mlsanityData to 7 Oct 2026

MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment

arXiv 2607.11070 ↗First posted 13 Jul 2026cs.CLcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Modern large language models (LLMs) operate in interactive multi-turn settings, making multi-turn jailbreaking a realistic threat model and an important setting for automated red teaming. A core challenge in learning multi-turn jailbreak attackers is credit assignment: different turns contribute differently to the final outcome, yet existing learning signals are often too coarse to identify their individual contributions. We propose decomposed credit GRPO (DC-GRPO), a unified turn-level credit assignment framework for Group Relative Policy Optimization in multi-turn jailbreak learning. DC-GRPO assigns a separate group-relative learning signal to each turn by combining immediate and future credit, avoiding the credit misassignment induced by broadcasting a single trajectory-level score across the dialogue. We instantiate this framework with static and dynamic weighting rules that differ in how the two credit sources are balanced while sharing the same turn-level structure. Across multiple victim LLMs and benchmarks, the dynamic- and static-weighted variants achieve average ASR5@3 scores of 98.26% and 97.88%, respectively, substantially outperforming the state-of-the-art methods, including SEMA (86.58%) and TROJail (86.23%). Their consistently strong performance indicates that the central empirical benefit comes from turn-level group-relative credit assignment rather than a particular weighting rule. Warning: This paper contains examples of harmful content.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 55 of its 64 references that are in the map. First posted on arXiv 13 Jul 2026.

Builds on

55 of 64 references.

Closest ancestors · 25

Same direction, newest first

  1. 2026SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks6 Feb
  2. 2025TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewards8 Dec
  3. 2025Automating Deception: Scalable Multi-Turn LLM Jailbreaks24 Nov
  4. 2025Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges3 Nov
  5. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs23 May
  6. 2025Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models28 Apr
  7. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents15 Apr
  8. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMs27 Feb
  9. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models16 Feb
  10. 2025Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions6 Feb
  11. 2025Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors24 Jan
  12. 2024Best-of-N Jailbreaking4 Dec
13 more
  1. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  2. 2024FlipAttack: Jailbreak LLMs via Flipping2 Oct
  3. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  4. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  5. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  6. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
  7. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  8. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  9. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  10. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  12. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  13. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 30

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2017Proximal Policy Optimization Algorithmscited by 14,441
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 8,851
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  6. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  7. 2024Qwen2 Technical Reportcited by 2,076
  8. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  10. 2025Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Modelscited by 1,175
  11. 2022Red Teaming Language Models with Language Modelscited by 983
  12. 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 877
18 more
  1. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
  2. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  3. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  4. 2025Group-in-Group Policy Optimization for LLM Agent Trainingcited by 442
  5. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  6. 2024Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Promptscited by 189
  7. 2025Qwen3Guard Technical Reportcited by 125
  8. 2024Curiosity-driven Red-teaming for Large Language Modelscited by 83
  9. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  10. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Testercited by 41
  11. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
  12. 2026Hierarchy-of-Groups Policy Optimization for Long-Horizon Agentic Taskscited by 37
  13. 2025MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teamingcited by 31
  14. 2025Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learningcited by 21
  15. 2025Post-training Large Language Models for Diverse High-Quality Responsescited by 19
  16. 2026Proximity-Based Multi-Turn Optimization: Practical Credit Assignment for LLM Agent Trainingcited by 18
  17. 2025CoP: Agentic Red-teaming for Large Language Models using Composition of Principlescited by 11
  18. 2025Auto-RT: Automatic Jailbreak Strategy Exploration for Red-Teaming Large Language Modelscited by 9

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
  2. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  3. 2025Multi-Turn Jailbreaks Are Simpler Than They Seem
  4. 2025Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learning
  5. 2025bi-GRPO: Bidirectional Optimization for Jailbreak Backdoor Injection on LLMs
  6. 2025MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs
  7. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  8. 2026SRTJ: Self-Evolving Rule-Driven Training-Free LLM Jailbreaking