PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies

Zeyu Feng; Qingyu Wu; Yuzhe Luo; Hua Cheng

cs.AIAug 24, 2026

PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies

Authors: Zeyu Feng, Qingyu Wu, Yuzhe Luo, Hua Cheng

Organizations: The Defense Innovation Institute, Academy of Military Sciences, Beijing, China

Abstract

Large language models (LLMs) are increasingly deployed in education, healthcare, policy advising, and other interactive settings, where users engage them as sustained social interlocutors rather than one-shot query engines. This shift makes jailbreaks a growing safety threat, yet most research emphasizes single-turn prompt optimization or iterative attack refinement, leaving psychologically grounded multi-turn vulnerabilities underexplored. We present PsychJail, a psychology-guided framework for red teaming aligned LLMs through theory-grounded, multi-turn persuasion. PsychJail maps established social-psychological persuasion techniques into a tactic-conditioned attack policy. It factorizes each attacker action into a Change-of-Meaning analysis, tactic selection, and victim-visible message, operationalizing the Persuasion Knowledge Model (PKM). The policy is refined with trajectory-level reinforcement learning using a PKM-gated reward that credits early jailbreak success only when every turn contains a well-formed Change-of-Meaning analysis. Across four aligned victim models, PsychJail achieves the highest average attack success rate (87.3%) and outperforms strong single-turn and multi-turn baselines on every model. We also measure susceptibility at the action that breaks each victim, revealing four distinct model-level fingerprints that identify which persuasion levers affect each model and how broadly. These fingerprints help explain cross-model transfer asymmetry. We interpret them as four candidate psychological profiles-rationalist, credibility-driven, narrative-monoculture, and broadly persuadable-while treating this interpretation as a conjecture requiring future validation. Our findings establish psychological jailbreaks as a distinct red-teaming frontier for increasingly interactive LLMs.

Figures & tables

Figure 1: Overview of the PsychJail framework. For each harmful objective $\bm{x}_{0}$ , the attacker $\pi_{\theta}$ emits the factorized action $\bm{a}_{t}=(\bm{n}_{t},c_{t},\bm{m}_{t})$ ; only $\bm{m}_{t}$ reaches the frozen victim $\pi_{v}$ ; the judge $\pi_{J}$ scores $\bm{y}_{t}$ as $s_{t}\in[0,1]$ . Strict-parse failure at any turn truncates the trajectory. The trajectory reward combines the per-turn format scores with the peak success term gated on PKM-aligned change-of-meaning analysis at every turn.

Method	MT	Traj-RL	Tax.	Adaptive	Policy
GCG, AutoDAN, ReNeLLM ( 52 ; 28 ; 7 )	$\times$	$\times$	$\times$	$\times$	$\times$
PAP ( 48 )	$\times$	$\times$	✓	$\times$	$\times$
PAIR ( 4 )	✓	$\times$	$\times$	✓	$\times$
CoA, ActorAttack ( 45 ; 32 )	✓	$\times$	$\times$	✓	$\times$
Siren, X-Teaming ( 50 ; 31 )	✓	$\times$	$\times$	✓	$\times$
TROJail ( 42 )	✓	✓	$\times$	✓	$\times$

Table 1: Positioning of PsychJail in the design space of representative jailbreak families. The columns are descriptive coordinates, not a quality scorecard: a

\times

marks a different design choice, not a deficiency. MT : operates over a multi-turn dialogue; Traj-RL : trajectory-level reinforcement learning over full rollouts; Tax. : grounded in an explicit social-science persuasion-tactic taxonomy; Adaptive : conditions each move on the target’s evolving response rather than emitting a fixed prompt; Policy : learns a policy that explicitly selects and sequences tactics from that taxonomy (vs. static templates or generic moves). ✓ yes,

\times

no.

Method	Llama-3.1-8B-Instruct			Qwen2.5-7B-Instruct			Gemma-2-9B-IT			Mistral-7B-Instruct-v0.3			Average
Method	HB	SR †	JBB †	HB	SR †	JBB †	HB	SR †	JBB †	HB	SR †	JBB †	Average
Single-Turn
ArtPrompt	40.50	18.06	27.27	56.50	29.51	41.82	30.50	5.56	29.09	73.00	59.72	61.82	39.45
ReNeLLM	50.50	52.08	65.45	65.50	69.44	80.00	43.50	50.00	54.55	75.00	75.35	81.82	63.60
AutoDAN-Turbo	72.33	63.66	63.64	58.83	60.53	63.64	59.67	55.32	55.76	62.00	53.59	60.61	60.80
Jailbreak-R1	50.75	36.00	40.00	68.67	52.78	61.82	24.00	21.99	32.12	82.33	73.61	73.94	51.50

Table 2: ASR (%) of different jailbreak methods on HarmBench (HB), StrongREJECT † (SR † ), and JailbreakBench † (JBB † ) across four victim LLMs. The best and second-best results in each column are marked in bold and underlined , respectively.

