rahul Gupta, Zhou Yu, and Ruoxi Jia. 2025. Strategize globally, adapt locally: A multi-turn red teaming agent with dual-level learning. arXiv preprint arXiv:2504.01278. — [arXiv:2504.01278](https://arxiv.org/abs/2504.01278) find
  12. Robert B Cialdini. 2006. Influence: The Psychology of Persuasion. Harper Business. find
  13. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474.
  14. Xiaohu Du, Fan Mo, Ming Wen, Tu Gu, Huadi Zheng, Hai Jin, and Jie Shi. 2025. Multi-turn jailbreaking large language models via attention shifting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23814–23822. find
  15. Gilles Fauconnier and Mark Turner. 2002. The Way We Think: Conceptual Blending and the Mind’s Hidden Complexities. Basic Books, New York. find
  16. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, and 1 others. 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858.
  17. Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021. SimCSE: Simple contrastive learning of sentence embeddings. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, page 6894. Association for Computational Linguistics.
  18. Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. 2023. MART: Improving LLM safety with multi-round automatic red-teaming. arXiv preprint arXiv:2311.07689.
  19. David Herman. 2003. Narrative Theory and the Cognitive Sciences. Center for the Study of Language and Information. find
  20. Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. LoRA: Low-Rank adaptation of large language models. In International Conference on Learning Representations.
  21. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614.
  22. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024a. ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pag…
  23. Yifan Jiang, Kriti Aggarwal, Tanmay Laud, Kashif Munir, Jay Pujara, and Subhabrata Mukherjee. 2024b. Red Queen: Safeguarding large language models against concealed multi-turn jailbreaking. arXiv preprint arXiv:2409.17458. — [arXiv:2409.17458](https://arxiv.org/abs/2409.17458) find
  24. Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. 2024. Exploiting programmatic behavior of LLMs: Dual-Use through standard security attacks. In 2024 IEEE Security and Privacy Workshops (SPW), pages 132–143. IEEE. find
  25. Kobin H. Kendrick, Penelope Brown, Mark Dingemanse, Simeon Floyd, Sonja Gipper, Kaoru Hayano, Elliott Hoey, Gertie Hoymann, Elizabeth Manrique, Giovanni Rossi, and Stephen C. Levinson. 2020. Sequence organization: A universal infrastructure for social action. Journal of Pragmatics, 168:119–138. find
  26. Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Vinayak Bhalerao, Christopher Buckley, Jason Phang, Samuel R Bowman, and Ethan Perez. 2023. Pretraining language models with human preferences. In International Conference on Machine Learning, pages 17506–17533. PMLR.
  27. Seanie Lee, Minsu Kim, Lynn Cherif, David Dobre, Juho Lee, Sung Ju Hwang, Kenji Kawaguchi, Gauthier Gidel, Yoshua Bengio, Nikolay Malkin, and 1 others. 2025. Learning diverse attacks on large language models for robust red-teaming and safety tuning. In The Thirteenth International Conference on Lear… find
  28. Nathaniel Li, Ziwen Han, Ian Steneker, Willow Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. 2024. LLM defenses are not robust to multi-turn human jailbreaks yet. arXiv preprint arXiv:2408.15221. — [arXiv:2408.15221](https://arxiv.org/abs/2408.15221) find
  29. Xiaogeng Liu, Peiran Li, G. Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. 2025. AutoDAN-turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs. In The Thirteenth International Conference on Learning Representations. find
  30. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. Harm-Bench: A standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine… find
  31. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box LLMs automatically. Advances in Neural Information Processing Systems, 37:61065–61105.
  32. Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. 2024. Can LLMs keep a secret? Testing privacy implications of language models via contextual integrity theory. In ICLR. find
  33. Norman Mu, Katharina Greshake Tzovaras, Yuntao Bai, and Ethan Perez. 2024. Learning to refuse: Towards mitigating privacy risks in LLMs. arXiv preprint arXiv:2407.10058.
  34. OpenAI. 2023. Moderation API. OpenAI Documentation. Retrieved from https://platform.openai.com/docs/guides/moderation. ↗
  35. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35:27730–27744.
  36. Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. 2024. AdvPrompter: Fast adaptive adversarial prompting for LLMs. In Forty-second International Conference on Machine Learning. find
  37. Maya Pavlova, Erik Brinkman, Krithika Iyer, Vítor Albiero, Joanna Bitton, Hailey Nguyen, Cristian Canton Ferrer, Ivan Evtimov, and Aaron Grattafiori. 2025. Automated red teaming with GOAT: The generative offensive agent tester. In ICLR 2025 Workshop on Building Trust in Language Models and Applicati… find
  38. Jakub Piskorski, Nicolas Stefanovitch, Giovanni Da San Martino, and Preslav Nakov. 2023. SemEval-2023 task 3: Detecting the category, the framing, and the persuasion techniques in online news in a multilingual setup. In Proceedings of the 17th International Workshop on Semantic Evaluation (SemEval-2… find
  39. Anita Pomerantz. 1984. Agreeing and disagreeing with assessments: Some features of preferred/dispreferred turn shapes. In J. Maxwell Atkinson and John Heritage, editors, Structures of Social Action: Studies in Conversation Analysis, pages 57–101. Cambridge University Press, Cambridge. find
  40. Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. 2025. X-Teaming: Multi-Turn jailbreaks and defenses with adaptive multi-agents. arXiv preprint arXiv:2504.13203. — [arXiv:2504.13203](https://arxiv.org/abs/2504.13203) find
  41. Mohaimenul Azam Khan Raiaan, Md Saddam Hossain Mukta, Kaniz Fatema, Nur Mohammad Fahad, Sadman Sakib, Most Marufatul Jannat Mim, Jubaer Ahmad, Mohammed Eunus Ali, and Sami Azam. 2024. A review on large language models: Architectures, applications, taxonomies, open issues and challenges. IEEE Access,… find
  42. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2024. Derail yourself: Multi-Turn LLM jailbreak attack through self-discovered clues. arXiv e-prints, pages arXiv–2410. find
  43. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2024. Great, now write an article about that: The Crescendo multi-turn LLM jailbreak attack. arXiv preprint arXiv:2404.01833. find
  44. Harvey Sacks. 1992. Lectures on Conversation, volume 1 & 2. Blackwell, Oxford. With an introduction by Emanuel A. Schegloff. find
  45. Emanuel A Schegloff. 2007. Sequence Organization in Interaction: A Primer in Conversation Analysis, volume 1. Cambridge University Press. find
  46. Deven Santosh Shah, H Andrew Schwartz, and Dirk Hovy. 2020. Predictive biases in natural language processing models: A conceptual framework and overview. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 5248–5264.
