Research map / Large language models / Language, safety and interpretability

MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DC-GRPO, a turn-level credit assignment framework for GRPO that splits each turn's advantage into immediate and future credit, instantiated as static- and dynamic-weighted variants for training multi-turn jailbreak attackers.

Problem

Multi-turn jailbreak attacker training suffers from coarse credit assignment: standard GRPO broadcasts one trajectory-level advantage to every turn, conflating immediate progress with later-useful context.

Approach

Assign each turn a group-relative advantage that combines normalized immediate reward deviation and normalized future-return deviation, either with fixed weights (SW, alpha) or with rollout-statistic-derived weights (DW) that equal the z-score of the discounted return-to-go.

Key results

• MJ_DW achieves 98.26% average ASR_5@3 across four victim LLMs, versus SEMA 86.58% and TROJail 86.23%.
• MJ_SW (alpha=1) achieves 97.88% average ASR_5@3.
• On OOD victims with last-turn ASR@1, DW reaches 57.24 vs SEMA 43.94 average OOD.

Surprising findings

• Against GPT-OSS-20B, the SW vs DW ranking flips depending on the learning-rate scheduler horizon, indicating no uniform winner.
• Immediate-only credit (alpha=0) is clearly weaker than including future credit, but the best alpha is not stable across ID and OOD.

Limitations

• Longer contexts and interaction horizons not fully evaluated.
• SEMA baseline is a reproduction using Qwen3Guard and Qwen2.5-3B, not the original release.
• Baseline numbers taken from TROJail paper rather than re-run under identical settings.

Experimental setup

Datasets: AdvBench HarmBench StrongREJECT JailbreakBench

Benchmarks: HarmBench StrongREJECT (filtered) JailbreakBench (filtered)

Metrics: ASR_5@3 ASR_5@1 first-success turn

Baselines: ArtPrompt ReNeLLM AutoDAN-Turbo Jailbreak-R1 CoA ActorAttack Siren MTSA X-Teaming GOAT Crescendo TROJail

Builds on: GRPO SEMA TROJail MT-GRPO

Closest papers by meaning

• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.89)
• MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks (NeurIPS 2026 · similarity 0.89)
• Improved Techniques for Optimization-Based Jailbreaking on Large Language Models (ICLR 2025 · similarity 0.89)
• MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs (AAAI 2026 · similarity 0.88)
• Multi-Turn Jailbreaking Large Language Models via Attention Shifting (AAAI 2025 · similarity 0.88)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.87)