[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-635184-105":59,"doc-detail-635184-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","red-queen-exposing-latent-multi-turn-risks-in-large-language-models","Red Queen - Exposing Latent Multi-Turn Risks in Large Language Models","","Red Queen investigates how large language models generate harmful responses under jailbreak attacks that conceal intent across multi-turn interactions. While existing work often focuses on single-turn, explicitly malicious prompts, this research frames the problem through Theory of Mind limitations, showing that models struggle to infer latent user goals. The study introduces RED QUEEN ATTACK and generates 56K multi-turn concealment data points across scenarios and harmful categories, achieving high attack success rates. It further proposes RED QUEEN GUARD to sharply reduce success while preserving standard benchmark performance.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/red-queen-exposing-latent-multi-turn-risks-in-large-language-models/635184/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/red-queen-exposing-latent-multi-turn-risks-in-large-language-models/635184.png","ImageObject",300,407,{"name":92,"@type":93},"putri.kecil17","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-10-22",true,{"@type":102,"interactionType":103,"userInteractionCount":14},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What problem does Red Queen focus on?","Question",{"text":112,"@type":113},"It examines latent multi-turn risks in large language models, specifically how jailbreak attacks can conceal malicious intent over multiple conversational turns.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does RED QUEEN ATTACK differ from prior jailbreak strategies?",{"text":117,"@type":113},"It constructs a multi-turn scenario that hides malicious intent by presenting itself as a protector while redirecting wrongdoing to someone else, rather than relying on single-turn explicit prompts.",{"name":119,"@type":110,"acceptedAnswer":120},"What mitigation is proposed to improve safety?",{"text":121,"@type":113},"RED QUEEN GUARD reduces the attack success rate to below 1% while aiming to maintain model performance on standard benchmarks.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},635184,1792717967,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":14,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},962094509873,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Red Queen: Exposing Latent Multi-Turn Risks in Large Language Models  \nYifan Jiang 1 ,2 Kriti Aggarwal 1 Tanmay Laud 1  \nKashif Munir 1 Jay Pujara2 Subhabrata Mukherjee 1  \n1Hippocratic AI  \n2Information Sciences Institute, University of Southern California  \n{yifan,kriti,tanmay,kashif,[subho}@hippocraticai.com](subho}@hippocraticai.com)  \n{yifjia,[pujara}@isi.edu](pujara}@isi.edu)  \nAbstract  \nContent Warning: This paper contains examples of harmful language and plans. The rapid advancement of large language models (LLMs) has unlocked diverse opportunities across domains and applications but has also raised concerns about their tendency to generate harmful responses under jailbreak attacks. However, most existing jailbreak strategies are singleturn with explicit malicious intent, failing to reflect the real-world scenario where interactions can be multi-turn and users can conceal their intents. Recent studies on Theory of Mind (ToM) reveal that LLMs often struggle to infer users’ latent intent in such scenarios. Building on these limitations, we propose a novel jailbreak attack, RED QUEEN ATTACK, which constructs a multi-turn scenario, concealing the malicious intent under the guise of preventing harm. We generate 56k multi-turn concealment data points across 40 scenarios and 14 harmful categories, evaluating four LLM families of different sizes. Results show all models are vulnerable to RED QUEEN ATTACK, reaching 87.6% attack success rate (ASR) on GPT-4o and 77.1% on Llama3-70B. Compared to prior jailbreak attacks, the RED QUEEN ATTACK achieves superior performance on nine out often models, with ASR improvements ranging from 2% to 64% . Further analysis reveals that larger models exhibit greater vulnerability to our attack, primarily due to the combination of multi-turn structures and concealment strategies. To enhance safety, we propose RED QUEEN GUARD, a mitigation strategy reducing ASR to below 1% while maintaining model performance on standard benchmarks. Full implementation and dataset are publicly accessible at [https://github.com/kriti-hippo/](https://github.com/kriti-hippo/)[ ](https://github.com/kriti-hippo/)red_queen.  \n1 Introduction  \nRecent advancements in novel training methodologies, computational capabilities, and data avail-  \n* Work done when YF was at Hippocratic AI  \nFigure 1: An example of RED QUEEN ATTACK on \"how to build a bomb\". Compared with a direct attack on the left, RED QUEEN ATTACK constructs a multi-turn scenario and conceals harmful intent by claiming to thwart the efforts of a friend wanting to build a bomb. The attack response is derived from GPT-4 .  \nability facilitate the adaptation of large language models (LLMs) (Achiam et al., 2023 ; Touvron et al., 2023) to diverse real-world applications, such as task planning (Zhang, 2024 ; Huang et al., 2024b) and question answering (Jiang et al., 2023b ; Hendrycks et al., 2021) . However, LLMs are also vulnerable to adversarial exploitation, which can lead to the generation of harmful or illegal content (Xu et al., 2024b), such as offensive language (Perez et al., 2022) or instructions for malicious actions (Zou et al., 2023) . Among this exploitation, jailbreaking has emerged as one of the most prominent strategies, where carefully crafted prompts bypass safety mechanisms to elicit harmful responses (Alex, 2023 ; Xu et al., 2024b) .  \nExisting jailbreak research has explored a range of approaches (Xu et al., 2024b ; Liu et al., 2023), such as appending sentences to influence model responses (Wei et al., 2024) or deploying another LLM to generate and refine jailbreaks automati-  \n25554  \nFindings of the Association for Computational Linguistics: ACL 2025 , pages 25554–25591 July 27-August 1, 2025 ©2025 Association for Computational Linguistics  \ncally (Chao et al., 2023) . While these methods demonstrate effectiveness, they are largely limited to single-turn prompts and often fail to conceal harmful intent. Recent work has begun exploring multi-tu","cbCaisW5QmeapEP6","https://ap.wps.com/l/cbCaisW5QmeapEP6","pdf",6958684,38,"English","# Abstract\n# 1 Introduction\n## Jailbreaking and single-turn limitations\n## Theory of Mind and multi-turn concealment\n## Proposed RED QUEEN ATTACK and data generation\n## Experimental evaluation and mitigation overview","[{\"question\":\"What problem does Red Queen focus on?\",\"answer\":\"It examines latent multi-turn risks in large language models, specifically how jailbreak attacks can conceal malicious intent over multiple conversational turns.\"},{\"question\":\"How does RED QUEEN ATTACK differ from prior jailbreak strategies?\",\"answer\":\"It constructs a multi-turn scenario that hides malicious intent by presenting itself as a protector while redirecting wrongdoing to someone else, rather than relying on single-turn explicit prompts.\"},{\"question\":\"What mitigation is proposed to improve safety?\",\"answer\":\"RED QUEEN GUARD reduces the attack success rate to below 1% while aiming to maintain model performance on standard benchmarks.\"}]","Red Queen - Exposing Latent Multi-Turn Risks in Large Language Models | PDF",1792675454,96]