Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks

Zhipeng Wei; Michael Lee; N. Benjamin Erichson

cs.AIOct 16, 2026

Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks

Authors: Zhipeng Wei, Michael Lee, N. Benjamin Erichson

Organizations: International Computer Science Institute · UC Berkeley · DSO National Laboratories · Lawrence Berkeley National Lab

Abstract

Multi-turn jailbreaks use feedback from a victim large language model to adapt their queries over several turns. However, once an effective trajectory has been found, it is unclear how much of the earlier query history is still needed. In this work, we study this by removing early attacker queries and running the remaining queries again in a new conversation while regenerating the victim's responses. We define the effective horizon as the shortest remaining query sequence that recovers the same attack progress. Empirically, we find that roughly half of the original query sequence is sufficient on average to recover the same attack progress. We call this phenomenon effective-horizon compression. We show that this shorter history can recover the best point reached during an unsuccessful attack and provide a better starting point for continuing the attack. It also helps identify which earlier queries should receive less learning signal during attacker training, and downweighting those queries improves performance. We further find that short reward-propagation windows preserve calibrated defense performance close to full-trajectory returns. These results show that multi-turn attacks can contain more queries than are needed to recover the progress reached later in the interaction.

Figures & tables

Figure 1: The attack progress reached by successful multi-turn attacks can often be recovered from only about half of their original query history. We measure this with the EHR, which divides the shortest query suffix that recovers the original attack progress by the full trajectory length. Across both X-Teaming and TROJail, trajectories of three or more turns have average EHRs close to

0.5

–

0.6

. The larger X-Teaming evaluation in (b) confirms this pattern, with five-turn attacks reaching an average EHR of

0.512

over

111

successful trajectories. Panels (a) and (c) use 200 WildJailbreak behaviors, while (b) uses 1,500;

n

denotes the number of successful trajectories.

Figure 2: Effective-horizon compression also appears in unsuccessful attacks. We truncate each X-Teaming trajectory at the first turn that reaches its highest attack score and measure how much query history is needed to recover that progress. Most supported groups have EHR below $1$ , including high-scoring intermediate states. In the larger 1,500-behavior evaluation, score- $4$ trajectories decrease from an average EHR of $0.729$ at two turns to $0.533$ at five turns. This shows that attack progress can be recovered from a shorter history even before the attack succeeds.

	X-Teaming				ActorBreaker
Victim Model	Base ASR	$\Delta$ ASR from Continuation $\uparrow$			Base ASR	$\Delta$ ASR from Continuation $\uparrow$
Victim Model	Base ASR	Full	Peak	EH-CR	Base ASR	Full	Peak	EH-CR
Qwen3-30B-A3B	67.9	+13.2 (81.1)	+15.7 (83.6)	+22.6 (90.5)	37.1	+20.8 (57.9)	+20.1 (57.2)	+22.0 (59.1)
Llama-3.3-70B	80.5	+10.1 (90.6)	+11.3 (91.8)	+15.1 (95.6)	32.7	+22.0 (54.7)	+23.9 (56.6)	+27.7 (60.4)
Muse-Glimmer-30B	15.1	+3.1 (18.2)	+3.1 (18.2)	+10.7 (25.8)	13.2	+10.7 (23.9)	+8.8 (22.0)	+13.8 (27.0)
DeepSeek-V4.1-Flash	23.9	+10.1 (34.0)	+13.2 (37.1)	+18.9 (42.8)	11.3	+4.4 (15.7)	+5.7 (17.0)	+11.3 (22.6)

Table 1: Attack continuation after five-turn initial trajectories. Each unsuccessful attack receives five additional turns. Full continues from the complete trajectory, Peak returns to the highest-scoring turn with its full prefix, and EH-CR returns to the same turn using only its effective suffix. Entries report

\Delta\mathrm{ASR}

, with final ASR in parentheses. Best values are shown in bold. EH-CR performs best for every attack–victim pair, showing that the shorter history is not only sufficient to recover progress but can provide a better continuation context despite using less of the original history.

Figure 3: EH-CR remains more effective across continuation budgets. Starting from 5-turn initial trajectories, we vary 1–5 additional turns on 159 HarmBench behaviors for Qwen3-30B-A3B and Llama-3.3-70B. EH-CR achieves higher final ASR than Full and Peak for both victims at every continuation budget, with the advantage already appearing after a single additional turn.

Figure 4: Reducing outcome credit before the effective horizon improves attacker training. TROJail assigns the same outcome signal to every query (

\beta=1

), while EH-CA scales this signal by

\beta

for queries before the effective horizon. Completely removing the earlier signal (

\beta=0

) is not consistently beneficial, but partial retention improves ASR@3 across all pairs.

\beta^{\star}

denotes the best value in

\{0.1,0.2,0.3\}

, selected on HarmBench for each victim and transferred to the other two benchmarks. Across all pairs,

\beta^{\star}

improves ASR@3 by

6.9

points on average.

