Red Queen: Exposing Latent Multi-Turn Risks in Large Language Models

Content Warning: This paper contains examples of harmful language and plans.The rapid advancement of large language models (LLMs) has unlocked diverse opportunities across domains and applications but has also raised concerns about their tendency to generate harmful responses under jailbreak attacks.However, most existing jailbreak strategies are singleturn with explicit malicious intent, failing to reflect the real-world scenario where interactions can be multi-turn and users can conceal their intents.Recent studies on Theory of Mind (ToM) reveal that LLMs often struggle to infer users' latent intent in such scenarios.Building on these limitations, we propose a novel jailbreak attack, RED QUEEN ATTACK, which constructs a multi-turn scenario, concealing the malicious intent under the guise of preventing harm.We generate 56k multi-turn concealment data points across 40 scenarios and 14 harmful categories, evaluating four LLM families of different sizes.Results show all models are vulnerable to RED QUEEN ATTACK, reaching 87.6% attack success rate (ASR) on GPT-4o and 77.1% on Llama3-70B.Compared to prior jailbreak attacks, the RED QUEEN ATTACK achieves superior performance on nine out of ten models, with ASR improvements ranging from 2% to 64%.Further analysis reveals that larger models exhibit greater vulnerability to our attack, primarily due to the combination of multi-turn structures and concealment strategies.To enhance safety, we propose RED QUEEN GUARD, a mitigation strategy reducing ASR to below 1% while maintaining model performance on standard benchmarks.Full implementation and dataset are publicly accessible at https://github.com/kriti-hippo/ red_queen.