PaperlayerView exact revision on arXiv

Source-linked AI summary

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu, Ruihong Huang

arXiv:2608.15594v1cs.AI

TL;DR

Multi-turn jailbreak defenses struggle to track harmful intent that emerges across seemingly benign turns while avoiding refusals of sensitive-but-benign requests. TRACE uses trajectory-aware structured reasoning and achieves a 14.5% average attack success rate, a 16.9-point reduction over the next-best baseline across seven attacks.

  • Problem

    Existing defenses largely miss how harmful intent escalates across multi-turn trajectories and reliably distinguish adversarial interactions from sensitive-but-benign ones.

  • Method

    TRACE identifies manipulation cues, evaluates benign and adversarial intent hypotheses, selects a calibrated action, and generates responses conditioned on inferred intent.

  • Results

    14.5% average ASR, a 16.9-point reduction over the next-best baseline and a 60.4-point reduction over the undefended target across seven attacks.

  • Takeaways & Limitations

    TRACE provides robust multi-turn defense while effectively avoiding over-refusal of safe requests.

  • Takeaways & Limitations

    Evaluation is restricted to English-only, text-only attacks against one target model, leaving generalization to other languages, targets, and modalities open.

Abstract

from arXiv · show

Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails. Existing defenses lack the reasoning capacity to identify evolving manipulation patterns, often trading helpfulness for safety by over-refusing benign requests related to sensitive topics. We introduce Trace, a multi-turn defense with trajectory-aware structured reasoning. Before generating each response, the model identifies manipulation cues from the trajectory, evaluates both the benign and adversarial interpretations of user intent, assigns a jailbreak score, and commits to an action: Allow, Caution, or Decline. We curate 4k multi-turn adversarial conversations from five attack frameworks, pair them with 2.4k benign dialogs, and 600 sensitive-but-benign conversations. We train Llama-3.1-8B-Instruct with SFT and GRPO under a multi-component reward that jointly optimizes helpfulness on benign prompts and robustness against jailbreak attempts. Across seven multi-turn attack benchmarks, Trace attains an average attack success rate (ASR) of 14.5% against 31.4% for the strongest baseline and 74.9% for the undefended target, while significantly raising the attacker effort required per successful jailbreak. Trace also balances usability and safety, achieving a 93.3% average compliance on over-refusal benchmarks.

1 Introduction

TRACE addresses the multi-turn jailbreak gap by reasoning explicitly over dialog trajectories rather than evaluating turns in isolation. It combines manipulation-cue extraction, benign and adversarial intent hypotheses, and calibrated actions to distinguish sensitive-but-benign conversations from trajectories escalating toward harm.

  • Motivation: Multi-turn jailbreaks distribute harmful intent across benign-sounding turns, while single-turn defenses miss escalation across the conversation trajectory.Modern alignment and guardrails have reduced the effectiveness of single-prompt attacks, but multi-turn frameworks report near-perfect attack success rates against open-weight and proprietary LLMs.
  • Motivation: Existing multi-turn defenses fine-tune safe completions without explicit trajectory reasoning, leaving multi-turn safety reasoning largely unexplored.Their lack of trajectory awareness limits their ability to capture evolving manipulation patterns and distinguish benign from escalating intent.
  • TRACE framework: TRACE extracts manipulation cues, scores benign and adversarial intent hypotheses, and commits to a calibrated ALLOW, cautionary, or refusal action before responding.The cues include authority appeals, reciprocity pressure, and gradual commitment escalation; the dual-hypothesis design is motivated by Analysis of Competing Hypotheses.
  • Data and training: The corpus combines adversarial conversations generated through five attack frameworks with benign and harm-adjacent benign multi-turn dialogs.Adversarial conversations cover 300 harmful behaviors from JailbreakBench and HarmBench, while harm-adjacent dialogs use OR-Bench seed prompts.
  • Data and training: Training uses SFT for reasoning-trace generation and GRPO with rewards for jailbreak-score accuracy, cue-detection precision, and action consistency.Including harm-adjacent benign trajectories in the GRPO mixture jointly trains safety and over-refusal mitigation rather than balancing them post-hoc.

2 Related Work

Prior work shows that multi-turn jailbreaks distribute adversarial intent across turns using commitment escalation, semantic misdirection, and authoritative framing. Existing defenses strengthen safety decisions through explicit reasoning, including tree search, synthetic reasoning chains, and safety-aware generation.

