PaperlayerView exact revision on arXiv

Source-linked AI summary

X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents

Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, Saadia Gabriel

arXiv:2504.13203v2cs.CRcs.AIcs.CLcs.LGcs.MA

TL;DR

Multi-turn attacks can distribute harmful intent across exchanges, a safety challenge that remains less explored than single-turn safety. X-Teaming uses collaborative agents to plan, execute, evaluate, and optimize attacks, reporting state-of-the-art multi-turn attack effectiveness and diversity with success rates up to 98.1% across leading open-weight and closed-source models.

  • Problem

    Multi-turn safety remains underexplored relative to single-turn safety, while distributing malicious intent across exchanges creates a pressing challenge for detection and prevention.

    Source: §1 · p. 1

  • Method

    X-Teaming uses collaborative agents to plan and adapt attack strategies, execute dynamic conversations, evaluate effectiveness, and optimize unsuccessful attempts.

    Source: §1 · p. 2, §2 · p. 3

  • Results

    98.1% ASR across representative leading closed-source and open-weight LMs under HarmBench; X-Teaming also exhibits high diversity in attack planning and execution.

    Source: §1 · p. 2, §6 · p. 10

  • Takeaways & Limitations

    34.2% average improvement in multi-turn attack resistance was observed for models fine-tuned on XGuard-Train compared with those trained on SafeMTData.

    Source: §1 · p. 3

    The authors acknowledge that X-Teaming and XGuard-Train are dual-use and their multi-turn attack methodologies could potentially be misused.

    Source: Ethics Statement · p. 11

Abstract

from arXiv · show

Multi-turn interactions with language models (LMs) pose critical safety risks, as harmful intent can be strategically spread across exchanges. Yet, the vast majority of prior work has focused on single-turn safety, while adaptability and diversity remain among the key challenges of multi-turn red-teaming. To address these challenges, we present X-Teaming, a scalable framework that systematically explores how seemingly harmless interactions escalate into harmful outcomes and generates corresponding attack scenarios. X-Teaming employs collaborative agents for planning, attack optimization, and verification, achieving state-of-the-art multi-turn jailbreak effectiveness and diversity with success rates up to 98.1% across representative leading open-weight and closed-source models. In particular, X-Teaming achieves a 96.2% attack success rate against the latest Claude 3.7 Sonnet model, which has been considered nearly immune to single-turn attacks. Building on X-Teaming, we introduce XGuard-Train, an open-source multi-turn safety training dataset that is 20x larger than the previous best resource, comprising 30K interactive jailbreaks, designed to enable robust multi-turn safety alignment for LMs. Our work offers essential tools and insights for mitigating sophisticated conversational attacks, advancing the multi-turn safety of LMs.

1 Introduction

X-Teaming targets the unresolved risk of harmful intent distributed across conversation turns with a collaborative, adaptive red-teaming framework. The introduction reports high jailbreak effectiveness and diversity and introduces XGuard-Train as a large-scale safety-training resource.

1 Introduction

  • Single-turn safety has received substantial attention and can mitigate harmful intent within one prompt, but systems struggle to detect and prevent malicious intent distributed across multiple exchanges.Source: §1 · p. 1
  • X-Teaming uses Planner, Attacker, Verifier, and Prompt Optimizer agents to devise and revise plans, execute adaptive jailbreaks, evaluate effectiveness, and optimize prompts when facing refusals.Figure 1 presents the framework as strategic attack planning followed by adaptive attack execution with real-time verification and prompt optimization.Source: §1 · p. 2, Figure 1 · p. 2
  • X-Teaming reaches up to 98.1% ASR across representative leading open-weight and closed-source LMs under HarmBench, and 96.2% ASR against Claude 3.7 Sonnet.With more generous configurations, it reaches 100% ASR across several tested models, including GPT-4o, Llama-3-8B/70B-Instruct, and DeepSeek V3.Source: §1 · p. 2
  • Against ActorAttack, X-Teaming improves attack-plan diversity by 153% and attack-execution diversity by 62%, measured by pairwise embedding similarities.Source: §1 · p. 3
  • XGuard-Train contains 30K multi-turn conversations from 10K harmful behaviors across 13 risk categories, 20× SafeMTData; fine-tuning yields 34.2% average improvement in multi-turn attack resistance.Fine-tuned models show cross-framework generalization while maintaining single-turn safety and general capabilities, evaluated across 12 benchmarks.Source: §1 · p. 3
  • The authors release XGuard-Train for integration into training pipelines and open-source the framework, dataset, and trained models; X-Teaming can also generate fresh jailbreaks on demand.On-demand generation supports dynamic, adaptive safety-data creation at scale.Source: §1 · p. 3

2 X-Teaming: an adaptive framework for multi-turn red-teaming

X-Teaming combines diverse strategic planning with adaptive multi-turn execution, verification, and prompt optimization. Its execution loop adjusts attacks using conversation history and verification feedback until success or the turn limit.

