ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs

Summary

ATTCK-R is a multi-turn red-teaming framework for protected black-box LLM systems. The authors show that adding a prompt-based safety protection reduces a strong multi-turn baseline's average attack success rate from 0.896 to 0.608 (32.1% relative), indicating that unprotected evaluations overestimate real-world vulnerability. Across 9 LLMs with a single prompt-based protection layer, ATTCK-R consistently outperforms recent multi-turn jailbreaking frameworks.

Topics

• Prompt injection and jailbreaks

Related items

• InfoDeveloping Gemini 4 Argon responsibly and safelySimilar attack · DeepMind Safety Research
• InfoRethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget SelectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoTop GenAI security resources — October 2026Similar attack · Adversa AI Blog
• InfoSame Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety ClassifiersSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoThe Tokens Strike Back: Safety-Aware Denoising with Directional Embedding-based RevisionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)