Pith. sign in

REVIEW 5 cited by

Tempest: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Search

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2503.10619 v5 pith:EQVHYHBP submitted 2025-03-13 cs.AI cs.CLcs.CR

Andy Zhou , Ron Arel This is my paper
classification cs.AIcs.CLcs.CR
keywords tempestmulti-turnlanguagemodelssearchtreeadversariallarge
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

We introduce Tempest, a multi-turn adversarial framework that models the gradual erosion of Large Language Model (LLM) safety through a tree search perspective. Unlike single-turn jailbreaks that rely on one meticulously engineered prompt, Tempest expands the conversation at each turn in a breadth-first fashion, branching out multiple adversarial prompts that exploit partial compliance from previous responses. By tracking these incremental policy leaks and re-injecting them into subsequent queries, Tempest reveals how minor concessions can accumulate into fully disallowed outputs. Evaluations on the JailbreakBench dataset show that Tempest achieves a 100% success rate on GPT-3.5-turbo and 97% on GPT-4 in a single multi-turn run, using fewer queries than baselines such as Crescendo or GOAT. This tree search methodology offers an in-depth view of how model safeguards degrade over successive dialogue turns, underscoring the urgency of robust multi-turn testing procedures for language models.

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks

    cs.CR 2026-08 conditional novelty 7.0 of 10

    Multi-turn LLM jailbreaks succeed based on how harmful intent is organized across turns, not on interaction length, and detection should shift to session and cross-session scope.

  2. Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactions

    cs.LG 2026-07 conditional novelty 6.5 of 10

    Recast predicts the turn distribution of future multi-turn LLM safety failures from dual-scale trajectory evidence, catching 88.3% of failures 2.41 turns early at 12.3% false alarms.

  3. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0 of 10

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  4. Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks

    cs.CR 2026-07 reject novelty 4.0 of 10

    CoopGuard's defer-tempt-analyze-coordinate agents cut reported jailbreak success and raise attacker token costs on the new EMRA benchmark, but the deceptive-rate metric is partly defined by the paper's own scoring rubric.

  5. A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks

    cs.CR 2025-06 conditional novelty 4.0 of 10

    Crescendo multi-turn jailbreak responses are represented by safety-tuned LLMs as benign rather than harmful, which helps explain why single-turn defenses fail.

Pith tools