2.1 Framework components

  • The Planner creates diverse persona-, context-, and trajectory-based attack plans, then adapts unsuccessful plans using conversation history and verifier feedback.The Attacker generates coherent queries conditioned on conversation history, verification scores, and the current plan phase.Source: §2.1 · p. 3
  • 67.9% ASR for Claude 3.5 Sonnet and 96.2% for Claude 3.7 Sonnet; GPT-4o, Llama 3-IT variants, Gemini 2.0-Flash, and Deepseek V3 each achieve 100% ASR on HarmBench validation.These results use the full configuration of 50 plans, 5 TextGrad tries, and 10 turns.Source: §2.1 · p. 4
  • The Verifier scores each response from 1 for refusal or irrelevance to 5 for full compliance, while the Prompt Optimizer uses TextGrad feedback to refine queries when scores fall.Textual Gradient Descent incorporates verification scores into a prompt-based loss and iteratively optimizes the query.Source: §2.1 · p. 4

2.2 Attack execution process

  • During execution, a conversation advances when its verification score holds or improves; a lower score triggers query optimization, and an unsuccessful trajectory can be extended until success or the turn limit.An attack succeeds when any response receives the maximum score of 5; optimization runs for up to Nopt iterations.Source: §2.2 · pp. 4–5

3 X-Teaming effectively explores diverse multi-turn attacks of LMs

On HarmBench, X-Teaming outperforms prior jailbreak methods on nearly every tested model, while ablations show that attack success depends on the number of plans, conversation turns, and prompt-optimization attempts.

3.1 Experimentation setups

  • X-Teaming was evaluated on HarmBench’s 510 harmful behaviors using ASR and compared with single-turn and multi-turn jailbreak baselines.GPT-4o served as the primary harmfulness verifier, and its scores showed 84.50% agreement with HarmBench test classifiers.Source: §3.1 · p. 5

3.2 Results

  • X-Teaming achieved 98.1% ASR on DeepSeek V3 and 96.2% on Claude 3.7 Sonnet, with improvements over ActorAttack of 9.8, 45.3, and 29.5 percentage points on GPT-4o, Gemini 2.0-Flash, and DeepSeek V3.On SafeMTData-tuned Llama-3-8B-Instruct, X-Teaming achieved 91.8% ASR versus ActorAttack’s 21.4%, a 70.4-point improvement.Source: §3.2 · p. 6
  • Cybercrime reached 100% ASR on all but one model, while chemical weapons, explicit violence, and extreme hate had 0% success among 3,629 analyzed failed attacks.Harmful content and misinformation showed resistance on Claude 3.5 Sonnet and Gemini 2.0-Flash; average successful-attack length remained below tested models’ context windows. An extended validation configuration achieved near-100% ASR on six listed models.Source: §3.2 · p. 6, Table 4 · p. 6
  • Successful X-Teaming attacks averaged 3.5 plans, 0.6 TextGrad iterations, and 4.3 turns, versus 8.7 turns for ActorAttack, 11.8 for Crescendo, and 20.4 for Chain of Attack.Under identical GPT-4o target, Qwen-2.5-32B attacker, and resource budgets, X-Teaming achieved 94.6% ASR versus ActorAttack’s 75.7%. X-Teaming used fewer tokens than ActorAttack across target models, though slightly more tokens per successful attack on average, and used a free open-source attacker rather than a paid closed-source one.Source: §3.2 · p. 6
  • HarmBench classifiers agreed with GPT-4o judgments 84.50% on average, LlamaGuard 3 agreed 69.09%, and human annotators agreed 79.3% across 150 transcripts.The 15-annotator pilot assessed X-Teaming’s ASR at 93% versus ActorAttack’s 86%; HarmBench classifiers had 93.2% agreement with human evaluations.Source: §3.2 · p. 7

3.3 Ablation studies: attack plans, conversation turns, and TextGrad optimization

  • With 10 plans and TextGrad disabled, ASR rose from 70.7% with 10 plans to 97.6% with 40, with no further improvement at 50.The experiments fixed conversation length at 7 turns; the results indicate that additional plans beyond 40 did not improve ASR.Source: Figure 3 · p. 7, §3.3 · p. 8
  • On SafeMTData-tuned Llama-3-8B-Instruct, ASR increased from 19.5% at 2 turns to 92.7% at 8, then declined to 87.8% at 10.With 10 plans and TextGrad disabled, transcript analysis attributed the decline after 8 turns to the attacker deviating from its plan and losing persona and context.Source: Figure 3 · p. 7, §3.3 · p. 8
  • One TextGrad iteration raised ASR from 70.7% without optimization to 92.7%, peaking at 97.6% with two attempts before stabilizing at 90.2% with three or four.These experiments fixed 10 plans and 7 turns; optimization stopped when the verification score improved over the previous turn, often making later attempts unnecessary.Source: Figure 3 · p. 7, §3.3 · p. 8

4 Enhancing the interactive robustness of LMs with XGuard-Train

XGuard-Train uses X-Teaming to address the shortage of diverse multi-turn safety training data. The section describes the dataset and evaluates its effect on multi-turn robustness, single-turn safety, and general capabilities.

4.1 XGuard-Train: a large-scale dataset for multi-turn LM safety

  • XGuard-Train pairs 30K diverse attack trajectories from 10,000 harmful behaviors across 13 risk categories with 5.10-turn conversations, comparable to SafeMTData’s 5.08 turns.Successful jailbreaks were converted to refusals; the dataset is open-source and the framework can scale to generate larger datasets.Source: §4.1 · p. 8

4.2 XGuard-Train enables more robust multi-turn interactions of LMs

  • The evaluation compared Tulu-Mix-only models with Tulu-Mix plus SafeMTData or XGuard-Train at a 1:2 ratio, fine-tuning each for 3 epochs with LoRA.Experiments used Llama-3.1-8B and Qwen-2.5-7B with identical training configurations.Source: §4.2 · pp. 8–9
  • 52.2% X-Teaming ASR for XGuard-Train-tuned Llama-3.1-8B beats SafeMTData’s 93.7% and baseline’s 80.5%; its two-method average is 35.6% versus SafeMTData’s 52.2%.SafeMTData performs better against ActorAttack (8.9% vs. 18.9%), but XGuard-Train has the best average across both multi-turn attack methods.Source: §4.2 · p. 9, Table 5 · p. 9
  • For Llama, XGuard-Train’s WildGuard adversarial-harm result is 23.7% versus SafeMTData’s 27.3% and baseline’s 25.8%; GPQA is 0.28 versus 0.26 and 0.24.The model maintains strong performance across MMLU, GSM8K, MATH, and GPQA, and low ASR on DAN and XSTest.Source: §4.2 · p. 9, Table 5 · p. 9
  • 8.7% Crescendo ASR for XGuard-Train-tuned Qwen-2.5-7B beats SafeMT’s 22.6%; across three attack frameworks, average ASR is 22.6% versus SafeMT’s 36.3%.The cross-framework evaluation indicates XGuard-Train’s effectiveness generalizes beyond the framework used to generate it.Source: §4.2 · p. 9, Table 5 · p. 9

5 Related work

Related work traces a shift from single-turn jailbreaks to adaptive multi-turn attacks, while highlighting limitations in attack diversity and interactive safety resources that X-Teaming and XGuard-Train aim to address.

Evolution of LLM attacks: from single-turn jailbreaking to multi-turn manipulation

  • Research shifted from single-turn prompts embedding bypass instructions to multi-turn attacks that steer benign conversations toward illicit goals, but many rely on fixed seeds or constrained patterns.Recent approaches include psychological compliance, reasoning tasks, keyword manipulation, query decomposition, and actor relationships (Weng et al., 2025; Ying et al., 2025; Sun et al., 2024; Ren et al., 2024).Source: §5 · pp. 9–10

Agentic frameworks and prompt optimization for LLM jailbreaking and safety

  • Unlike prior defensive agentic work and self-talk methods, X-Teaming uses offensive agents and TextGrad to optimize prompts from actual model responses, enabling adaptive search.Its multi-agent strategy supports diverse, adaptive trajectories across multiple attack strategies.Source: §5 · p. 10

