mlsanityData to 14 Oct 2026

MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in Large Language Models

arXiv 2509.14651 ↗First posted 18 Sep 2025cs.CL cs.AIcited by 4

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

As large language models~(LLMs) become widely adopted, ensuring their alignment with human values is crucial to prevent jailbreaks where adversaries manipulate models to produce harmful content. While most defenses target single-turn attacks, real-world usage often involves multi-turn dialogues, exposing models to attacks that exploit conversational context to bypass safety measures. We introduce MUSE, a comprehensive framework tackling multi-turn jailbreaks from both attack and defense angles. For attacks, we propose MUSE-A, a method that uses frame semantics and heuristic tree search to explore diverse semantic trajectories. For defense, we present MUSE-D, a fine-grained safety alignment approach that intervenes early in dialogues to reduce vulnerabilities. Extensive experiments on various models show that MUSE effectively identifies and mitigates multi-turn vulnerabilities. Code is available at hrefhttps://github.com/yansiyu02/MUSEhttps://github.com/yansiyu02/MUSE.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 36 of its 51 references that are in the map. First posted on arXiv 18 Sep 2025.

Builds on

36 of 51 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024RePD: Defending Jailbreak Attack through a Retrieval-based Prompt Decomposition Process11 Oct
  2. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
  3. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
  4. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  6. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  7. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 29

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  5. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  6. 2017Deep reinforcement learning from human preferencescited by 3,912
  7. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
  8. 2020Learning to summarize from human feedbackcited by 2,588
  9. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  11. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  12. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
17 more
  1. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  2. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  4. 2024Step-DPO: Step-wise Preference Optimization for Long-chain Reasoning of LLMscited by 273
  5. 2024Direct Language Model Alignment from Online AI Feedbackcited by 260
  6. 2023The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learningcited by 257
  7. 2024MT-Bench-101: A Fine-Grained Benchmark for Evaluating Large Language Models in Multi-Turn Dialoguescited by 250
  8. 2015Building End-To-End Dialogue Systems Using Generative Hierarchical Neural Network Modelscited by 207
  9. 2024Aligner: Efficient Alignment by Learning to Correctcited by 98
  10. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 77
  11. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
  12. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 53
  13. 2024AD-LLM: Benchmarking Large Language Models for Anomaly Detectioncited by 26
  14. 2025Reasoning with Reinforced Functional Token Tuningcited by 14
  15. 2025Bridging the Safety Gap: A Guardrail Pipeline for Trustworthy LLM Inferencescited by 8
  16. 2024Inductive-Deductive Strategy Reuse for Multi-Turn Instructional Dialoguescited by 6
  17. 2023Multi-turn Dialogue Comprehension from a Topic-aware Perspectivecited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Dolphin-v2: Universal Document Parsing via Scalable Anchor Promptingcited by 22
  2. 2026TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreakingcited by 7
  3. 2026JMedEthicBench: A Multi-Turn Conversational Benchmark for Evaluating Medical Safety in Japanese Large Language Modelscited by 1
  4. 2026MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAGcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025SafeDialBench: A Fine-Grained Safety Evaluation Benchmark for Large Language Models in Multi-Turn Dialogues with Diverse Jailbreak Attacks
  2. 2025Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models
  3. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue
  4. 2025GRAF: Multi-turn Jailbreaking via Global Refinement and Active Fabrication
  5. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models
  6. 2026One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent
  7. 2025Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks
  8. 2025MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teaming