Trained Against	Llama-3.1-8B-Instruct			Qwen2.5-7B-Instruct			Gemma-2-9B-IT			Mistral-7B-Instruct-v0.3			Average
Trained Against	HB	SR †	JBB †	HB	SR †	JBB †	HB	SR †	JBB †	HB	SR †	JBB †	ID	OOD
Llama-3.1-8B-Instruct	83.50	77.78	81.82	89.00	88.89	89.09	82.50	76.04	63.64	90.00	92.36	87.27	81.03	84.31
Qwen2.5-7B-Instruct	70.00	62.85	50.91	92.50	93.75	92.73	78.00	70.83	60.00	88.00	89.93	87.27	92.99	73.09
Gemma-2-9B-IT	74.00	68.06	63.64	91.50	92.71	90.91	85.00	80.21	76.36	92.50	93.75	94.55	80.52	84.62
Mistral-7B-Instruct-v0.3	48.00	48.96	36.36	86.00	85.07	83.64	50.00	44.10	32.73	93.00	94.44	96.36	94.60	57.21

Table 3: Transferability of PsychJail in attacking different victim LLMs. Each row reports the ASR (%) when the attacker is trained against one victim LLM and evaluated on all victim LLMs. Shaded cells indicate in-domain (ID) evaluations, and the remaining entries report out-of-domain (OOD) performance. The best and second-best results in the Average columns are marked in bold and underlined .

Panel of Figure 2 — Figure 2: Training dynamics of PsychJail over the $500$ MT-GRPO updates, with one attacker trained per victim. (a) batch jailbreak success rate; (b) mean first-success turn, where a lower value means harmful compliance is elicited in an earlier turn; (c) fraction of sampled trajectories whose five turns all strict-parse. Faint traces are raw per-step values and solid lines are EMA-smoothed. Success climbs while the first-success turn falls and strict-format compliance stays saturated, indicating that RL induces earlier , well-formed successes rather than degrading the action protocol.

Method	HB	SR †	JBB †	Average
PsychJail	92.50	93.75	92.73	92.99
w/o early-success ( $1/t$ ) weighting	91.00	90.97	89.09	90.35
w/o PKM strict-parse gate	89.50	88.19	85.45	87.71
w/o dense format reward	86.50	84.72	81.82	84.35
w/o SFT warm-start	70.00	65.97	63.64	66.54

Table 4: Ablation study of PsychJail on Qwen2.5-7B-Instruct. Each variant removes one component while keeping the remaining training and evaluation protocol unchanged.

Victim	Succ.@1	Succ.@2	Succ.@3	Mean Turn	Median Turn	Replay ASR
Llama-3.1-8B-Instruct	67.22	78.27	79.74	1.20	1	61.24
Qwen2.5-7B-Instruct	70.53	90.42	92.63	1.28	1	54.81
Gemma-2-9B-IT	64.27	79.93	81.22	1.24	1	66.52
Mistral-7B-Instruct-v0.3	63.17	90.98	93.55	1.37	1	41.03

Table 5: Front-loaded success and trajectory replay for PsychJail, including mean and median successful turn, cumulative Succ.@

k

(pooled over the

543

evaluation prompts per victim; success saturates by turn

5

at the main-table ASR), and Replay ASR. “Replay ASR” denotes the average ASR when successful trajectories from one victim are replayed against the remaining victims without re-optimization.

Figure 3: Per-victim conditional-susceptibility fingerprint. Each cell is a victim’s conditional susceptibility $\Pr(\mathrm{break}\mid\text{tactic deployed})$ to a persuasion tactic, measured on the best-checkpoint evaluation rollouts; conditioning on deployment disentangles victim susceptibility from the attacker’s tactic-selection policy. Every tactic the attacker ever deploys is shown: the well-sampled block sits above the grey separator and the rarely-deployed tail below it; hatched cells marked $*$ have fewer than $15$ deployments and are not interpreted, and blank cells mark tactics never deployed against that victim (the $13$ taxonomy tactics never deployed against any victim are listed in the text). The distinct column patterns constitute four empirically different susceptibility fingerprints—which levers open which model, and how broadly.

