Shanghai Jiao Tong University proposes ActorBreaker, a multi-turn jailbreak attack method based on actor-network theory, at ACL 2025

In an ACL 2025 paper, a Shanghai Jiao Tong University team proposed a multi-turn jailbreak attack method, ActorBreaker, which is based on Latour's actor-network theory and generates prompts that are semantically related to a harmful goal but superficially harmless, bypassing the safety mechanisms of aligned large language models. The method first builds an attack clue network containing six types of actors, including creation, execution, and distribution, then generates multi-turn queries through attack-chain inference and self-dialogue, and dynamically modifies the attack path according to the victim model's responses. In an evaluation on HarmBench against six models including GPT-4o, GPT-o1, Claude-3.5, and Llama-3, the average attack success rate was 77.7%, higher than CoA's 18.3% and Crescendo's 45.0%; the attack success rate against GPT-o1 reached 60.0%, and it was observed that its chain of thought first stated a safety stance and then listed execution steps, raising concerns about chain-of-thought faithfulness. The team also used this method to build a dataset of 1,680 multi-turn safety prompts; Circuit Breaker trained on it is more robust to multi-turn attacks, but safety fine-tuning reduces model usefulness.