Foot-In-The-Door: A Multi-Turn Jailbreak Method for LLMs

The paper by Weng et al. proposes the multi-turn jailbreak method Foot-In-The-Door (FITD), which gradually escalates the malicious intent of user queries through intermediate bridging prompts, transitioning from benign requests to harmful content, achieving an average attack success rate of 94% across seven mainstream models, higher than existing multi-turn and single-turn methods. The method exploits the model's self-corruption mechanism of treating its own previous answers as acceptable grounds, forming a feedback loop that lowers the threshold for subsequent harmful requests; since each turn is harmless in isolation, safety mechanisms calibrated for single-turn threats are difficult to trigger. The authors argue this is a structural weakness of autoregressive models in handling multi-turn contexts, rather than an implementation flaw of a specific model.