HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models

TL;DR

The paper addresses the persistent vulnerability of LLMs to multi-turn jailbreak attacks and the limited exploration of adversarial space in prior work. HarmNet introduces a modular, LLМ-agnostic framework with ThoughtNet for semantically structured search, a Feedback-Driven Simulator for iterative refinement, and a Network Traverser for real-time adaptive execution. Key contributions include a threshold-driven semantic space construction, an iterative prune-and-refine loop guided by harmfulness and semantic alignment, and demonstrated robustness across both closed-source and open-source LLMs, achieving state-of-the-art Attack Success Rates on HarmBench. These results highlight HarmNet's effectiveness as a rigorous red-teaming tool and its practical impact for safety evaluation and adversarial research in large language models.

Abstract

Large Language Models (LLMs) remain vulnerable to multi-turn jailbreak attacks. We introduce HarmNet, a modular framework comprising ThoughtNet, a hierarchical semantic network; a feedback-driven Simulator for iterative query refinement; and a Network Traverser for real-time adaptive attack execution. HarmNet systematically explores and refines the adversarial space to uncover stealthy, high-success attack paths. Experiments across closed-source and open-source LLMs show that HarmNet outperforms state-of-the-art methods, achieving higher attack success rates. For example, on Mistral-7B, HarmNet achieves a 99.4% attack success rate, 13.9% higher than the best baseline. Index terms: jailbreak attacks; large language models; adversarial framework; query refinement.

Figures (1)

• Figure 1: Attack Diversity Comparison