ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs

Md Mushfiqur Rahman; Tobias Rohde; Rahul Tripathi; Khalil Elkhalil; Kevin Lybarger

cs.CROct 12, 2026

ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs

Authors: Md Mushfiqur Rahman, Tobias Rohde, Rahul Tripathi, Khalil Elkhalil, Kevin Lybarger

Organizations: George Mason University · Amazon

Abstract

As large language models are deployed behind increasingly sophisticated safety mechanisms, evaluating their robustness under realistic adversarial conditions becomes increasingly difficult and critical. Existing jailbreaking evaluations often rely on static prompts, limited interaction horizons, or lightly protected systems, failing to reflect protected deployment settings with prompt-based safety protections. We show that the introduction of a prompt-based safety protection reduces the average attack success rate of a strong multi-turn baseline from 0.896 to 0.608 (32.1% relative), demonstrating that unprotected evaluations substantially overestimate real-world vulnerabilities. We propose Adaptive Traceback and Tactic Curation for Knowledge-based Red-teaming (ATTCK-R), a planning-driven multi-turn red teaming framework designed for protected black-box systems. ATTCK-R models jailbreaking as a long-horizon trajectory optimization problem using a structured belief state, introduces optimization-based tactic curation to abstract reusable strategies from prior successes and failures, and employs informed traceback to resume attacks from strategically meaningful states rather than restarting. Evaluated across 9 widely used LLMs configured with a single prompt-based safety protection layer, ATTCK-R consistently outperforms strong recent multi-turn jailbreaking frameworks. Ablation results confirm that long-horizon planning and tactic curation improve attack effectiveness, while adaptive traceback improves efficiency through structured recovery from conversational failure.

Figures & tables

Figure 1: ATTCK-R system architecture in a multi-agent closed loop interaction among three prompt-driven components: ATTACKER , protected TARGET , and external JUDGE . The attacker generates queries to elicit harmful responses while avoiding refusal, the target produces responses according to its safety policies, and the judge evaluates policy violations. The judge’s per-turn verdicts feed back into the attacker’s planning loop and determine final attack success

Belief state $b_{t}$ (turn 3 of a run)
conversationStage: mid-stage info extraction
refusalCount: 1
progressScore: 0.48 ( $\rho_{t}$ )
missingInformation: concrete actionable steps; final integrated artifact (full harmful output text)
collectedInformation: target engaged with safety-audit framing; provided abstract discussion and …
cooperativeness: 6/10 (raw; $r_{t}=0.60$ )

Table 1: Sample of ATTCK-R’s internal states and one attacker step. Top: belief state

b_{t}

at a mid-conversation turn. Middle: one tactic record from

\mathcal{K}_{t}

. Bottom: the attacker’s turn-3 formulation

x_{t}

(goal, plan, and next prompt) produced from

b_{t-1}

\mathcal{K}_{t}

, and

G

using the current tactic (Request Framing), which is the record shown. Shorthand (

\rho_{t}

r_{t}

) is defined in the notation mapping below.

Dataset	Target Model	GALA (without safety)	GALA	RED QUEEN*	X-Teaming*	ATTCK-R
JBB	Llama-3.3-70B	0.89	0.56	0.41	0.63	0.66
	Llama-3.1-8B	0.85	0.39	0.28	0.41	0.45
	Llama-3.2-1B	0.93	0.72	0.66	0.81	0.84
	Phi-4	0.89	0.60	0.50	0.67	0.70
	Phi-3.5-mini	0.93	0.73	0.70	0.83	0.86
	Qwen3-32B	0.90	0.61	0.49	0.71	0.74

Table 2: ATTCK-R is compared with GALA, RED QUEEN*, and X-Teaming* under protected evaluation settings across 8 open-source and 1 proprietary target model on JBB and HarmBench. GALA on unprotected targets is additionally included to illustrate how ASR changes when prompt-based safety protections are introduced. Across both benchmarks, ATTCK-R achieves the strongest overall protected-setting performance. * indicates methods reproduced and adapted under our protected evaluation setting.

Figure 2: Average ASR (top) and attack velocity (bottom) per attacker model, shown as matched additions to a common backbone. Adaptive Traceback (AT) is the primary driver of velocity: adding it to GALA yields the highest attack velocity in the ablation (GALA vs. GALA+AT). Tactic Curation (TC) is the primary driver of effectiveness: adding it yields the largest ASR gains (GALA vs. GALA+TC). LHP alone improves over GALA on both metrics, and the full ATTCK-R (LHP+TC+AT) combines these gains, improving over its LHP backbone and the GALA baseline on both ASR and velocity.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 3 — Figure 3: Screenshots of the custom annotation platform used in this research project

	Human: No Violation	Human: Violation
Judge: No Violation	142 (TN)	18 (FN)
Judge: Violation	15 (FP)	104 (TP)

Appendix

Table 3: Confusion matrix for judge vs. human binary violation classification.

