{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,30]],"date-time":"2026-10-30T04:30:58Z","timestamp":1793334658829,"version":"4.5.0"},"reference-count":36,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["72571281"],"award-info":[{"award-number":["72571281"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010909","name":"Excellent Young Scientists Fund","doi-asserted-by":"publisher","award":["2025JJ40066"],"award-info":[{"award-number":["2025JJ40066"]}],"id":[{"id":"10.13039\/501100010909","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2027,1]]},"DOI":"10.1016\/j.eswa.2026.133684","type":"journal-article","created":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T07:56:19Z","timestamp":1784534179000},"page":"133684","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"PA","title":["JAIL: Adaptive multi-turn jailbreak attacks reveal limitations of LLM safety alignment"],"prefix":"10.1016","volume":"333","author":[{"given":"Yunhao","family":"Feng","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingrui","family":"Lao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yishan","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaolong","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuxiang","family":"Xie","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9184-5313","authenticated-orcid":false,"given":"Yanming","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2026.133684_bib0001","article-title":"FinBERT: Financial sentiment analysis with pre-trained language models","author":"Araci","year":"2019","journal-title":"Computation and Language"},{"key":"10.1016\/j.eswa.2026.133684_bib0002","unstructured":"Bai, J., Bai, S., Chu, Y., Cui, Z., Dang, K., Deng, X., Fan, Y., Ge, W., Han, Y., Huang, F. et al. (2023). Qwen technical report. arXiv: 2309.16609."},{"key":"10.1016\/j.eswa.2026.133684_bib0003","unstructured":"Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., & Wong, E. (2023). Jailbreaking black box large language models in twenty queries. arXiv: 2310.08419."},{"key":"10.1016\/j.eswa.2026.133684_bib0004","unstructured":"Chiang, W.-L., Li, Z., Lin, Z., Sheng, Y., Wu, Z., Zhang, H., Zheng, L., Zhuang, S., Zhuang, Y., Gonzalez, J. E. et al. (2023). Vicuna: An open-source chatbot impressing GPT-4 with 90%* chatGPT quality. vol. 2(3), 6See https:\/\/vicuna.lmsys.org(accessed 14 April 2023)."},{"key":"10.1016\/j.eswa.2026.133684_bib0005","unstructured":"Dai, J., Pan, X., Sun, R., Ji, J., Xu, X., Liu, M., Wang, Y., & Yang, Y. (2023). Safe RLHF: Safe reinforcement learning from human feedback."},{"key":"10.1016\/j.eswa.2026.133684_bib0006","series-title":"Proceedings of the AAAI Conference on Artificial Intelligence","first-page":"23814","article-title":"Multi-turn jailbreaking large language models via attention shifting","volume":"39","author":"Du","year":"2025"},{"key":"10.1016\/j.eswa.2026.133684_bib0007","doi-asserted-by":"crossref","first-page":"24678","DOI":"10.52202\/075280-1072","article-title":"BeaverTails: Towards improved safety alignment of LLM via a human-preference dataset","volume":"36","author":"Ji","year":"2023","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.133684_bib0008","unstructured":"Jiang, A. Q., Sablayrolles, A., Roux, A., Mensch, A., Savary, B., Bamford, C., Chaplot, D. S., de las, C. D., Hanna, E. B., Bressand, F. et al. (2024a). Mixtral of experts. arXiv: 2401.04088."},{"key":"10.1016\/j.eswa.2026.133684_bib0009","series-title":"Proceedings of the 62nd annual meeting of the association for computational linguistics (volume 1: Long papers)","first-page":"15157","article-title":"ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs","author":"Jiang","year":"2024"},{"key":"10.1016\/j.eswa.2026.133684_bib0010","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"35562","article-title":"PurMM: Attention-guided test-time backdoor purification in multimodal large language models","volume":"vol. 40","author":"Jiang","year":"2026"},{"key":"10.1016\/j.eswa.2026.133684_bib0011","unstructured":"Jiang, Y., Aggarwal, K., Laud, T., Munir, K., Pujara, J., & Mukherjee, S. (2024c). Red queen: Safeguarding large language models against concealed multi-turn jailbreaking. arXiv: 2409.17458."},{"key":"10.1016\/j.eswa.2026.133684_bib0012","doi-asserted-by":"crossref","unstructured":"Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., & Hashimoto, T. (2023). Exploiting programmatic behavior of LLMs: Dual-use through standard security attacks.","DOI":"10.1109\/SPW63631.2024.00018"},{"key":"10.1016\/j.eswa.2026.133684_bib0013","article-title":"PolyGuard: Massive multi-domain safety policy-grounded guardrail dataset","volume":"38","author":"Kang","year":"2026","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.133684_bib0014","unstructured":"Kritz, J., Robinson, V., Vacareanu, R., Varjavand, B., Choi, M., Gogov, B., S. R. Team, Yue, S., Primack, W. E., & Wang, Z. (2025). Jailbreaking to jailbreak. arXiv: 2502.09638."},{"key":"10.1016\/j.eswa.2026.133684_bib0015","doi-asserted-by":"crossref","unstructured":"Li, Y., Li, Z., Zhao, W., Min, N. M., Huang, H., Ma, X., & Sun, J. (2025). AutoBackdoor: Automating backdoor attacks via LLM agents. arXiv: 2511.16709.","DOI":"10.18653\/2026.findings-emnlp.1164"},{"key":"10.1016\/j.eswa.2026.133684_bib0016","unstructured":"Liu, X., Xu, N., Chen, M., & Xiao, C. (a). AutoDAN: Generating stealthy jailbreak prompts on aligned large language models."