Year: 2026
Type: conference-paper
Abstract: Multi-turn jailbreaking is a critical approach for evaluating the safety of large language models (LLMs).However, existing methods largely rely on heuristic strategies or trained attack agents, lacking a unified state-action formulation and systematic search over strategy compositions, and often struggling to balance attack success rate with query overhead.We propose RAMP, which formulates multi-turn jailbreaking as a risk-aware PDDL planning problem.Specifically, we characterize dialogue safety using predicate-based states, abstract common jailbreak strategies as high-level actions, and introduce a closed-loop framework that iteratively plans and executes each turn via a Judge, a Transitioner, and a Planner.Experimental results show that RAMP achieves consistently strong attack performance across both open-source and closed-source target models, while remaining effective under stricter turn budgets and yielding a favorable efficiencyeffectiveness trade-off.Ablation studies, interpretability analyses, and extended experiments further show that multi-step planning, clue accumulation, and consistent findings across evaluator settings are key factors underlying these gains.
Authors: Yize Liu, Yunyun Hou, Aina Sui
Institution: Communication University of China
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7166862841