  47. Omar Shaikh, Hongxin Zhang, William Held, Michael Bernstein, and Diyi Yang. 2023. On second thought, let’s not think step by step! Bias and toxicity in zero-shot reasoning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4454–…
  48. Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman, Newton Chung, Ethan Perez, Taylor Sorensen, Zac Hatfield-Dodds, and 1 others. 2024. Towards understanding sycophancy in language models. In International Conference on Learning Representations.
  49. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. “Do Anything Now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685.
  50. Dan Sperber and Deirdre Wilson. 1986. Relevance: Communication and Cognition. Blackwell, Oxford. Second edition 1995. find
  51. Xiongtao Sun, Deyue Zhang, Dongdong Yang, Quanchen Zou, and Hui Li. 2024. Multi-turn context jailbreak attack on large language models from first principles. arXiv preprint arXiv:2408.04686. — [arXiv:2408.04686](https://arxiv.org/abs/2408.04686) find
  52. Natalie Turk, Julie Kaspar, and Leila Kosseim. 2025. The influence of discourse relations on persuasion in persuasive texts. In Proceedings of the Canadian Conference on Artificial Intelligence. Canadian Artificial Intelligence Association. find
  53. Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. 2024. The instruction hierarchy: Training LLMs to prioritize privileged instructions. arXiv preprint arXiv:2404.13208. find
  54. Xunguang Wang, Daoyuan Wu, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Shuai Wang, Yingjiu Li, Yang Liu, Ning Liu, and Juergen Rahmel. 2025. SelfDefend: LLMs can defend themselves against jailbreaking in a practical manner. In 34th USENIX Security Symposium (USENIX Security 25). USENIX Association. find
  55. Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A Smith, Daniel Khashabi, and Hannaneh Hajishirzi. 2022. Self-instruct: Aligning language models with self-generated instructions. arXiv preprint arXiv:2212.10560. find
  56. Zezhong Wang, Fangkai Yang, Lu Wang, Pu Zhao, Hongru Wang, Liang Chen, Qingwei Lin, and Kam-Fai Wong. 2024. SELF-GUARD: Empower the LLM to safeguard itself. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologi… find
  57. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023a. Jailbroken: How does LLM safety training fail? Advances in Neural Information Processing Systems, 36:80079–80110.
  58. Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023b. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387.
  59. Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. Membership inference attacks against in-context learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3481–3495. find
  60. Deirdre Wilson and Dan Sperber. 2004. Relevance theory. In Laurence R. Horn and Gregory Ward, editors, The Handbook of Pragmatics, pages 607–632. Blackwell, Oxford. find
  61. Xikang Yang, Xuehai Tang, Songlin Hu, and Jizhong Han. 2024. Chain of attack: A semantic-driven contextual multi-turn attacker for LLM. arXiv preprint arXiv:2405.05610. — [arXiv:2405.05610](https://arxiv.org/abs/2405.05610) find
  62. Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2023. Large language model unlearning. arXiv preprint arXiv:2310.10683.
  63. Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. Low-resource languages jailbreak GPT-4. arXiv preprint arXiv:2310.02446.
  64. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher. arXiv preprint arXiv:2308.06463.
  65. Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chujie Zheng, Hongning Wang, and Minlie Huang. 2024. Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks. arXiv preprint arXiv:2407.02855. — [arXiv:2407.02855](https://arxiv.org/abs/2407.02855) find
  66. Zhexin Zhang, Junxiao Yang, Pei Ke, Fei Mi, Hongning Wang, and Minlie Huang. 2023. Defending large language models against jailbreaking attacks through goal prioritization. arXiv preprint arXiv:2311.09096.
  67. Jiachen Zhao, Jing Huang, Zhengxuan Wu, David Bau, and Weiyan Shi. 2025. LLMs encode harmfulness and refusal separately. arXiv preprint arXiv:2507.11878. — [arXiv:2507.11878](https://arxiv.org/abs/2507.11878) find
  68. Jieyu Zhao, Tianlu Wang, Mark Yatskar, Vicente Ordonez, and Kai-Wei Chang. 2018. Gender bias in coreference resolution: Evaluation and debiasing methods. In Proceedings of NAACL-HLT, pages 15– 20.
  69. Yi Zhao and Youzhi Zhang. 2025. Siren: A learning-based multi-turn attack framework for simulating real-world human jailbreak behaviors. arXiv preprint arXiv:2501.14250. — [arXiv:2501.14250](https://arxiv.org/abs/2501.14250) find
  70. Andy Zhou. 2025. Siege: Autonomous multi-turn jailbreaking of large language models with tree search. arXiv e-prints, pages arXiv–2503. find
  71. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. *Figure 7: Multi-turn jailbreaking attacks following different conversation patterns toward the sa…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/nihal-2026-pattern-enhanced-multi-turn-jailbreaking/