ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
As large language models are deployed behind increasingly sophisticated safety mechanisms, evaluating their robustness under realistic adversarial conditions becomes increasingly difficult and critical. Existing jailbreaking evaluations often rely on static prompts, limited interaction horizons, or lightly protected systems, failing to reflect protected deployment settings with prompt-based safety protections. We show that the introduction of a prompt-based safety protection reduces the average attack success rate of a strong multi-turn baseline from 0.896 to 0.608 (32.1% relative), demonstrating that unprotected evaluations substantially overestimate real-world vulnerabilities. We propose Adaptive Traceback and Tactic Curation for Knowledge-based Red-teaming (ATTCK-R), a planning-driven multi-turn red teaming framework designed for protected black-box systems. ATTCK-R models jailbreaking as a long-horizon trajectory optimization problem using a structured belief state, introduces optimization-based tactic curation to abstract reusable strategies from prior successes and failures, and employs informed traceback to resume attacks from strategically meaningful states rather than restarting. Evaluated across 9 widely used LLMs configured with a single prompt-based safety protection layer, ATTCK-R consistently outperforms strong recent multi-turn jailbreaking frameworks. Ablation results confirm that long-horizon planning and tactic curation improve attack effectiveness, while adaptive traceback improves efficiency through structured recovery from conversational failure.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 33 of its 56 references that are in the map. First posted on arXiv 12 Oct 2026.
Builds on
33 of 56 references.
Closest ancestors · 12
Same direction, newest first
- 2025TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewards8 Dec
- 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections10 Oct
- 2025Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models9 Oct
- 2025Adversarial Attack on Large Language Models using Exponentiated Gradient Descent14 May
- 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents15 Apr
- 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models16 Feb
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
- 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
- 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
- 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul
Other references · 21
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
- 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,386
- 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2022Red Teaming Language Models with Language Modelscited by 1,026
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
- 2023Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunchcited by 694
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
9 more
- 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
- 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
- 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 77
- 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Testercited by 45
- 2024RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agentcited by 44
- 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 43
- 2025Multi-lingual Multi-turn Automated Red Teaming for LLMscited by 13
- 2025Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learningcited by 8
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization
- 2025Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning
- 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models
- 2025Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs
- 2025Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space
- 2025Defending Large Language Models Against Jailbreak Exploits with Responsible AI Considerations
- 2025RedTWIZ: Diverse LLM Red Teaming via Adaptive Attack Planning
- 2026SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration