MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment

2026-07-13

AI Summary

This work addresses the credit assignment challenge in multi-turn jailbreaking attacks against large language models, where it is difficult to accurately assess the contribution of each dialogue turn to the ultimate attack success. To this end, the authors propose the Decomposed Credit GRPO (DC-GRPO) framework, which introduces, for the first time, a turn-level grouped relative credit assignment mechanism into jailbreaking attacks. By integrating static and dynamic weighting strategies to combine immediate and future rewards, DC-GRPO enables fine-grained credit allocation and overcomes the misattribution issues inherent in conventional trajectory-level single-reward approaches. Experimental results demonstrate that DC-GRPO significantly outperforms existing methods across multiple mainstream large language models and benchmarks, achieving ASR5@3 success rates of 98.26% and 97.88% for its dynamic and static variants, respectively.

Abstract

Modern large language models (LLMs) operate in interactive multi-turn settings, making multi-turn jailbreaking a realistic threat model and an important setting for automated red teaming. A core challenge in learning multi-turn jailbreak attackers is credit assignment: different turns contribute differently to the final outcome, yet existing learning signals are often too coarse to identify their individual contributions. We propose decomposed credit GRPO (DC-GRPO), a unified turn-level credit assignment framework for Group Relative Policy Optimization in multi-turn jailbreak learning. DC-GRPO assigns a separate group-relative learning signal to each turn by combining immediate and future credit, avoiding the credit misassignment induced by broadcasting a single trajectory-level score across the dialogue. We instantiate this framework with static and dynamic weighting rules that differ in how the two credit sources are balanced while sharing the same turn-level structure. Across multiple victim LLMs and benchmarks, the dynamic- and static-weighted variants achieve average ASR5@3 scores of 98.26% and 97.88%, respectively, substantially outperforming the state-of-the-art methods, including SEMA (86.58%) and TROJail (86.23%). Their consistently strong performance indicates that the central empirical benefit comes from turn-level group-relative credit assignment rather than a particular weighting rule. Warning: This paper contains examples of harmful content.

Problem

• multi-turn jailbreaking
• credit assignment
• large language models
• automated red teaming
• turn-level evaluation

Innovation

• multi-turn jailbreaking
• credit assignment
• group relative policy optimization
• DC-GRPO
• automated red teaming