One-sentence Summary

Researchers from Shanghai Jiao Tong University and Beihang University propose ActorBreaker, a novel attack method grounded in Latour's actor-network theory that exploits natural distribution shifts between benign, semantically related prompts and original toxic content to bypass safety mechanisms in aligned LLMs, outperforming existing attacks in diversity, effectiveness, and efficiency, and they construct a multi-turn safety dataset to enhance robustness through fine-tuning.

Key Contributions

• The paper identifies a new failure mode in aligned LLMs: their brittleness to natural distribution shifts, where benign prompts semantically related to harmful content bypass safety mechanisms.

• The paper proposes ActorBreaker, a novel multi-turn attack method grounded in Latour's actor-network theory that generates diverse, naturally phrased prompts to systematically probe LLM vulnerabilities. The method achieves state-of-the-art performance on HarmBench, bypasses Llama Guard 2 detection, and transfers across aligned LLMs without additional optimization.

• The paper constructs a multi-turn safety dataset using ActorBreaker and demonstrates that fine-tuning models on this dataset significantly improves robustness against natural distribution shift attacks, showing the importance of broadening safety training data to cover a wider semantic space of toxic content.

Introduction

The authors address a critical safety gap in large language models: these systems are pre-trained on web-scale data containing harmful content, and while safety training teaches them to reject explicit toxic queries, this protection can collapse under natural distribution shifts. Specifically, benign prompts that are semantically related to harmful topics, such as referencing a known terrorist in a multi-turn conversation, can gradually steer an aligned model toward revealing dangerous details. This vulnerability matters because it is not driven by deliberate jailbreak tricks, but by exploiting the same semantic relationships the model learned during pre-training, which safety data does not cover.

Prior multi-turn attack methods rely on fixed strategies (role-playing, hypothetical scenarios) or human-designed seed templates, which limit prompt diversity and push prompts out of the natural distribution. These approaches also depend on explicit malicious modifications, making them easier to detect.

The authors propose ActorBreaker, a multi-turn attack method grounded in Latour's actor-network theory. It builds a conceptual network of diverse actors, both human and non-human (e.g., books, media, social movements), linked to a harmful target, and uses each node as an attack clue to generate in-distribution, benign multi-turn prompts without any jailbreak techniques. This approach achieves state-of-the-art success rates on Harmbench across aligned LLMs, even bypassing advanced models like GPT-o1, and its prompts evade detection by Llama Guard 2. To mitigate this risk, the authors also construct a multi-turn safety alignment dataset from ActorBreaker and show that fine-tuning on it improves model robustness, highlighting the need to broaden safety training to cover the wider semantic space of toxic content.

Method

The authors propose a two-stage framework designed to automatically identify attack clues and generate multiturn adversarial queries. The first stage focuses on constructing an actor network around a seed toxic prompt to extract semantic relationships, while the second stage utilizes these clues to orchestrate a step-by-step attack via self-talk simulation.

Actor-Network Construction The initial phase is grounded in Latour’s actor-network theory, which posits that entities exist within a network of relationships. The system identifies six semantic categories of actors involved in the lifecycle of harmful content: Creation, Distribution, Execution, Reception, Facilitation, and Regulation. The framework constructs a two-layered tree structure where the root node represents the specific harmful target $x$x. The first layer comprises these six abstract actor types, while the leaf nodes consist of instantiated specific entities, such as historical figures, books, or social movements.

To adapt this structure to a specific harmful target, the system employs a Large Language Model (LLM) to instantiate the conceptual network $\mathcal{G}_{concept}$Gconcept​ into a concrete instance $\mathcal{G}_{inst}$Ginst​. The edges in this tree capture the semantic relationships between the specific actors and the harmful target. The leaf nodes and their connecting edges are extracted to form a diverse set of potential attack clues $C$C.

In-Attack Generation The second stage generates the actual attack queries based on the selected clues. This process involves three distinct steps: inferring an attack chain, generating queries via self-talk, and dynamically modifying the path.

First, given a selected attack clue $c_i$ci​ and the harmful target $x$x, the attacker LLM infers a chain of thoughts $z_1, \dots, z_n$z1​,…,zn​. This chain establishes a logical path from the clue to the target, specifying how the topics of the multi-turn queries should evolve to guide the victim model toward the desired harmful response.

Second, the system generates the multi-turn query set $[q_1, \dots, q_n]$[q1​,…,qn​] sequentially. The context $s$s includes the harmful target, the attack clue, and the thought chain. The first query $q_1$q1​ is generated based on $s$s. Subsequent queries $q_i$qi​ are conditioned on the previous queries and the predicted responses. Instead of directly querying the victim model during the generation phase, the framework employs a self-talk strategy. The attacker LLM predicts the victim's response $r_i$ri​ as a proxy. This allows the system to simulate the interaction, anticipate safety guardrails, and refine the query sequence without real-time feedback from the target model.