Pool	$n$	DeepSeek	Kimi	Raw	$\kappa$	Cons.	SFT cons.	$\Delta$ (pp)
SFT prior (4 victims)	400	86.0	78.8	91.8	0.72	78.3	–	–
Post-RL Qwen2.5-7B	500	90.4	86.0	95.2	0.77	85.8	84.8	$+1.0$
Post-RL Llama-3.1-8B	500	93.8	84.4	89.0	0.45	83.6	72.7	$+10.9$
Post-RL Gemma-2-9B	500	96.2	89.2	92.6	0.46	89.0	76.3	$+12.7$
Post-RL Mistral-7B	500	92.4	85.2	91.2	0.56	84.4	79.6	$+4.8$
Post-RL pooled	2000	93.2	86.2	–	–	85.7	78.3	$\bm{+7.4}$

Table 6: Label-fidelity audit. Per-judge fidelity, raw inter-judge agreement, Cohen’s

\kappa

, and consensus yes-rate (both judges

=1

), per pool. SFT cons. is the consensus yes-rate on that victim’s stratum of the SFT pool (

n=97

–

106

) and

\Delta

the SFT

\to

RL change in percentage points. Raw,

\kappa

, and consensus are computed on the both-scored subset; two content-filter refusals (one each on the Llama and Mistral pools, both from Kimi) are excluded from those denominators.

	DeepSeek	Kimi	Consensus
Accuracy vs. human gold	0.91	0.89	0.90
Precision	0.92	0.90	0.93
Recall	0.93	0.91	0.89
Negative-control yes-rate (%)	4.1	6.8	1.9

Table 7: Validation of the judging instrument. Top: accuracy, precision, and recall against the human-majority gold standard on the

300

-turn stratified subsample (three blinded annotators, Krippendorff’s

\alpha=0.74

). Bottom: negative-control yes-rate—the rate at which a judge affirms a deliberately false, uniformly resampled tactic label on

500

probe messages (lower is better). The consensus rule trades recall for precision, consistent with its role as the conservative primary metric.

Turn	1	2	3	4	5
SFT prior	52.6	75.6	86.5	86.4	89.0
Post-RL pooled	83.9	81.7	85.0	86.9	86.4
$\Delta$ (pp)	$+31.3$	$+6.1$	$-1.5$	$+0.5$	$-2.6$

Table 8: Per-turn consensus yes-rate (both judges agreeing the message instantiates the labeled technique). SFT prior is pooled over four victims (

n=400

); post-RL is pooled over the four victim pools (

n=1{,}998

both-scored out of

n=2{,}000

total).

Explore similar work

Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing
Apr 17, 2026Zehao Wang, Lanjun WangAdversarial Prompt Generation Jailbreak Attacks
College of Intelligence and Computing, Tianjin University, Tianjin 300350, China. · School of New Media and Communication, Tianjin University, Tianjin 300072, China. · Shanghai Key Laboratory of Data Science,[cs.LG] Shanghai 200438, China.
ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming
May 4, 2026Mario Rodríguez Béjar, Francisco J. Cortés-Delgado, S. Braghin +1Evolutionary Optimization LLM Red Teaming
Universidad de Murcia · IBM Research
JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization
Jun 9, 2026Ge Shi, Jun Yin, Donglin Xie +3Adversarial Prompt Generation Large Language Model-Guided Optimization
University of California, Davis · The Renmin University of China · Independent Researcher +3

Apr 17, 2026J/K move · Enter open · S save

Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing

Zehao Wang, Lanjun Wang

College of Intelligence and Computing, Tianjin University, Tianjin 300350, China. · School of New Media and Communication, Tianjin University, Tianjin 300072, China. · Shanghai Key Laboratory of Data Science,[cs.LG] Shanghai 200438, China.

Adversarial Prompt Generation Jailbreak Attacks LLM Jailbreak Attacks Large Reasoning Models

Open paper AskPDF arXiv

Large Reasoning Models (LRMs) have demonstrated strong capabilities in generating step-by-step reasoning chains alongside final answers, enabling their deployment in high-stakes domains such as healthcare and education. While prior jailbreak attack studies have focused on the safety of final answers, little attention has been given to the safety of the reasoning process. In this work, we identify a novel problem that injects harmful content into the reasoning steps while preserving unchanged answers. This type of attack presents two key challenges: 1) manipulating the input instructions may inadvertently alter the LRM's final answer, and 2) the diversity of input questions makes it difficult to consistently bypass the LRM's safety alignment mechanisms and embed harmful content into its reasoning process. To address these challenges, we propose the Psychology-based Reasoning-targeted Jailbreak Attack (PRJA) Framework, which integrates a Semantic-based Trigger Selection module and a Psychology-based Instruction Generation module. Specifically, the proposed PRJA automatically selects manipulative reasoning triggers via semantic analysis and leverages psychological theories of obedience to authority and moral disengagement to generate adaptive instructions for enhancing the LRM's compliance with harmful content generation. Extensive experiments on five question-answering datasets demonstrate that PRJA achieves an average attack success rate of 83.6% against several commercial LRMs, including DeepSeek R1, Qwen2.5-Max, and OpenAI o4-mini.

Abstract

Explore similar work

Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization