Structured Multi-step Jailbreaking under a Hamiltonian Generative Formulation

Recent work shows that even safety aligned large language models (LLM) can be pushed into unsafe behavior by carefully crafted jailbreak prompts. Existing jailbreaking attack methods often rely on disfluent or incoherent prompts, which limit their success and make them easy to detect. We introduce SJA, a structured jailbreak attack built around two ideas. First, inspired by the logic of Spilsbury puzzle, SJA decomposes a harmful query into a sequence of harmless sub-questions and reconstructs the original answer by combining the sub-question responses. Second, by leveraging the theory of Hamiltonian dynamics on hyperbolic space, we propose a hyperbolic Hamiltonian dynamics-based sub-question generation framework that effectively captures the structural and temporal dependencies. We provide a theoretical analysis of how each sub-question evolves along the trajectory and show that the hyperbolic Hamiltonian system effectively captures the underlying semantic structure. Finally, we propose a hyperbolic narrative fusion mechanism built on fractional embedding and Möbius fusion. This mechanism integrates coherent narratives into sub-questions while preserving geometric consistency and improving stealth performance. We theoretically validate that the combination of the generated harmless sub-questions, guided by the stealthy narrative, can effectively preserve the contextual semantics of the original harmful question.

Large language models, such as AI chat assistants, are trained to refuse dangerous requests, but users can sometimes bypass these safeguards by splitting a harmful request into smaller, ordinary-looking questions. This kind of bypass is often called a jailbreak. This paper studies this risk in a structured way. We propose SJA, a method that turns one unsafe request into a sequence of harmless-looking sub-questions. Each sub-question appears safe on its own, but their answers can be combined to recover the original harmful intent. The main idea is similar to a jigsaw puzzle: each question is only one small piece, while the full meaning appears after the pieces are put together. To make these pieces fit, our method uses a geometry-based path that keeps the questions in a clear order and avoids abrupt changes between steps. It also adds a shared story so the dialogue sounds natural instead of like a list of unrelated prompts. Experiments on standard safety benchmarks and several language models show that this structured approach is more effective and harder to detect than prior attacks. These results show a weakness in current safety systems: they often judge each question separately and may miss harmful intent that is built across multiple turns. By revealing this weakness, the paper can help guide the design of stronger defenses for multi-turn interactions.