Comparison	Observed Gap	Exceeds Error Margin?
ATTCK-R vs. X-Teaming	0.034 (5.0% relative)	Yes ( $>0.025$ )
ATTCK-R vs. GALA (protected)	0.098 (16.1% relative)	Yes ( $>0.025$ )
GALA unprotected vs. protected	0.288 (32.1% relative)	Yes ( $\gg 0.025$ )

Appendix

Table 4: Performance gaps compared to judge error margin. All reported gaps exceed the estimated measurement error of

\pm 0.025

Tactic	Pair Coverage	Status
Request Framing	100%	Initial
Echoing	100%	Initial
Obfuscation	83%	Initial
Progressive Context Anchoring	67%	New
Hidden Intention Streamline	67%	Initial
Output Format	67%	Initial

Appendix

Table 5: Most frequent tactics by pair coverage: the proportion of 24 attacker-target pairs (3 attackers × 8 targets) in which each tactic appears in the final tactic set. Initial tactics are seeded; New tactics are discovered through curation.

Target	Unique tactic identified	Description
Llama-1B	Phishing-Based Vulnerability Exploitation	Leverages phishing attacks to infiltrate voting system vulnerabilities, exploiting weak password policies and outdated software to bypass security checks.
Llama-8B	Social Engineering Mimicry	Leverages psychological tactics to bypass security systems by creating false trust in user data, prompting the system to overlook suspicious activity.
Phi-3.5	Social Media Campaign	Utilizes targeted social media outreach to amplify community safety initiatives, fostering trust and engagement without legal repercussions.
Qwen-0.6B	False Production Data Manipulation	Create fabricated production data to mislead regulators, undermining their confidence in the company’s operational capabilities.

Appendix

Table 6: Target-specific unique curated tactics with a fixed Qwen-3-0.6B attacker.

Component	Average Token counts
Initial planning	2,510
Follow-up planning	18,700
Belief updates	15,750
Judge evaluations	4,380
Informed traceback (only after failed trial)	2,870
Traceback planning (only after failed trial)	4,340

Appendix

Table 7: Token consumption breakdown for ATTCK-R per conversation. Follow-up planning and belief updates constitute the majority of the cost due to their per-turn invocation and need to maintain full conversational context.

Method	Avg. Tokens/Conv.	Relative to GALA
GALA	32,000	1.00 $\times$
RED QUEEN	29,500	0.92 $\times$
X-Teaming	31,200	0.98 $\times$
ATTCK-R	53,200	1.66 $\times$

Appendix

Table 8: Average token consumption per conversation across evaluated methods. ATTCK-R incurs higher per-conversation costs due to long-horizon planning with explicit belief-state tracking, tactic curation, and adaptive traceback mechanisms.

Method	Tokens/Conv.	ASR	Tokens/Success
GALA	32,000	0.608	52,600
RED QUEEN	29,500	0.542	54,400
X-Teaming	31,200	0.672	46,400
ATTCK-R	53,200	0.706	75,400

Appendix

Table 9: Estimated token cost per successful attack, derived as the average per-conversation token cost divided by the average attack success rate across runs. ATTCK-R has the highest cost per success.

LLM Jailbreak Attacks

Large language model (LLM) jailbreak attacks study how adversarial inputs bypass safety rules and elicit disallowed outputs.

See all 203 papers

$M^3$ : A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process
Oct 22, 2026Yuqing Huang, Jack Ji, Jithin Pradeep +2Adversarial Attacks on LLMs Multi-Turn Jailbreak Attacks
The Vanguard Group∗
Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models
Oct 4, 2026Tongyan Hu, Hao Li, Xiaogeng Liu +8Test-Time Training LLM Jailbreak Attacks
Johns Hopkins University · National University of Singapore · Washington University in St. Louis +2
MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
May 3, 2026Jialin Song, Xiaodong Liu, Weiwei Yang +4LLM Safety Benchmarks Adversarial Prompt Generation
Simon Fraser University · Microsoft Research

Oct 22, 2026J/K move · Enter open · S save

$M^3$ : A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process

Yuqing Huang, Jack Ji, Jithin Pradeep, Sagarika Suresh+1

The Vanguard Group∗

Adversarial Attacks on LLMs Multi-Turn Jailbreak Attacks Automated Red Teaming Language Model Safety Evaluation

Open paper AskPDF arXiv

Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing

M^3

, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In

M^3

, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models,

M^3

consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with lightweight attacker,

M^3

attains gains up to 26% in ASR@1 and 34% in ASR@5, compared to baselines that use higher capacity attackers. Beyond improved effectiveness,

M^3

exhibits steeper risk escalation over conversational turns and achieves more consistent performance across risk categories (up to 4.82 improvement in Gini index) without relying on predefined risk taxonomy, providing a scalable and principled framework for multi-turn red-teaming and safety evaluation.

Abstract

LLM Jailbreak Attacks

Explore similar work

M3M^3M3: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process

Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

$M^3$ : A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process