REVIEW 12 cited by
X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Multi-turn interactions with language models (LMs) pose critical safety risks, as harmful intent can be strategically spread across exchanges. Yet, the vast majority of prior work has focused on single-turn safety, while adaptability and diversity remain among the key challenges of multi-turn red-teaming. To address these challenges, we present X-Teaming, a scalable framework that systematically explores how seemingly harmless interactions escalate into harmful outcomes and generates corresponding attack scenarios. X-Teaming employs collaborative agents for planning, attack optimization, and verification, achieving state-of-the-art multi-turn jailbreak effectiveness and diversity with success rates up to 98.1% across representative leading open-weight and closed-source models. In particular, X-Teaming achieves a 96.2% attack success rate against the latest Claude 3.7 Sonnet model, which has been considered nearly immune to single-turn attacks. Building on X-Teaming, we introduce XGuard-Train, an open-source multi-turn safety training dataset that is 20x larger than the previous best resource, comprising 30K interactive jailbreaks, designed to enable robust multi-turn safety alignment for LMs. Our work offers essential tools and insights for mitigating sophisticated conversational attacks, advancing the multi-turn safety of LMs.
Forward citations
Cited by 12 Pith papers
-
SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks
Multi-turn LLM jailbreaks succeed based on how harmful intent is organized across turns, not on interaction length, and detection should shift to session and cross-session scope.
-
Do LLMs Know Their Vulnerable Scenarios?
Scenario jailbreaks suppress refusal via internal concept directions; Concept2Scenario attributes those concepts with SAEs and turns them into transferable natural-language attack scenarios.
-
Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Models
Online self-play between attacker and defender roles of a single LLM improves safety robustness and attack diversity across Llama and Qwen models.
-
AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation
A phase-structured multi-turn red-team framework reports 97.6–100% lenient ASR but only 66.7–78.6% full actionable ASR on six frontier LLMs, with success strongly depth-dependent.
-
Robust Critics: Defending LLMs Against Multi-Turn Attacks
Critic-weighted sampling over inferred user intents improves multi-turn LLM defense success while preserving helpfulness, with an expected-Q improvement guarantee and transfer to frontier models.
-
Reasoning Up the Instruction Ladder for Controllable Language Models
RLVR on ~7K verifiable system/user conflict examples teaches LLMs to prioritize higher-priority instructions, improving instruction-hierarchy and safety benchmarks.
-
SafeWork-R1: Coevolving Safety and Intelligence under the AI-45$^{\circ}$ Law
SafeWork-R1 shows that a staged RL pipeline with safety, value, and knowledge verifiers can improve both safety and general reasoning scores over a base multimodal model.
-
Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation
Test-time retrieval of committee-disagreement-mined synthetic images cuts a safety classifier's false-negative rate on a hard HoliSafe subset from 41.2% to 24.5%.
-
SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues
STREAM fine-tunes a small reasoning model on human-labeled, reason-annotated multi-turn dialogues and uses it to warn target LLMs, cutting average attack success rates by roughly half while keeping benchmark scores close.
-
A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination
A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...
-
Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks
CoopGuard's defer-tempt-analyze-coordinate agents cut reported jailbreak success and raise attacker token costs on the new EMRA benchmark, but the deceptive-rate metric is partly defined by the paper's own scoring rubric.
-
Securing Generative AI Agentic Workflows: Risks, Mitigation, and a Proposed Firewall Architecture
A draft proposal for a centralized GenAI security firewall, with unsupported quantitative claims and no implemented or evaluated system.
Discussion (0). Continue with ORCID to comment.