Third, the framework includes an optional dynamic modification module to handle misalignments during actual interaction with the victim model. A judge LLM assesses the victim's response to identify two types of failures. If the response indicates an "Unknown" failure, such as a lack of knowledge, the system halts the current attempt and restarts with a new clue to improve efficiency. If the response indicates a "Rejective" failure, where the model explicitly refuses the query, the system refines the query by replacing sensitive terms with ellipsis or synonyms. This modification helps bypass safety filters while maintaining the semantic intent of the attack.

Experiment

Across six LLMs, Actor-Breaker outperformed both leading single-turn and multi-turn attack baselines, including strong reasoning models, by generating benign yet semantically related prompts that reliably elicit harmful responses. The six actor categories produced diverse attack prompts, and using more actor types consistently improved attack success, highlighting how varied semantic relationships expose different safety vulnerabilities. The method demonstrated strong transferability across models, higher diversity and efficiency than multi-turn baselines, and its prompts largely bypassed toxicity detection. An adaptive defense using multi-turn safety data constructed from these attacks, combined with representation-space alignment, substantially reduced success rates, underscoring both the attack's robustness and the value of multi-turn safety tuning.

ActorBreaker consistently outperforms both single-turn and multi-turn attack baselines across all evaluated open and closed source language models, achieving the highest average attack success rate. The method is notably effective against GPT-o1, where it reaches 60% success compared to 14% for the strongest baseline, despite not using special optimization. Its prompts are also reported to have lower toxicity compared to other multi-turn attacks. ActorBreaker achieves a 77.7% average attack success rate, far exceeding the 18.3% and 45.0% rates of the best single-turn and multi-turn baselines, respectively. Against GPT-o1, ActorBreaker attains 60.0% success, while the strongest baseline (Crescendo) only reaches 14.0%. The method's multi-turn prompts are less toxic than those of the original harmful queries and other multi-turn attacks, according to Llama Guard 2 classification.

The table reports attack success rates for six actor types across four language models, showing that all actor categories are effective at probing safety vulnerabilities. Success rates vary by actor type and model, with Distribution and Facilitation generally performing well and Regulation often lowest. These results confirm that diverse actor definitions enable robust multi-turn attacks. All six actor types achieve notable attack success rates across both open-source and closed-source models, validating their effectiveness. Distribution and Facilitation actor types tend to yield higher success rates, while Regulation consistently shows the lowest rates. Success rates differ by model, with GPT-3.5 and Llama-3-70B showing higher overall effectiveness across actor types than GPT-4o and Llama-3-8B.

The table shows how attack success rate on Harmbench improves as more actor categories are combined. For every tested model, success rates rise steadily from a single actor to the full set of six categories, with the complete combination achieving the highest scores. This trend supports the paper's argument that expanding the adversarial action space enables more effective probing of model safety vulnerabilities. Adding more actor categories consistently increases attack success across all four models. The full combination of creation, execution, distribution, reception, facilitation, and regulation yields the highest success rates, reaching up to 90% on Llama-3-70B-instruct. The largest relative gains typically occur when execution or distribution is added to the base creation actor.

ActorBreaker achieves high attack success rates on Harmbench across all evaluated models, and incorporating dynamic modification consistently improves performance. The average success rate rises from 72.7% without modification to 81.2% with it, indicating that adapting the attack path during interaction enhances efficacy. Dynamic modification boosts attack success rate for every model, with the largest gains on Claude-3.5 and Llama-3-70B. The average attack success rate increases by 8.5 percentage points when dynamic modification is applied. GPT-4o reaches the highest success rate with dynamic modification at 84.5%, while Llama-3-8B shows a notable jump from 68.0% to 79.0%.

The table measures prompt diversity across multi-turn attack methods using pairwise cosine similarity, where higher values indicate greater diversity. ActorBreaker consistently shows higher diversity scores across all tested models compared to both CoA and Crescendo. This suggests that ActorBreaker generates a wider variety of attack prompts, which may contribute to its effectiveness in probing safety vulnerabilities. ActorBreaker achieves the highest diversity scores across all evaluated models, outperforming both CoA and Crescendo. Crescendo shows moderate diversity, while CoA exhibits the lowest diversity, with values that decrease as attacks progress. Diversity differences align with attack success rates, indicating that more diverse prompts correlate with better probing of model vulnerabilities.

ActorBreaker consistently outperforms single-turn and multi-turn attack baselines across diverse open and closed source language models, achieving the highest average attack success rate (77.7% versus 45.0% for the best baseline) and notably 60% success against GPT-o1 versus 14% for the strongest baseline, while also generating prompts with lower toxicity. Ablation studies show that all six actor types are effective, with Distribution and Facilitation generally yielding higher success and Regulation the lowest, and that combining more actor categories progressively increases attack success across models. Incorporating dynamic modification further boosts performance, raising the average success rate from 72.7% to 81.2% with consistent gains on every model. ActorBreaker also produces more diverse prompts than baseline methods, as measured by pairwise cosine similarity, which correlates with its higher attack success.