Multi-turn jailbreaks exhibit effective horizon compression
Start here
An arXiv paper proposes the concept of "effective horizon" in multi-turn jailbreaks: after deleting early attack queries, rerunning the remaining queries in a new conversation and regenerating model responses, on average about half of the original query sequence suffices to recover the same attack progress, which the authors call effective horizon compression. The study states that this shorter history can recover the best point reached in unsuccessful attacks, providing a better starting point for continuing the attack; the result can also be used to identify which early queries should receive less learning signal in attacker training, and downweighting them improves performance, while a shorter reward propagation window can also maintain calibration defense performance close to that of the full trajectory.
Generated by AI from reports · Updated 25 days ago
Attention and developments
Attention, hourly
Now 32, 0% in 24 hours·Peak 32 (Nov 6 04:00)
Related research
This event's paper
- Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks
arXiv · 2026-10-16 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesMulti-turn short horizon: measuring effective horizon compression in jailbreaks
Researchers propose the concept of "effective horizon" in multi-turn jailbreaks. By deleting early attack queries and rerunning the remaining queries in a new conversation, regenerating model replies, they find that on average about half of the original query sequence is sufficient to recover the same attack progress. The authors call this phenomenon effective horizon compression, and state that this shorter history can recover the best point reached in unsuccessful attacks, providing a better starting point for continuing the attack. The results can also be used to identify which early queries should receive less learning signal in attacker training; down-weighting them improves performance; a shorter reward propagation window also maintains calibrated defense performance close to that of full trajectories.