Large reasoning models with reasoning capabilities achieve state-of-the-art performance on complex tasks, but their robustness under multi-turn adversarial pressure remains underexplored. We evaluate nine frontier reasoning models under adversarial attacks. Our findings reveal that reasoning confers meaningful but incomplete robustness: most reasoning models studied significantly outperform instruction-tuned baselines, yet all exhibit distinct vulnerability profiles, with misleading suggestions universally effective and social pressure showing model-specific efficacy. Through trajectory analysis, we identify five failure modes (Self-Doubt, Social Conformity, Suggestion Hijacking, Emotional Susceptibility, and Reasoning Fatigue) with the first two accounting for 50% of failures. We further demonstrate that Confidence-Aware Response Generation (CARG), effective for standard LLMs, fails for reasoning models due to overconfidence induced by extended reasoning traces; counterintuitively, random confidence embedding outperforms targeted extraction. Our results highlight that reasoning capabilities do not automatically confer adversarial robustness and that confidence-based defenses require fundamental redesign for reasoning models.
FRACTURED-SORRY-Bench: Framework for Revealing Attacks in Conversational Turns Undermining Refusal Efficacy and Defenses over SORRY-Bench (Automated Multi-shot Jailbreaks)
Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors
Department of Computing The Hong Kong Polytechnic University Hong Kong SAR, China；Centre for Artificial Intelligence；Robotics Hong Kong Institute of Science \& Innovation Chinese Academy of Sciences Hong Kong SAR, China
SafeDialBench: A Fine-Grained Safety Evaluation Benchmark for Large Language Models in Multi-Turn Dialogues with Diverse Jailbreak Attacks
National Key Laboratory for Novel Software Technology, Nanjing University（南京大学新型软件技术国家重点实验室）；University of Liverpool（利物浦大学）；City University of Hong Kong（香港城市大学）；School of Intelligence Science and Technology, Nanjing University（南京大学智能科学与技术学院）；China Mobile Research Institute（中国移动研究院）；China Mobile (Suzhou) Software Technology Co., Ltd（中国移动苏州软件技术有限公司）
CoSafe: Evaluating Large Language Model Safety in Multi-Turn Dialogue Coreference
The Hong Kong Polytechnic University（香港理工大学）；Huawei Noah’s Ark Lab（华为诺亚方舟实验室）；Research Centre for Data Science & Artificial Intelligence（数据科学与人工智能研究中心）
Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks
University of California, Berkeley（加州大学伯克利分校）；Stanford University（斯坦福大学）；Georgia Institute of Technology（佐治亚理工学院）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；McGill University（麦吉尔大学）；Mila（米拉研究所）
Doppelganger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack
Research Institute for Future Medicine, Samsung Medical Center（未来医学研究所，三星医疗中心）；Department of Digital Health, SAIHST, Sungkyunkwan University（数字健康系，SAIHST，成均馆大学）；Department of Medical Device Management and Research, SAIHST, Sungkyunkwan University（医疗设备管理与研究系，SAIHST，成均馆大学）；Department of Emergency Medicine, Samsung Medical Center（急诊医学系，三星医疗中心）
M2S: Multi-turn to Single-turn jailbreak in Red Teaming for LLMs
AIM Intelligence（AIM智能研究所）；University of Seoul（首尔大学）；Korea Advanced Institute of Science and Technology（韩国科学技术院）；Seoul National University（首尔国立大学）；Yonsei University（延世大学）；Korea Institute of Science and Technology（韩国科学技术院）；Kyung Hee University（庆熙大学）
One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent
Georgia Institute of Technology（佐治亚理工学院）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；UCSD（加州大学圣地亚哥分校）；National Taiwan University（台湾大学）；IBM Research（IBM研究院）；Virtue AI
The Attacker in the Mirror: Breaking Self-Consistency in Safety via Anchored Bipolicy Self-Play
Department of Informatics, King’s College London（伦敦国王学院信息学院）；Department of Computer Science, University of Oxford（牛津大学计算机科学系）；University of Sussex（Sussex大学）；Institute for Decentralized AI（去中心化人工智能研究所）
D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting
University of California, Berkeley（加州大学伯克利分校）；International Computer Science Institute（国际计算机科学研究所）；University of California, Riverside（加州大学河滨分校）；Lawrence Berkeley National Laboratory（伯克利国家实验室）
JailbreakOPT: Iterative Jailbreak Prompt Optimization with Macro-Action
University of California, Davis（加州大学戴维斯分校）；The Renmin University of China（中国人民大学）；Independent Researcher（独立研究员）；Nankai University（南开大学）；Cornell University（康奈尔大学）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））
Purdue University（普渡大学）；Independent（独立）；Columbia University（哥伦比亚大学）；University of California, San Diego（加州大学圣地亚哥分校）；University of California, Los Angeles（加州大学洛杉矶分校）；Dartmouth College（达特茅斯学院）；University of Michigan, Ann Arbor（密歇根大学安娜堡分校）