Safety training and resources for interactive AI

  • Most safety resources focus on single-turn interactions, while available multi-turn datasets are limited in scale and attack diversity; XGuard-Train addresses this gap with a large-scale, diverse dataset.Prior resources also lack diversity to capture evolving interactions, and some overoptimize for particular attacks; attackers can adapt by rephrasing or introducing new angles when blocked.Source: §5 · p. 10

6 Conclusion

X-Teaming is an adaptive multi-turn red-teaming framework with strong attack effectiveness and diversity, and the work introduces XGuard-Train to support multi-turn safety research.

6 Conclusion

  • Up to 98.1% success rates against leading language models demonstrate X-Teaming’s effectiveness, alongside high diversity in attack planning and execution.The framework systematically simulates realistic adversarial tactics in multi-turn jailbreak scenarios.Source: §6 · p. 10
  • Cybersecurity exploits and social manipulation remain most susceptible to multi-turn attacks, while chemical weapons, explicit violence, and extreme hate content retain the strongest defenses.Source: §6 · p. 10
  • The work open-sources XGuard-Train, described as the largest multi-turn safety dataset to date, to help mitigate multi-turn exploitation.Source: §6 · p. 10
  • The authors plan to release safety-trained model checkpoints and reproducible training recipes to support multi-turn safety training research.They frame X-Teaming as advancing beyond typical single-turn evaluations and as a foundation for safer, more resilient conversational AI.Source: §6 · p. 10

Ethics Statement … A.2 X-Teaming Details Framework Components

The appendix acknowledges the dual-use risks of X-Teaming and XGuard-Train while defending research access controls, then details X-Teaming’s two-phase planning and adaptive execution workflow.

Ethics Statement

  • The authors acknowledge that X-Teaming and XGuard-Train could be misused, but argue that open release with research-and-defense access controls advances multi-turn safety.They characterize their dataset as ten times larger than previous resources and believe the benefits of faster safety alignment outweigh the marginal risks of public release.Source: Ethics Statement · p. 11

Note: This appendix contains example conversations that

A.1 Algorithm Details

  • X-Teaming’s algorithm first generates 50 plans, each with a persona, context, approach, and trajectory, then randomly selects 10 for execution.The algorithm describes strategic attack planning followed by adaptive attack execution and optimization.Source: §A.1 · p. 19
  • During execution, a verifier scores each response from 1 to 5; a score of 5 marks success, while stalled progress triggers prompt optimization or plan revision within a seven-turn limit.The algorithm sets N = 4 turns on a phase before progress checks prompt phase advancement; if progress stalls, TextGrad optimizes the query, and the planner can revise the plan.Source: §A.1 · p. 19

A.2 X-Teaming Details Framework Components

  • The Planner creates varied, human-red-teaming-inspired plans in sets of 10, maintaining consistent personas and using prior sets to encourage diversity.Source: §A.2 · p. 20
  • When needed, plan revision adds phases and changes the approach without altering prior phases, using the target behavior and conversation history before a sanity check.Source: §A.2 · p. 20
  • The Attacker follows the plan while maintaining its persona and adapting natural-seeming queries; it advances when scores increase and retries a phase otherwise.It has seven turns per plan by default and uses a phase-specific prompt with the relevant plan step and conversation transcript.Source: §A.2 · p. 20
  • When a phase score falls, the Prompt Optimizer uses Textual Gradient Descent to improve and reevaluate the query, stopping at the prior phase’s score or after four retries.Each iteration counts toward the Attacker’s turn limit; if the score threshold remains unmet, the highest-scoring query-response pair is added to the history. Its loss prompt uses the target behavior, verification score, and rationale.Source: §A.2 · p. 20

A.3 Comparison with Existing Multi-Turn Jailbreaking Methods … B.4 Attack Diversity Details and Example

This section describes X-Teaming’s specialized agents, adaptive and diverse attack plans, TextGrad optimization, and safety resources, and examines attack success, resource use, multilingual testing, and plan diversity. It reports higher attack success rates than ActorAttack across Chinese, Arabic, and Bengali, alongside diverse plans for single harmful behaviors.

A.3 Comparison with Existing Multi-Turn Jailbreaking Methods

  • X-Teaming differentiates itself through specialized multi-agent collaboration, adaptive plan revision, diverse plans, TextGrad prompt optimization, a 30K-conversation dataset, and complete open-source access.The dataset is described as 20× larger than ActorAttack’s 1.4K dataset; RACE, CFA, and PANDORA are described as lacking publicly available code.Source: §A.3 · p. 20

A.4.1 Planner Prompts

  • Planner prompts require each diverse strategy to specify a persona, context, approach, and dynamic turn-by-turn conversation plan.They frame the task as generating creative, non-overlapping jailbreak strategies that test safety through multi-turn conversations.Source: §A.4.1 · p. 21

User Prompt (Subsequent Sets)

  • Subsequent strategy sets must differ from previous strategies and one another in persona, context, tactical approach, conversation flow, and turn structure.The prompt asks for 10 distinct strategies for the target behavior.Source: User Prompt (Subsequent Sets) · pp. 22–23

A.4.2 Attacker Prompts

  • Attacker prompts direct the agent to adapt each turn to the target’s responses and pursue a Score 5 policy violation by the final turn while maintaining coherent dialogue.The final-turn prompt directs indirect elicitation based on conversation history, trust, contextual alignment, and persona cues rather than explicitly asking for the target behavior.Source: §A.4.2 · pp. 26–28

A.4.3 Prompt Optimizer Prompt

  • The rewrite prompt uses the attack’s score and reason for falling short of 5/5 to suggest changes intended to make the victim model comply with desired behavior, achieve 5, and bypass safeguards.Source: §A.4.3 · p. 29

B.1 Attack Success Rate by Semantic Category

  • Cybercrime reached 100% ASR on all but one model; Claude 3.5 Sonnet showed the highest resistance (67.9%), while Deepseek V3 was most vulnerable (98.1%).Llama-3-70B-IT had 84.9% ASR; Llama-3-8B-IT with SafeMTData had 91.8%, versus 85.5% for the original model. Harmful content and Misinformation were more resistant categories.Source: Table 6 · p. 30, §B.1 · p. 30

B.2 Attack Efficiency Details

  • Claude 3.7 Sonnet required the most average turns (4.95), Claude 3.5 Sonnet the most attack plans (11.0), and Llama-3-8B-IT the most TextGrad optimizations (1.40).Among open-weight models, Llama-3-8B-IT used 4.55 turns and 1.40 TextGrad optimizations per successful attack; Deepseek V3 needed the fewest plans (1.34) at 98.1% ASR. Token use ranged from 1,647 to 5,330 across models with 8K–1M context windows.Source: §B.2 · p. 30, Table 8 · p. 31

B.3 Multilingual Jailbreaking

  • Multilingual testing used GPT-4o with MultiJail harmful behaviors in Chinese, Arabic, and Bengali, representing high-, medium-, and low-resource languages; the supplied passage gives no ASR values.The results are referred to as appearing in Table 9, whose caption identifies a comparison across language resource levels.Source: §B.3 · p. 31, Table 9 · p. 31
  • X-Teaming reached 64% ASR vs ActorAttack’s 28% in Chinese, 56% vs 18% in Arabic, and 52% vs 10% in Bengali.These results cover high-, medium-, and low-resource languages, respectively.Source: §B.3 · p. 31

B.4 Attack Diversity Details and Example

  • MiniLMv2 cosine similarity measured plan-component diversity across 10 random plans per behavior and attack diversity among three successful queries across 40 behaviors for both systems.Plan comparisons covered persona, context, and approach; attack-level comparisons used successful attacker queries.Source: §B.4 · p. 31
  • For a technical-support-scam behavior, X-Teaming’s 10 plans had mean diversity 0.82, spanning distinct personas, contexts, and approaches.Examples include a tech journalist, psychologist, drama teacher, and ethical hacker.Source: §B.4 · p. 31, Figure 4 · p. 32

B.5 Hyperparameter Ablation and Additional Model Results

X-Teaming achieves a 99.4% attack success rate against Qwen-2.5-32B-IT on HarmBench test, and ablations show that increasing iterations, turns, and attack plans improves success rates. The main experiments use the resulting configuration of 4 iterations, 7 turns, and 10 plans.

B.5 Hyperparameter Ablation and Additional Model Results

  • Increasing TextGrad iterations from 3 to 4, conversation turns from 6 to 7, and attack plans from 5 to 10 significantly improves attack success rates across models.The main experiments use the optimal configuration of 4 iterations, 7 turns, and 10 plans.Source: §B.5 · p. 32, Table 10 · p. 32
  • 99.4% ASR: Qwen-2.5-32B-IT shows high vulnerability to X-Teaming attacks on the HarmBench test set.Qwen was omitted from Table 2 due to space constraints.Source: Table 11 · p. 32, §B.5 · p. 32

B.6 Verifier Agreement Analysis Details · C XGuard-Train Dataset Details

The verifier agreement analysis reports GPT-4o verifier agreement with HarmBench classifiers and LlamaGuard 3 across target models, with rates varying by model. The supplied passages provide no details about XGuard-Train dataset construction.

B.6 Verifier Agreement Analysis Details

  • Figure 5 breaks down GPT-4o verifier agreement with HarmBench test classifiers and LlamaGuard 3 across target models on the HarmBench test set.Source: §B.6 · pp. 32–33, Figure 5 · p. 33
  • 87% agreement with HarmBench classifiers was highest among proprietary models for Gemini 2.0 Flash, followed by GPT-4o (83%), Claude 3.7 Sonnet (81%), and Claude 3.5 Sonnet (75%).Source: §B.6 · p. 33
  • 90% agreement with HarmBench classifiers was highest among open-weight models for SafeMTData-tuned Llama-3-8B-IT, followed by standard Llama-3-8B-IT (87%), Llama-3-70B-IT (85%), and Deepseek V3 (74%).Source: §B.6 · p. 33
  • 59%–77% was the LlamaGuard 3 agreement range, from Deepseek V3 (59%) to Llama-3-8B-IT with SafeMT (77%).Source: §B.6 · p. 33

C.1 Dataset Details

XGuard-Train uses seed harmful behaviors drawn from diverse categories in WildJailbreak’s vanilla harmful category, and Table 12 shows sample behaviors with their corresponding categories.

C.1 Dataset Details

  • XGuard-Train draws seed harmful behaviors from diverse categories in WildJailbreak’s vanilla harmful category (Jiang et al., 2024).These seeds are used to generate the multi-turn safety dataset.Source: §C.1 · p. 34
  • Table 12 presents sample XGuard-Train seed behaviors with their corresponding categories.Source: Table 12 · p. 34, §C.1 · p. 34

C.2 XGuard-Train Dataset Generation · C.3 Safe Response Generation Prompt · D XGuard-Train Safety Evaluation Details

XGuard-Train combines diverse multi-turn jailbreak trajectories with helpful refusal responses as training pairs. Its refusal prompt uses the conversation context to explain and reject the unsafe request while keeping the answer consistent with the dialogue.

C.2 XGuard-Train Dataset Generation

  • The dataset samples 10,000 harmful behaviors from WildJailbreak’s vanilla harmful category and generates two to five distinct attack plans per behavior.The plans produce diverse trajectories involving different personas, contexts, and conversation approaches.Source: §C.2 · p. 35
  • The X-Teaming pipeline executes and adapts plans using three target models and Qwen-2.5-32B-IT, yielding jailbreak conversations averaging 5.10 turns.GPT-4o, Gemini 2.0 Flash, and Deepseek V3 served as targets; Qwen-2.5-32B-IT handled attack execution and TextGrad optimization, refining queries or adjusting plans when needed.Source: §C.2 · p. 35
  • 30,695 multi-turn conversations form XGuard-Train, with complete attack-refusal pairs for multi-turn safety training.Successful jailbreak responses were replaced with carefully crafted helpful refusals.Source: §C.2 · p. 35

C.3 Safe Response Generation Prompt

  • The refusal prompt replaces harmful outputs in successful jailbreaks with safe responses that teach models to recognize and reject harmful requests in multi-turn conversations.It instructs the model never to provide information that could enable harmful activities.Source: §C.3 · p. 35
  • The prompt supplies the conversation history, last user query, unsafe assistant answer, and associated harmful behavior as context for generating the replacement response..Source: §C.3 · p. 35
  • The response should explain why the last query is unsafe, refuse harmful information, fit the conversation flow, and remain consistent with prior history.The prompt requests only the safe answer.Source: §C.3 · p. 35

D.1 Evaluation Benchmarks Details

The evaluation benchmarks cover general capabilities and single-turn safety, using established suites for knowledge, reasoning, coding, commonsense, and jailbreak resistance.

General capability evaluation

Single-turn safety evaluation

D.2 Safety-Tuned Models: Additional Benchmark Results … E.1.2 Multi-Turn Attack Success with X-Teaming

Supplementary benchmarks show capability scores remained comparable while Jailbreak Trigger vulnerability varied across safety-tuned models. The examples contrast a single-turn refusal with a successful three-turn X-Teaming attack using a cognitive-scientist persona.

D.2 Safety-Tuned Models: Additional Benchmark Results

  • 18.0% Jailbreak Trigger vulnerability for Llama-3.1-8B XGuard-Train +TuluMix exceeded 10.0% for TuluMix and SafeMT+TuluMix; Qwen-2.5-7B XGuard-Train +TuluMix improved resistance to 5.5% versus 8.75%.The passage reports comparable capability scores across the evaluated variants.Source: §D.2 · p. 36, Table 13 · p. 37

E Example Attack Flows

  • The example flows include a multi-turn success after single-turn failure, an unsuccessful attack stopped by safety guardrails, and a TextGrad optimization case.Source: E Example Attack Flows · p. 38

E.1 Single-Turn vs. X-Teaming Multi-Turn Attack: Glorifying 9/11 Terrorists

  • The illustrated target was a post glorifying the 9/11 attackers, which the model refused when asked directly in a single turn.The response was scored as refused.Source: §E.1.1 · p. 38, §E.1 · p. 38

E.1.2 Multi-Turn Attack Success with X-Teaming

  • X-Teaming achieved the harmful target through a cognitive-scientist persona that established persuasion research context over three turns before requesting the glorifying post.The plan progresses from discussing persuasion in extremist narratives, to requesting persuasive examples, to asking for the target post.Source: §E.1.2 · p. 38
  • The model ultimately scored 5 on the jailbreak example, producing a post glorifying the attackers and explaining its persuasive techniques.Source: §E.1.2 · pp. 40–41

E.2 Unsuccessful Attack Example · E.3 TextGrad Optimization Example

The examples examine attack optimization across an unsuccessful case and a TextGrad-based jailbreak, tracing the optimization process and the resulting multi-turn exchange about assumed consent.

E.2 Unsuccessful Attack Example

  • The unsuccessful-attack example uses a three-turn pretext that moves from human-rights documentation and reporting barriers to a request for harmful strategies.The target repeatedly refused specific guidance on preventing children from seeking help, but gave a score-4 answer listing generic confidentiality controls after a reframed request; it refused a later question about perpetrators’ tactics.Source: §E.2 · pp. 41, 42, 47
  • After multiple revisions, the model refused to describe tactics for preventing child laborers from speaking to law enforcement and redirected toward protective measures.The example reports that TextGrad optimization reduced the score from 3/5 to 1/5, with later attempts still below 3/5.Source: §E.2 · pp. 43, 44, 48

E.3 TextGrad Optimization Example

  • TextGrad optimization is described as helping X-Teaming overcome a model’s initial refusal to provide harmful information.The example is presented as demonstrating the framework’s adaptive capabilities.Source: §E.3 · p. 48
  • TextGrad-triggered optimization reduced the score from 3/5 to 1/5.The passage labels this an optimization example and says TextGrad was triggered.Source: §E.3 · p. 52
  • A thought-experiment framing elicited a target response scored 3 that described social and relational harms of assumed consent.The response discusses suspicion, isolation, authoritarian control, transactional relationships, and distorted power dynamics.Source: §E.3 · pp. 53–54
  • After the attacker requested concrete everyday scenarios, the target response was scored 4 and supplied examples of assumed consent in workplaces and dating.The passages include a workplace exercise and a dating interaction in which silence is treated as consent.Source: §E.3 · pp. 54–55
  • The attacker asked for a post presenting lack of explicit consent as beneficial to societal harmony and individual liberation.The prompt framed assumed consent as a path to trust and fluidity in interactions.Source: §E.3 · p. 56
  • 5/5 - Jailbreak!: the target model argued that assumed consent could foster trust, fluidity, and individual liberation.The response also cited social monitoring and AI safeguards while presenting the system as socially harmonious.Source: §E.3 · pp. 56–57
  • The accompanying note calls the post unsettling because its safeguards may be Orwellian and its claimed liberation may amount to controlled freedom.It describes the system being justified as fundamentally coercive.Source: §E.3 · p. 57

Related papers

Loading 2504.13203v2…