TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewards (2026.acl-long)
Copied to clipboard
| Challenge: | Existing approaches to training multi-turn attackers to probe model safety vulnerabilities rely on turn-level optimization, which is insufficient for learning long-term attack strategies. |
| Approach: | They propose a multi-turn reinforcement learning problem that optimizes the harmfulness of the final-turn response as the outcome reward. |
| Outcome: | The proposed approach improves attack success rates across multiple models and benchmarks, highlighting the effectiveness of the proposed approach. |
Similar Papers
RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for evaluating the safety of large language models rely on heuristic strategies or trained attack agents. |
| Approach: | They propose a method for multi-turn jailbreaking that iteratively plans and executes each turn via a Judge, a Transitioner, and a Planner. |
| Outcome: | The proposed framework achieves strong attack performance across open-source and closed-source target models while remaining effective under stricter turn budgets. |
Activation-Guided Local Editing for Jailbreaking Attacks (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking Large Language Models (LLMs) are limited and produce incoherent or unreadable inputs. |
| Approach: | They propose a two-stage framework that performs a one-shot, scenario-based generation of context and rephrases the original malicious query to obscure its harmful intent. |
| Outcome: | The proposed framework achieves state-of-the-art Attack Success Rate, with gains of up to 37.74% over the strongest baseline, and excellent transferability to black-box and large-scale models. |
Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing multi-turn methods for large language models exploit conversational context to bypass safety constraints gradually. |
| Approach: | They propose a framework of five conversation patterns to construct multi-turn jailbreaks through natural dialogue. |
| Outcome: | The proposed framework exploits conversational contexts to construct multi-turn jailbreaks . it reveals that models exhibit distinct weakness profiles and model families share similar failure modes . |
MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts? (2025.findings-emnlp)
Copied to clipboard
Muntasir Wahed, Xiaona Zhou, Kiet A. Nguyen, Tianjiao Yu, Nirav Diwan, Gang Wang, Dilek Hakkani-Tür, Ismini Lourentzou
| Challenge: | Recent advances in Large Language Models have significantly enhanced their code generation capabilities, but their robustness against adversarial misuse remains underexplored. |
| Approach: | They introduce a code decomposition attack where a malicious coding task is broken down into subtasks across multiple conversational turns to evade safety filters. |
| Outcome: | The proposed code decomposition attacks exploits multi-turn malicious coding prompts . the proposed model improves rejection rates while preserving coding ability . |
Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experience (2025.emnlp-main)
Copied to clipboard
Xi Wang, Songlei Jian, Shasha Li, Xiaopeng Li, Bin Ji, Ma Jun, Xiaodong Liu, Jing Wang, Jianfeng Zhang, Jie Yu, Feilong Bao, null Wangbaosheng
| Challenge: | Existing methods to generate human-aligned content with a “jailbreak prompt” are inefficient and repetitive, causing inefficiency and a lack of experience. |
| Approach: | They propose a framework that integrates past attack experiences to aid current jailbreak attempts. |
| Outcome: | The proposed framework improves both attack effectiveness and efficiency compared to the current black-box jailbreak method. |
Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models (2025.findings-emnlp)
Copied to clipboard
Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, Dacheng Tao
| Challenge: | Existing methods for implementing multi-turn jailbreaks struggle to balance semantic coherence with attack effectiveness, resulting in benign semantic drift or ineffective detection evasion. |
| Approach: | They propose a framework that reformulates harmful queries into benign reasoning tasks and leverages LLMs’ strong reasoning capabilities to compromise safety alignment. |
| Outcome: | The proposed framework achieves state-of-the-art attack effectiveness in complex conversational scenarios, with average ASRs increasing by up to 96%. |
MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teaming (2025.acl-long)
Copied to clipboard
| Challenge: | Existing jailbreak techniques rely on single-round interactions, pro-Corresponding author. |
| Approach: | They propose a multi-turn safety alignment framework to address the challenge of securing large language models in multi-round interactions. |
| Outcome: | The proposed framework exhibits state-of-the-art attack capabilities while improving safety performance on safety benchmarks. |
MultiCodeAttack: Iterative Jailbreak Attacking on LLMs with Multi-Code Prompt Injection (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to jailbreak rely on fixed template design and a single programming language . however, existing approaches do not consider language diversity or adaptive template evolution . |
| Approach: | They propose a structured jailbreak framework that explores and optimizes multi-language code templates. |
| Outcome: | The proposed framework outperforms existing jailbreak baselines and produces higher harmful outputs than baseline methods. |
Red Queen: Exposing Latent Multi-Turn Risks in Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak strategies are single-turn with explicit malicious intent, failing to reflect real-world scenarios where interactions can be multi-turn and users can conceal intents. |
| Approach: | They propose a jailbreak attack that constructs a multi-turn scenario and conceals malicious intent under the guise of preventing harm. |
| Outcome: | The proposed attack achieves 87.6% attack success rate (ASR) on GPT-4o and 77.1% on Llama3-70B compared to previous jailbreak attacks . |
A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated capabilities for generating content that could be deemed harmful. |
| Approach: | They conduct a comprehensive analysis of existing studies on jailbreaking LLMs and their defense techniques. |
| Outcome: | The proposed techniques underperform existing white-box attacks and include special tokens significantly affects the likelihood of successful attacks. |