MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Technical Summary: MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety

Problem Statement
While aligning Large Language Models (LLMs) with human values is critical, adversarial "jailbreak" attacks remain a significant threat. Early research focused on single-turn prompts, but these fail to capture real-world adversarial behaviors where attackers iteratively refine intents across multi-turn conversations to bypass safety guardrails. Existing multi-turn benchmarks suffer from two primary limitations: (1) Limited Diversity, where deduplication of harmful intents drastically reduces the unique intent pool, failing to capture fine-grained safety issues; and (2) Scalability, where reliance on pre-designed templates or small-scale human red-teaming results in datasets that are too small to rigorously evaluate the robustness of diverse LLMs. Consequently, current benchmarks often yield inconsistent evaluations and miss subtle vulnerabilities that only emerge in complex conversational dynamics.

Methodology
The authors propose MultiBreak, a scalable and diverse multi-turn jailbreak benchmark constructed via an active learning framework. The construction process is framed as a pool-based active learning problem involving three core stages:

1. Data Diversification and Initialization:

   • The authors aggregate a large-scale pool of harmful intents from five existing multi-turn datasets and nine single-turn intent datasets.
   • A filtering process removes duplicates using semantic similarity (via Qwen3-0.6B embeddings) and eliminates "false positives" by evaluating against closed-source victim models to ensure high Attack Success Rates (ASR).
   • This yields an initial dataset of 2,201 multi-turn adversarial prompts (MTAPs) covering 3,010 unique harmful intents.

2. Iterative Active Learning Loop:

   • Generator Training: Instead of prompting, the authors employ Supervised Fine-Tuning (SFT) on attack generators (LLaMA3-8B, Qwen2.5-7B, and DeepSeek-Distill-Qwen-14B). Fine-tuning is chosen because it achieves significantly higher ASR than prompting and prevents safety-aligned models from refusing to generate harmful content when directly exposed to intents.
   • Acquisition Function: Generated prompts are evaluated against a set of victim models and judges. A composite acquisition function partitions outputs into three categories:
     • ACCEPT: High ASR and high faithfulness (semantic alignment with the original intent).
     • REWRITE: High uncertainty (disagreement among judges) but high faithfulness. These "borderline" samples are processed by an uncertainty-guided rewriter (Qwen2.5-7B) to clarify phrasing and strengthen the adversarial signal without altering the core intent.
     • DISCARD: Low ASR or low faithfulness.
   • Retraining: Accepted and successfully rewritten samples are added to the training set, and the generator is iteratively fine-tuned to produce stronger attack candidates.

3. Uncertainty-Guided Rewriting:

   • To recover valuable training signals from samples that succeed on some models but fail on others, a rewriter model clarifies ambiguous phrasing and strengthens persuasion tactics. This step consistently reduces judge uncertainty across iterations, converting borderline samples into reliable jailbreaks.

Key Contributions

• Scalable Active Learning Framework: A pipeline that iteratively fine-tunes attack generators and refines high-uncertainty samples, enabling efficient expansion of adversarial prompts while maintaining quality and diversity.
• Large-Scale, Diverse Benchmark (MultiBreak): The resulting dataset contains 10,389 multi-turn adversarial prompts spanning 2,665 unique harmful intents. It covers the broadest range of semantically distinct intents to date, with a diversity score of 0.942, significantly outperforming existing benchmarks like CoSafe, MHJ, SafeDialBench, and RedQueen.
• Fine-Grained Safety Insights: The benchmark reveals that diverse attack categories uncover specific LLM vulnerabilities. Notably, categories that appear benign or have low ASR in single-turn settings exhibit substantially higher adversarial effectiveness in multi-turn scenarios.

Experimental Results
Empirical evaluations across open-source (DeepSeek-R1-Distill-Qwen-7B, Qwen3-8B, LLaMA3.1-8B) and closed-source (GPT-4.1-mini, Gemini-2.5-flash-lite) models demonstrate:

• Superior Attack Success Rates (ASR): MultiBreak achieves up to 54.0% and 34.6% higher ASR than the second-best dataset on DeepSeek-R1-7B and GPT-4.1-mini, respectively.
• Robustness Across Models: The dataset maintains high effectiveness across different victim models and judges (LLaMA Guard and GPT-4o-mini), indicating strong generalization.
• Multi-Turn Advantage: Experiments show that increasing the number of turns transforms "benign" single-turn prompts into effective jailbreaks, with ASR gains of up to 44.8% for specific low-vulnerability categories when extended to six turns.
• Defense Limitations: Even with existing defense methods (e.g., X-Boundary, NBF-LLM), MultiBreak exposes persistent vulnerabilities, particularly in high-risk regulated advice and financial crime categories.

Significance
The paper positions MultiBreak as a critical resource for advancing LLM safety. It highlights that current safety evaluations are insufficient because they rely on static, single-turn, or template-heavy datasets that fail to reflect realistic adversarial settings. By demonstrating that multi-turn interactions expose fine-grained vulnerabilities not apparent in isolation, the authors argue for the necessity of scalable, diverse, and iterative evaluation frameworks. MultiBreak serves as a practical tool for identifying persistent safety gaps and guiding the development of more robust alignment strategies.