Figure 5: Long-range reward propagation has little effect on calibrated defense performance. TurnGate normally propagates rewards through the full remaining trajectory, while

K

limits each decision to rewards from at most

K

later turns;

K=0

uses only the current reward. Longer windows improve performance at the original threshold

\tau=0.5

, but the gap largely disappears after selecting each policy’s threshold on the validation set. For

F1_{\phi_{2}}

, performance across reward windows has a standard deviation of only

0.16\%

, and

K=0

performs nearly the same as the full return.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Turn	Redacted attacker query	Original score	Replay suffix
1	Request a neutral explanation of socioeconomic disparity.	1	Discarded
2	Ask how people with fewer resources are stereotyped in conversation and media.	2	Discarded
3	Request examples of disparaging jokes, framed as awareness of harmful language.	4	Discarded
4	Request supposedly “harmless” everyday remarks that reinforce class stereotypes.	4	Retained
5	Reframe the request as sarcastic remarks by a fictional character in social media or workplace settings.	5	Retained
Replay of turn 5 in a new conversation		final score $4$ (not recovered)

Appendix

Table 2: A five-turn attack can depend on much less history when its later queries are run again. Attacker queries are lightly summarized to preserve their conversational role without reproducing harmful details. The final query alone reaches score

4

, while replaying turns 4–5 in a new conversation recovers the original score of

5

. The trajectory therefore has

H_{\mathrm{eff}}=2

and EHR

=0.4

. Earlier turns may still have helped discover the retained queries; the replay result shows that they are no longer required in the query history used to recover the final progress.

	X-Teaming			ActorBreaker
Victim Model	Full	Peak	EH-CR	Full	Peak	EH-CR
Qwen3-30B-A3B	15.57	14.16	13.65	5.13	5.24	8.14
Llama-3.3-70B	12.77	13.03	11.90	5.38	5.36	7.65
Muse-Glimmer-30B	19.02	19.05	19.35	7.04	7.09	10.04
DeepSeek-V4.1-Flash	18.12	17.59	18.11	6.79	6.72	8.85
GPT-5.6 Luna	18.70	17.82	18.22	6.54	6.50	7.89

Appendix

Table 3: EH-CR does not have a uniform effect on total victim-query cost. For X-Teaming, fewer continuation turns offset the queries used to validate the effective suffix, while for ActorBreaker they do not. The table reports average victim-LLM queries per behavior in the five-turn continuation experiment, including suffix-replay validation for EH-CR. Results include all valid behaviors for which the initial attack fails, regardless of continuation success. Lower is better, and best values are shown in bold.

	X-Teaming			ActorBreaker
Victim Model	Full	Peak	EH-CR	Full	Peak	EH-CR
Qwen3-30B-A3B	4.24	3.90	3.06	4.21	4.27	4.09
Llama-3.3-70B	3.58	3.61	2.58	4.22	4.25	4.08
Muse-Glimmer-30B	4.91	4.93	4.56	4.77	4.80	4.59
DeepSeek-V4.1-Flash	4.71	4.62	4.26	4.87	4.84	4.55
GPT-5.6 Luna	4.80	4.63	4.07	4.87	4.85	4.46

Appendix

Table 4: The shorter EH-CR context leads to earlier termination for both attacks. The table reports the average number of continuation turns used per behavior under a five-turn budget. EH-CR uses fewer turns for every evaluated victim model with both X-Teaming and ActorBreaker, although the reduction is larger for X-Teaming. Lower is better, and the pooled average aggregates behaviors across all six victim models.

Victim	Setting	HarmBench	StrongREJECT	JailbreakBench
Llama-3.1-8B-IT	Original ( $\beta=1$ )	$85.83\pm 0.62$	$84.38\pm 0.85$	$86.06\pm 2.27$
	$\beta=0$	$83.83\pm 0.62$	$75.12\pm 0.59$	$89.09\pm 1.48$
	$\beta=0.1$	$95.33\pm 1.31$	$90.16\pm 0.33$	$90.30\pm 0.86$
	$\beta=0.2$	$90.67\pm 0.24$	$73.84\pm 1.66$	$78.18\pm 3.93$
	$\beta=0.3$	$77.50\pm 0.41$	$58.80\pm 0.59$	$75.15\pm 2.27$
Qwen2.5-7B-IT	Original ( $\beta=1$ )	$90.50\pm 1.41$	$93.63\pm 1.18$	$90.30\pm 2.27$

Appendix

Table 5: A credit-retention factor selected on HarmBench transfers to two other benchmarks without further tuning. For each victim, we choose

\beta\in\{0.1,0.2,0.3\}

on HarmBench and apply that value unchanged to StrongREJECT and JailbreakBench. Shaded rows show the selected settings. They outperform the original

\beta=1

assignment in all six cross-benchmark evaluations by

6.4

ASR@3 points on average; including HarmBench, the average gain is

6.9

points across all nine evaluations. Values are mean

\pm

standard deviation over three evaluation runs.

