ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	Lin, Xingwei, Lin, Wenhao, Cao, Sicong, Yu, Jiahao, Huang, Renke, Xue, Lei, Wu, Chunming
Format:	Preprint
Published:	2026
Subjects:	Cryptography and Security Artificial Intelligence
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

_version_	1866914288820551680
author	Lin, Xingwei Lin, Wenhao Cao, Sicong Yu, Jiahao Huang, Renke Xue, Lei Wu, Chunming
author_facet	Lin, Xingwei Lin, Wenhao Cao, Sicong Yu, Jiahao Huang, Renke Xue, Lei Wu, Chunming
contents	Multi-turn jailbreak attacks have emerged as a critical threat to Large Language Models (LLMs), bypassing safety mechanisms by progressively constructing adversarial contexts from scratch and incrementally refining prompts. However, existing methods suffer from the inefficiency of incremental context construction that requires step-by-step LLM interaction, and often stagnate in suboptimal regions due to surface-level optimization. In this paper, we characterize the Intent-Context Coupling phenomenon, revealing that LLM safety constraints are significantly relaxed when a malicious intent is coupled with a semantically congruent context pattern. Driven by this insight, we propose ICON, an automated multi-turn jailbreak framework that efficiently constructs an authoritative-style context via prior-guided semantic routing. Specifically, ICON first routes the malicious intent to a congruent context pattern (e.g., Scientific Research) and instantiates it into an attack prompt sequence. This sequence progressively builds the authoritative-style context and ultimately elicits prohibited content. In addition, ICON incorporates a Hierarchical Optimization Strategy that combines local prompt refinement with global context switching, preventing the attack from stagnating in ineffective contexts. Experimental results across eight SOTA LLMs demonstrate the effectiveness of ICON, achieving a state-of-the-art average Attack Success Rate (ASR) of 97.1\%. Code is available at https://github.com/xwlin-roy/ICON.
format	Preprint
id	arxiv_https___arxiv_org_abs_2601_20903
institution	arXiv
publishDate	2026
record_format	arxiv
spellingShingle	ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack Lin, Xingwei Lin, Wenhao Cao, Sicong Yu, Jiahao Huang, Renke Xue, Lei Wu, Chunming Cryptography and Security Artificial Intelligence Multi-turn jailbreak attacks have emerged as a critical threat to Large Language Models (LLMs), bypassing safety mechanisms by progressively constructing adversarial contexts from scratch and incrementally refining prompts. However, existing methods suffer from the inefficiency of incremental context construction that requires step-by-step LLM interaction, and often stagnate in suboptimal regions due to surface-level optimization. In this paper, we characterize the Intent-Context Coupling phenomenon, revealing that LLM safety constraints are significantly relaxed when a malicious intent is coupled with a semantically congruent context pattern. Driven by this insight, we propose ICON, an automated multi-turn jailbreak framework that efficiently constructs an authoritative-style context via prior-guided semantic routing. Specifically, ICON first routes the malicious intent to a congruent context pattern (e.g., Scientific Research) and instantiates it into an attack prompt sequence. This sequence progressively builds the authoritative-style context and ultimately elicits prohibited content. In addition, ICON incorporates a Hierarchical Optimization Strategy that combines local prompt refinement with global context switching, preventing the attack from stagnating in ineffective contexts. Experimental results across eight SOTA LLMs demonstrate the effectiveness of ICON, achieving a state-of-the-art average Attack Success Rate (ASR) of 97.1\%. Code is available at https://github.com/xwlin-roy/ICON.
title	ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack
topic	Cryptography and Security Artificial Intelligence
url	https://arxiv.org/abs/2601.20903