@inproceedings{rafiei-asl-etal-2025-nexus,
    title = "{NEXUS}: Network Exploration for e{X}ploiting Unsafe Sequences in Multi-Turn {LLM} Jailbreaks",
    author = "Rafiei Asl, Javad  and
      Narula, Sidhant  and
      Ghasemigol, Mohammad  and
      Blanco, Eduardo  and
      Takabi, Daniel",
    editor = "Christodoulopoulos, Christos  and
      Chakraborty, Tanmoy  and
      Rose, Carolyn  and
      Peng, Violet",
    booktitle = "Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing",
    month = nov,
    year = "2025",
    address = "Suzhou, China",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-emnlp/2025.emnlp-main.1235/",
    pages = "24278--24306",
    ISBN = "979-8-89176-332-6",
    abstract = "Large Language Models (LLMs) have revolutionized natural language processing, yet remain vulnerable to jailbreak attacks{---}particularly multi-turn jailbreaks that distribute malicious intent across benign exchanges, thereby bypassing alignment mechanisms. Existing approaches often suffer from limited exploration of the adversarial space, rely on hand-crafted heuristics, or lack systematic query refinement. We propose NEXUS (Network Exploration for eXploiting Unsafe Sequences), a modular framework for constructing, refining, and executing optimized multi-turn attacks. NEXUS comprises: (1) ThoughtNet, which hierarchically expands a harmful intent into a structured semantic network of topics, entities, and query chains; (2) a feedback-driven Simulator that iteratively refines and prunes these chains through attacker{--}victim{--}judge LLM collaboration using harmfulness and semantic-similarity benchmarks; and (3) a Network Traverser that adaptively navigates the refined query space for real-time attacks. This pipeline systematically uncovers stealthy, high-success adversarial paths across LLMs. Our experimental results on several closed-source and open-source LLMs show that NEXUS can achieve a higher attack success rate, between 2.1{\%} and 19.4{\%}, compared to state-of-the-art approaches. Our source code is available at https://github.com/inspire-lab/NEXUS."
}