标题： 多轮越狱比看起来更容易 显示英文标题

标题： Multi-Turn Jailbreaks Are Simpler Than They Seem

摘要： 尽管针对大型语言模型(LLMs)的单轮越狱攻击的防御措施已显著改进，但多轮越狱攻击仍是一个持续的漏洞，通常在针对单轮保护优化的模型上成功率达到70%以上。 本研究对最先进的模型包括GPT-4、Claude和Gemini变体进行了自动化多轮越狱攻击的经验分析，使用了StrongREJECT基准。 我们的发现挑战了多轮攻击的复杂性认知：当考虑到攻击者能够从模型如何拒绝有害请求中学习时，多轮越狱方法大约等同于多次重新采样单轮攻击。 此外，相似模型之间的攻击成功率存在相关性，使得越狱新发布模型变得更加容易。 此外，对于推理模型，我们发现令人惊讶的是，更高的推理努力往往会导致更高的攻击成功率。 我们的结果对人工智能安全评估和越狱抗性系统的设计具有重要影响。 我们在https://github.com/diogo-cruz/multi_turn_simpler发布源代码。 显示英文摘要

摘要： While defenses against single-turn jailbreak attacks on Large Language Models (LLMs) have improved significantly, multi-turn jailbreaks remain a persistent vulnerability, often achieving success rates exceeding 70% against models optimized for single-turn protection. This work presents an empirical analysis of automated multi-turn jailbreak attacks across state-of-the-art models including GPT-4, Claude, and Gemini variants, using the StrongREJECT benchmark. Our findings challenge the perceived sophistication of multi-turn attacks: when accounting for the attacker's ability to learn from how models refuse harmful requests, multi-turn jailbreaking approaches are approximately equivalent to simply resampling single-turn attacks multiple times. Moreover, attack success is correlated among similar models, making it easier to jailbreak newly released ones. Additionally, for reasoning models, we find surprisingly that higher reasoning effort often leads to higher attack success rates. Our results have important implications for AI safety evaluation and the design of jailbreak-resistant systems. We release the source code at https://github.com/diogo-cruz/multi_turn_simpler