Protected large language models face smarter long-term jailbreaking attacks
ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs
Cryptography and SecurityComputation and Language
Summary
As safety measures improve for large language models (LLMs), it becomes harder to find ways to trick them into doing harmful things. The authors show that current tests underestimate how well these protections work because they don’t simulate realistic, ongoing attacks well. They created a new approach called ATTCK-R that plans multi-step attacks in a smarter way to test these protections more rigorously. This method can find weaknesses better by learning from past tries and resuming attacks without starting over.
What this means in practice
- •For ai safety teams: Evaluate and improve prompt-based safety methods for deployed LLMs using long-horizon, multi-turn adversarial testing.
- •For security analysts: Analyze and simulate advanced multi-step jailbreaking tactics on protected AI systems to identify potential vulnerabilities.
Authors
Md Mushfiqur Rahman, Tobias Rohde, Rahul Tripathi, Khalil Elkhalil, Kevin Lybarger
Abstract
As large language models are deployed behind increasingly sophisticated safety mechanisms, evaluating their robustness under realistic adversarial conditions becomes increasingly difficult and critical. Existing jailbreaking evaluations often rely on static prompts, limited interaction horizons, or lightly protected systems, failing to reflect protected deployment settings with prompt-based safety protections. We show that the introduction of a prompt-based safety protection reduces the average attack success rate of a strong multi-turn baseline from 0.896 to 0.608 (32.1\% relative), demonstrating that unprotected evaluations substantially overestimate real-world vulnerabilities. We propose Adaptive Traceback and Tactic Curation for Knowledge-based Red-teaming (ATTCK-R), a planning-driven multi-turn red teaming framework designed for protected black-box systems. ATTCK-R models jailbreaking as a long-horizon trajectory optimization problem using a structured belief state, introduces optimization-based tactic curation to abstract reusable strategies from prior successes and failures, and employs informed traceback to resume attacks from strategically meaningful states rather than restarting. Evaluated across 9 widely used LLMs configured with a single prompt-based safety protection layer, ATTCK-R consistently outperforms strong recent multi-turn jailbreaking frameworks. Ablation results confirm that long-horizon planning and tactic curation improve attack effectiveness, while adaptive traceback improves efficiency through structured recovery from conversational failure.