ATTCK-R: A Long-Range Jailbreak Framework for Protected LLMs
Start here
The researchers propose a multi-turn red-teaming framework, ATTCK-R, for jailbreak testing on black-box systems equipped with prompt-based safety defenses. The paper reports that after adding a layer of prompt-based safety defense, a strong multi-turn baseline's average attack success rate drops from 0.896 to 0.608, a relative decrease of 32.1%, indicating that evaluations without defenses significantly overestimate real-world deployment vulnerabilities. ATTCK-R models jailbreaking as a long-horizon trajectory optimization problem, uses a structured belief state, distills reusable strategies from past successes and failures via optimization-based strategy screening, and uses informed backtracking to continue attacks from strategically meaningful states rather than restarting.
Generated by AI from reports · Updated 29 days ago
Attention and developments
Attention, hourly
Now 33, 0% in 24 hours·Peak 33 (Nov 6 04:00)
Related research
This event's paper
- ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs
arXiv · 2026-10-12 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesATTCK-R: A Knowledge-Aware Long-Horizon Jailbreak Framework for Protected LLMs
The researchers propose a multi-turn red-teaming framework ATTCK-R for conducting jailbreak tests on black-box systems equipped with prompt-based safety defenses. The paper reports that after introducing a layer of prompt-based safety defense, the average attack success rate of a strong multi-turn baseline drops from 0.896 to 0.608, a relative decrease of 32.1%, indicating that evaluations without defenses significantly overestimate vulnerability in real deployments. ATTCK-R models jailbreaking as a long-horizon trajectory optimization problem, uses structured belief states, distills reusable strategies from past successes and failures through optimization-based strategy screening, and uses informed backtracking to continue attacks from strategically meaningful states rather than restarting. Across 9 common LLMs configured with a single layer of prompt-based safety defense, ATTCK-R consistently outperforms recent strong multi-turn jailbreak frameworks. Ablation results show that long-horizon planning and strategy screening improve attack effectiveness, while adaptive backtracking improves efficiency by structurally recovering from conversation failures.