README.md

July 29, 2026 · View on GitHub

💥Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues

RESEARCH USE ONLY✅ NO MISUSE❌

LOVE💗 and Peace🌊

🆙Updates

2024-10-14: We release SafeMTData which inclues our multi-turn jailbreak data and the multi-turn safety alignment data on huggingface.

📄 Brief Information for each file and directory

data ---> includes the original jailbreak benchmark data.
prompts ---> are the prompts for attack data generation, evaluation, and safety alignment data generation.
main.py ---> is the file to run ActorAttack, which consists of two-stages: pre-attack (preattack.py) and in-attack (inattack.py).
judge.py ---> is the file to define our GPT-Judge.
ft ---> contains the script and python file to train LLMs.
construct_dataset.py ---> is the file to construct the multi-turn safety alignment data.

🛠️ Attack data generation

Installation

conda create -n actorattack python=3.10
conda activate actorattack
pip install -r requirements.txt

Before running, you need to set the API credentials in your environment variables. An example of using your .env file is:

BASE_URL_GPT="https://api.openai.com/v1"
GPT_API_KEY="YOUR_API_KEY"

BASE_URL_CLAUDE="https://api.anthropic.com/v1"
CLAUDE_API_KEY="YOUR_API_KEY"

BASE_URL_DEEPSEEK="https://api.deepseek.com/v1"
DEEPSEEK_API_KEY="YOUR_API_KEY"

BASE_URL_DEEPINFRA="https://api.deepinfra.com/v1/openai"
DEEPINFRA_API_KEY="YOUR_API_KEY"

⚡️ Model Recommendation for Attack Generation

We have noticed that GPT-4o, when used as an attack model, tends to refuse to generate multi-turn attack prompts. Therefore, we recommend using the open-source LLM WizardLM-2-8x22B. (You can also access the model through the DeepInfra API via microsoft/WizardLM-2-8x22B.)

✨An example run:

python3 main.py --questions 1 \
--actors 3 \
--behavior ./data/harmbench.csv \
--attack_model_name gpt-4o \
--target_model_name gpt-4o \
--early_stop \
--step_modify

You can find the actors and initial jailbreak queries for each instruction in pre_attack_result, and the final attack result in attack_result.

🛠️ Safety Fine-tuning

Generate multi-turn jailbreak queries based on ActorAttack.

python3 main.py --questions 1000 \
--actors 3 \
--behavior ./data/circuit_breaker_train.csv \
--attack_model_name WizardLM-2-8x22B \
--target_model_name deepseek-chat \
--early_stop

Generate multi-turn safety alignment dataset based on the above attack data.

python3 construct_dataset.py \
--attack_data_file ./attack_result/your_file_name \

Fine-tune LLM using our multi-turn safety alignment data.

sh ft/scripts/lora_train.sh your_defense_dataset_path 
sh ft/scripts/lora_merge.sh your_train_iter

💡Motivation & Method

As shown in the figure, we expose a significant safety vulnerability of LLMs in multi-turn scenarios, which enable the malicious users to hide their intentions.

ActorAttack explicitly models a network where each node (actor) is semantically linked with the harmful target. These actors and their relationships with the harmful target constitute our attack clues. We automate the discovery of attack clues by leveraging the knowledge of LLMs. Based on the attack clues, ActorAttack first infers the attack chain, then generates multi-turn jailbreak queries following the attack chain.

@misc{ren2024derailyourselfmultiturnllm,
      title={Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues}, 
      author={Qibing Ren and Hao Li and Dongrui Liu and Zhanxu Xie and Xiaoya Lu and Yu Qiao and Lei Sha and Junchi Yan and Lizhuang Ma and Jing Shao},
      year={2024},
      eprint={2410.10700},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2410.10700}, 
}