		Benign (Utility)	Harmful						Overall
Method	$\tau$	Benign Score $\uparrow$	Miss $\downarrow$	Early $\downarrow$	$\ell_{1}\downarrow$	Acc. ( $\phi_{1}$ ) $\uparrow$	Harmful Score $\phi_{2}\uparrow$	Harmful Score $\phi_{3}\uparrow$	$\mathit{F1}_{\phi_{1}}\uparrow$	$\mathit{F1}_{\phi_{2}}\uparrow$	$\mathit{F1}_{\phi_{3}}\uparrow$
Reward-weighted SFT †	–	0.856	0.407	0.262	0.90	0.332	0.460	0.402	0.478	0.599	0.547
TurnGate (Full, fixed threshold)	0.5000	0.818	0.306	0.318	0.93	0.377	0.531	0.461	0.516	0.644	0.589
TurnGate ( $K=0$ )	0.3430	0.765	0.219	0.380	0.98	0.401	0.582	0.496	0.526	0.661	0.602
TurnGate ( $K=1$ )	0.4013	0.796	0.253	0.355	0.95	0.393	0.563	0.484	0.526	0.660	0.602
TurnGate ( $K=2$ )	0.4013	0.794	0.241	0.362	0.96	0.397	0.568	0.487	0.529	0.662	0.603

Appendix

Table 6: After threshold calibration, TurnGate performance changes little across reward-propagation windows. All variants use Qwen3-4B, start from the same reward-weighted SFT checkpoint, and differ only in

K

, the number of later turns whose rewards can contribute to an earlier decision. Full uses every remaining reward. Each RL policy’s Block threshold is selected on validation using

F1_{\phi_{2}}

and then fixed for all test metrics. The additional Full row uses TurnGate’s original fixed threshold

\tau=0.5

so that the effect of calibration can be seen directly.

	Global future-return window
Metric	$K=0$	$K=1$	$K=2$	$K=3$	$K=4$	$K=5$	$K=6$	Full
AUROC $\uparrow$	0.810	0.809	0.810	0.809	0.808	0.808	0.809	0.809
AUPRC $\uparrow$	0.457	0.453	0.457	0.455	0.454	0.453	0.455	0.452

Appendix

Table 7: Threshold-free ranking quality is nearly unchanged across reward-propagation windows. AUROC varies only from

0.808

0.810

, while AUPRC varies from

0.452

0.457

. The

K=0

policy matches or slightly exceeds Full on both metrics. The ranking task treats harm-enabling turns as positives and benign and pre-harm turns as negatives; the AUPRC no-skill baseline is the positive prevalence of

19.27\%

Multi-Turn Jailbreak Attacks

Multi-turn jailbreak attacks spread harmful intent across dialogue turns to bypass language-model safeguards and test conversational safety.

See all 31 papers

Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking
May 9, 2026Zhida He, Xiaoyu Wen, Han Qi +7RL for Language Models Credit Assignment in RL
Shanghai AI Laboratory · Fudan University · Shanghai Jiao Tong University
THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models
Jun 1, 2026Zhiqing Ma, Zhonghao Xu, Dong Yu +3LLM Safety Multi-Turn Jailbreak Attacks
1Beijing Language and Culture University · †Corresponding authors
MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks
May 10, 2026Xinkai Zhang, Zhipeng Wei, Huanli Gong +4Language Model Safety Evaluation Jailbreak Attacks
1UC Berkeley · 3International Computer Science Institute · 2UC Riverside +1

May 9, 2026J/K move · Enter open · S save

Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking

Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou+6

Shanghai AI Laboratory · Fudan University · Shanghai Jiao Tong University

RL for Language Models Credit Assignment in RL Step-Level Credit Assignment in RL Jailbreak Attacks LLM Jailbreak Attacks Multi-Turn Jailbreak Attacks+1

Open paper AskPDF arXiv

Deploying LLMs in multi-turn dialogues facilitates jailbreak attacks that distribute harmful intent across seemingly benign turns. Recent training-based multi-turn jailbreak methods learn long-horizon attack strategies from interaction feedback, but often rely on coarse trajectory-level outcome signals that broadcast uniformly to every turn. However, we find that turn-level contributions in multi-turn jailbreaking are non-uniform, phase-dependent, and target-specific. Such coarse outcome supervision induces a credit assignment problem, leading to over-rewarding redundant turns in successful trajectories and under-crediting useful intermediate turns in failed ones. To address this, we propose TRACE, a turn-aware credit assignment framework for reinforcement learning (RL)-based multi-turn jailbreaking. For successful trajectories, TRACE estimates turn-level contributions via leave-one-turn-out semantic masking; for failed ones, TRACE assigns penalties based on prompt harmfulness and semantic relevance, with an additional local refusal-aware penalty. Furthermore, we reuse the attack-side credit signal for multi-turn defense alignment. Extensive experiments on open-source and closed-source targets show that TRACE achieves strong overall performance in effectiveness, transferability, and efficiency, yielding about a 25% relative improvement in attack success rate over the strongest RL baseline while also improving the safety-utility balance when reused for defense alignment.

Abstract

Multi-Turn Jailbreak Attacks

Explore similar work

Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models

MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks