MSIA: Adaptive Medical Multimodal Multi-turn Semantic Jailbreak (2026.findings-acl)
Copied to clipboard
| Challenge: | Medical large language models exhibit high domain specificity and condensed semantics, making them vulnerable to diagnostic errors in real-world clinical settings. |
| Approach: | They propose a framework for modeling and inducing multi-turn medical semantic jailbreaks in clinical dialogues. |
| Outcome: | Experiments on chest X-ray-based multimodal medical dialogues show that MSIA outperforms existing jailbreak methods with an average success rate of 76.67%. |
Similar Papers
Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models (2025.findings-emnlp)
Copied to clipboard
Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, Dacheng Tao
| Challenge: | Existing methods for implementing multi-turn jailbreaks struggle to balance semantic coherence with attack effectiveness, resulting in benign semantic drift or ineffective detection evasion. |
| Approach: | They propose a framework that reformulates harmful queries into benign reasoning tasks and leverages LLMs’ strong reasoning capabilities to compromise safety alignment. |
| Outcome: | The proposed framework achieves state-of-the-art attack effectiveness in complex conversational scenarios, with average ASRs increasing by up to 96%. |
From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking (2024.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in Large Language Models (LLMs) have demonstrated remarkable performance across various tasks, effectively following instructions to meet diverse user needs. |
| Approach: | They propose a framework for evaluation benchmarks and attack techniques for LLMs and MLLMs to enhance their security. |
| Outcome: | The proposed frameworks have been exploited to exploit the weaknesses of LLMs and MLLMs. |
Reasoning Is Not All You Need: Examining LLMs for Multi-Turn Mental Health Conversations (2026.acl-long)
Copied to clipboard
| Challenge: | Existing evaluation frameworks focus on diagnostic accuracy and win-rates and often overlook alignment with patient-specific goals, values, and personalities required for meaningful conversations. |
| Approach: | They propose a framework for synthetically generating realistic, multi-turn mental health sensemaking conversations and a dataset to examine their models in healthcare settings. |
| Outcome: | The proposed framework synthesizes a dataset comprising over 2,200 patient–LLM conversations and evaluates them using human-centric criteria. |
DrAgent: Empowering Large Language Models as Medical Agents for Multi-hop Medical Reasoning (2025.findings-emnlp)
Copied to clipboard
Fenglin Liu, Zheng Li, Hongjian Zhou, Qingyu Yin, Jingfeng Yang, Xin Liu, Zhengyang Wang, Xianfeng Tang, Shiyang Li, Xiang He, Ruijie Wang, Bing Yin, Xiao Gu, Lei Clifton, David A. Clifton
| Challenge: | commercial LLMs can be difficult to use in real-world clinical decision-making . a lightweight LLM can be used to collaborate with diverse clinical tools . |
| Approach: | They propose a lightweight LLM that can be used to build medical LLMs as agents . they use recursive curriculum learning to optimize the LLM in an easy-to-hard progression . |
| Outcome: | The proposed approach outperforms human experts in medical examinations on diverse datasets. |
GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing attacks focus on increasing the complexity of the modified visual task and do not explicitly leverage the model’s own reasoning incentives. |
| Approach: | They propose a framework that decomposes and reassembles harmful visual semantics and constructs a gamified scene that drives the model to explore, reconstruct intent and answer as part of winning the game. |
| Outcome: | Experiments on reasoning and non-reasoning MLLMs show that the proposed framework outperforms baseline models on both vision and text. |
SemanticCamo: Jailbreaking Large Language Models through Semantic Camouflage (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have made safety issues of LLMs more prominent and critical. |
| Approach: | They propose a framework which attacks LLMs through semantic camouflage and replaces unsafe content with semantic features to conceal malicious intent . |
| Outcome: | The proposed framework outperforms existing models in over 80% of cases and is highly effective against various defenses. |
Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing multi-turn methods for large language models exploit conversational context to bypass safety constraints gradually. |
| Approach: | They propose a framework of five conversation patterns to construct multi-turn jailbreaks through natural dialogue. |
| Outcome: | The proposed framework exploits conversational contexts to construct multi-turn jailbreaks . it reveals that models exhibit distinct weakness profiles and model families share similar failure modes . |
MultiCodeAttack: Iterative Jailbreak Attacking on LLMs with Multi-Code Prompt Injection (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to jailbreak rely on fixed template design and a single programming language . however, existing approaches do not consider language diversity or adaptive template evolution . |
| Approach: | They propose a structured jailbreak framework that explores and optimizes multi-language code templates. |
| Outcome: | The proposed framework outperforms existing jailbreak baselines and produces higher harmful outputs than baseline methods. |
When Background Matters: Breaking Medical Vision Language Models by Transferable Attack (2026.acl-long)
Copied to clipboard
| Challenge: | Existing medical attacks focus on secondary objectives such as model stealing or adversarial fine-tuning, while transferable attacks from natural images introduce visible distortions that clinicians can easily detect. Existing transferable adversarials are less effective in the medical domain. |
| Approach: | They propose a highly transferable black-box multimodal attack that induces incorrect yet clinically plausible diagnoses while keeping perturbations imperceptible. |
| Outcome: | The proposed method induces incorrect yet clinically plausible diagnoses while keeping perturbations imperceptible. |
MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in Large Language Models (2025.emnlp-main)
Copied to clipboard
Siyu Yan, Long Zeng, Xuecheng Wu, Chengcheng Han, Kongcheng Zhang, Chong Peng, Xuezhi Cao, Xunliang Cai, Chenjuan Guo
| Challenge: | Existing defenses target single-turn attacks, but real-world usage involves multi-turn dialogues, exposing models to attacks that exploit conversational context to bypass safety measures. |
| Approach: | They propose a framework that tackles multi-turn jailbreaks from both attack and defense angles. |
| Outcome: | Experiments on large language models show that MUSE effectively mitigates multi-turn jailbreaks. |