Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking

Researchers propose TRACE, a credit assignment framework that improves multi-turn jailbreak attacks on large language models by identifying which dialogue turns actually contribute to harmful outcomes. The method achieves 25% higher attack success rates than existing approaches and can be repurposed to strengthen AI safety defenses.

This research addresses a fundamental technical challenge in adversarial AI: understanding which components of complex attack sequences deserve credit for success. Traditional reinforcement learning methods treat entire conversation chains as atomic units, rewarding or penalizing all turns equally regardless of their actual contribution. TRACE introduces turn-level granularity through semantic masking and harmfulness scoring, enabling more precise signal assignment during training. The work sits at an intersection of AI safety research that benefits both offensive and defensive applications—the same credit signals used to optimize attacks can strengthen defenses by identifying vulnerability patterns.

The broader context reveals an escalating arms race around multi-turn jailbreaking techniques. As single-prompt safeguards improve, adversaries distribute malicious intent across seemingly innocent dialogue exchanges, exploiting sequential reasoning patterns that safety training may not adequately address. This research formalizes what practitioners have observed empirically: not all conversational turns equally enable jailbreaks, yet current training methods lack the sophistication to distinguish productive manipulation from noise.

For the AI safety industry, this carries dual implications. Negatively, TRACE demonstrates that attack methodologies are becoming more efficient and transferable across models. Positively, the framework's applicability to defense alignment suggests a pathway for building more robust systems through adversarial understanding. Organizations deploying conversational LLMs should view this as evidence that turn-level monitoring and safety mechanisms may be necessary complements to existing prompt-level defenses. The 25% effectiveness improvement underscores how technical sophistication in attack design continues outpacing generic safety measures.

• →TRACE framework achieves 25% relative improvement in multi-turn jailbreak success by assigning credit at individual dialogue turn granularity rather than trajectory level.
• →The research identifies that different turns contribute non-uniformly to jailbreak success depending on attack phase and target model characteristics.
• →Credit assignment signals from attacks can be reused to improve multi-turn defense alignment and safety training.
• →Multi-turn attack distribution represents an evolving vulnerability that single-prompt safeguards alone cannot adequately address.
• →The work formalizes technical methods for analyzing which conversational components enable adversarial success against LLMs.