},{"key":"10.1016\/j.eswa.2026.133684_bib0017","unstructured":"Liu, X., Yu, Z., Zhang, Y., Zhang, N., & Xiao, C. (2024). Automatic and universal prompt injection attacks against large language models. arXiv: 2403.04957."},{"key":"10.1016\/j.eswa.2026.133684_bib0018","article-title":"Enhancing security in large language models: A comprehensive review of prompt injection attacks and defenses","author":"Mathew","year":"2024","journal-title":"Authorea Preprints"},{"key":"10.1016\/j.eswa.2026.133684_bib0019","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"6144","article-title":"Autonomous LLM-enhanced adversarial attack for text-to-motion","volume":"vol. 39","author":"Miao","year":"2025"},{"key":"10.1016\/j.eswa.2026.133684_bib0020","series-title":"NeurIPS safe generative AI workshop 2024","article-title":"GuardFormer: Guardrail instruction pretraining for efficient safeguarding","author":"O\u2019Neill","year":"2024"},{"key":"10.1016\/j.eswa.2026.133684_bib0021","doi-asserted-by":"crossref","first-page":"27730","DOI":"10.52202\/068431-2011","article-title":"Training language models to follow instructions with human feedback","volume":"35","author":"Ouyang","year":"2022","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.133684_bib0022","doi-asserted-by":"crossref","first-page":"53728","DOI":"10.52202\/075280-2338","article-title":"Direct preference optimization: Your language model is secretly a reward model","volume":"36","author":"Rafailov","year":"2023","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.133684_bib0023","unstructured":"Ren, Q., Li, H., Liu, D., Xie, Z., Lu, X., Qiao, Y., Sha, L., Yan, J., Ma, L., & Shao, J. (2024). Derail yourself: Multi-turn LLM jailbreak attack through self-discovered clues. arXiv: 2410.10700."},{"key":"10.1016\/j.eswa.2026.133684_bib0024","unstructured":"Shen, K., Quan, R., Miao, J., Xiao, J., & Yang, Y. (2025). TarPro: Targeted protection against malicious image editing. arXiv: 2503.13994."},{"key":"10.1016\/j.eswa.2026.133684_bib0025","unstructured":"Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozi\u00e8re, B., Goyal, N., Hambro, E., Azhar, F. et al. (2023). LLaMA: Open and efficient foundation language models. arXiv: 2302.13971."},{"key":"10.1016\/j.eswa.2026.133684_bib0026","doi-asserted-by":"crossref","unstructured":"Wei, A., Haghtalab, N., & Steinhardt, J. (2023). Jailbroken: How does LLM safety training fail?","DOI":"10.52202\/075280-3508"},{"key":"10.1016\/j.eswa.2026.133684_bib0027","unstructured":"Xu, Z., Liu, Y., Deng, G., Li, Y., Picek, S., Dan\u201d. Gpt, & Construction, B.. LLM jailbreak attack versus defense techniques -A comprehensive study."},{"key":"10.1016\/j.eswa.2026.133684_bib0028","unstructured":"Yang, X., Tang, X., Hu, S., & Han, J. (2024). Chain of attack: A semantic-driven contextual multi-turn attacker for LLM. arXiv: 2405.05610."},{"key":"10.1016\/j.eswa.2026.133684_bib0029","unstructured":"Yu, J., Lin, X., Yu, Z., & Xing, X. (2023). GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts. arXiv: 2309.10253."},{"key":"10.1016\/j.eswa.2026.133684_bib0030","unstructured":"Yuan, Y., Jiao, W., Wang, W., Huang, J.-J., He, P., Shi, S., & Tu, Z. (2023). GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher."},{"key":"10.1016\/j.eswa.2026.133684_bib0031","doi-asserted-by":"crossref","unstructured":"Zhang, W., & Pei, S. (2026). Your LLM agent can leak your data: Data exfiltration via backdoored tool use. arXiv: 2604.05432.","DOI":"10.18653\/v1\/2026.findings-acl.1257"},{"key":"10.1016\/j.eswa.2026.133684_bib0032","unstructured":"Zhao, W., Li, Z., Li, Y., & Sun, J. (2024). Adversarial suffixes may be features too!arXiv: 2410.00451."},{"key":"10.1016\/j.eswa.2026.133684_bib0033","doi-asserted-by":"crossref","unstructured":"Zhao, Y., & Zhang, Y. (2025). Siren: A learning-based multi-turn attack framework for simulating real-world human jailbreak behaviors. arXiv: 2501.14250.","DOI":"10.1109\/ACSAC67867.2025.00095"},{"key":"10.1016\/j.eswa.2026.133684_bib0034","unstructured":"Zhu, S., Zhang, R., An, B., Wu, G., Barrow, J., Wang, Z., Huang, F., Nenkova, A., & Sun, T. (2023). AutoDAN: interpretable gradient-based adversarial attacks on large language models. arXiv: 2310.15140."},{"key":"10.1016\/j.eswa.2026.133684_bib0035","unstructured":"Zhuo, T., Huang, Y., Chen, C., & Xing, Z. (2023). Red teaming chatGPT via jailbreaking: Bias, robustness, reliability and toxicity."},{"key":"10.1016\/j.eswa.2026.133684_bib0036","unstructured":"Zou, A., Wang, Z., Kolter, J. Z., & Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models."}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426025923?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426025923?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,10,30]],"date-time":"2026-10-30T03:41:21Z","timestamp":1793331681000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417426025923"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2027,1]]},"references-count":36,"alternative-id":["S0957417426025923"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2026.133684","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2027,1]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"JAIL: Adaptive multi-turn jailbreak attacks reveal limitations of LLM safety alignment","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2026.133684","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"133684"}}