Jailbreaking Large Language Models through Iterative Tool-Disguised Attacks via Reinforcement Learning

2026-01-09

arXiv.org

AI Summary

Current safety mechanisms in large language models struggle to defend against adversarial attacks disguised as legitimate tool calls, potentially leading to the generation of harmful content. This work proposes iMIST, a novel approach that, for the first time, integrates tool-call masquerading with reinforcement learning–based multi-turn progressive optimization to dynamically amplify harmful outputs during interactive sessions while evading content filters. Evaluated on mainstream large language models, iMIST significantly increases attack success rates while maintaining a low request rejection rate. The method exposes critical vulnerabilities in existing defense frameworks and highlights a blind spot in security design concerning tool-calling interfaces.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Security and Privacy: Large-scale security measurements

Abstract

Large language models (LLMs) have demonstrated remarkable capabilities across diverse applications, however, they remain critically vulnerable to jailbreak attacks that elicit harmful responses violating human values and safety guidelines. Despite extensive research on defense mechanisms, existing safeguards prove insufficient against sophisticated adversarial strategies. In this work, we propose iMIST (\underline{i}nteractive \underline{M}ulti-step \underline{P}rogre\underline{s}sive \underline{T}ool-disguised Jailbreak Attack), a novel adaptive jailbreak method that synergistically exploits vulnerabilities in current defense mechanisms. iMIST disguises malicious queries as normal tool invocations to bypass content filters, while simultaneously introducing an interactive progressive optimization algorithm that dynamically escalates response harmfulness through multi-turn dialogues guided by real-time harmfulness assessment. Our experiments on widely-used models demonstrate that iMIST achieves higher attack effectiveness, while maintaining low rejection rates. These results reveal critical vulnerabilities in current LLM safety mechanisms and underscore the urgent need for more robust defense strategies.

Problem

• jailbreak attacks
• large language models
• safety mechanisms
• adversarial strategies
• harmful responses

Innovation

• jailbreak attack
• tool-disguised
• reinforcement learning
• interactive optimization
• LLM safety