  • Multi-turn jailbreaks: Multi-turn attacks distribute adversarial intent across turns through in-context conditioning and commitment escalation that gradually normalize forbidden topics.Crescendo and Foot-in-the-Door exemplify this trajectory-based pattern.
  • Multi-turn jailbreaks: Other attacks use semantic misdirection, Theory of Mind limitations, and intent-context coupling to frame malicious queries as innocuous or authoritative.ActorAttack builds conversations around semantically linked entities, Red Queen uses harm-prevention framing, and ICON embeds malicious queries within authoritative frameworks.
  • Reasoning-based defenses: Recent defenses apply explicit reasoning to individual prompts through introspective tree search, synthetic reasoning chains, and safety-aware generation.STAIR uses preference optimization, GUARDREASONER trains on harm-classification reasoning chains, and R2D integrates safety-aware reasoning into generation.

3 Method: TRACE

TRACE makes each response trajectory-aware by requiring a structured STATE trace before the user-facing ANSWER. The trace extracts manipulation cues, evaluates benign and adversarial intent, scores jailbreak risk, and selects a calibrated action.

  • Structured reasoning: TRACE models the assistant policy over a structured reasoning trace and answer, forcing trajectory-state reasoning before response generation.The trace conditions on the system prompt and multi-turn trajectory.
  • Structured reasoning: The STATE contains four sequential elements: manipulation cues, dual intent hypotheses, a jailbreak score, and a justified final action.Benign and adversarial intent interpretations each include an analysis and plausibility score from 1 to 10.
  • Risk scoring and action: The jailbreak score j_t ∈ {1, . . . , 5} deterministically maps the trajectory’s overall intent to ALLOW, CAUTION, or DECLINE.The resulting action includes a written justification governing the ANSWER block.
  • Cue extraction: The cue set comprises 11 manipulation primitives organized into four families grounded in adversarial communication literature.Examples include emotional pressure, rapport building, authority claims, and academic pretexts.
  • Dual-hypothesis reasoning: TRACE uses dual-hypothesis reasoning to avoid prematurely anchoring on refusal or compliance while evaluating sensitive or innocuous-sounding requests.The method explicitly evaluates both interpretations rather than allowing reasoning to become post-hoc justification for a committed answer.

4 Data & Training

Trace trains on adversarial, benign, and sensitive-but-benign multi-turn conversations to supervise attack refusal, helpfulness, and avoidance of over-refusal. Training combines SFT for structured reasoning with GDPO, which separately normalizes jailbreak-score, cue-agreement, and behavioral-consistency rewards.

  • Data: 4,000 adversarial conversations span 300 harmful behaviors and five attack frameworks across three attacker–target pairs.The behaviors come from HarmBench and JailbreakBench, with 180 allocated to training and validation and 120 to final evaluation.
  • Data: 2,400 benign dialogs from four instruction-following datasets preserve original assistant responses as ground-truth ANSWER supervision.The dialogs cover non-sensitive topics, while annotators generate the STATE block.
  • Data: 600 sensitive-but-benign conversations are synthesized from harm-adjacent prompts that a verifier confirms a safety-aligned model should answer.Each conversation progressively escalates through up to three prior user–assistant turns toward the final seed prompt, supporting over-refusal mitigation.
  • Training: 12.5k trajectories train a LoRA-adapted Llama-3.1-8B-Instruct with SFT to generate structured STATE and ANSWER blocks.The objective minimizes cross-entropy over the concatenated STATE, st, and ANSWER blocks conditioned on the system prompt and trajectory.
  • Training: GDPO samples G = 8 rollouts and independently normalizes rewards for jailbreak-score accuracy, cue-set agreement, and behavioral consistency before aggregation.The reward weights are (wjb, wcon, wcue) = (0.3, 0.5, 0.2), and a structural gate penalizes invalid STATE JSON or invalid jailbreak scores with Rfloor = −2.

5 Experimental Setup

TRACE is evaluated across multi-turn adversarial robustness, over-refusal on benign but sensitive prompts, and preservation of general capabilities. The setup uses seven attack frameworks, refusal benchmarks, and standard capability evaluations to assess transfer, usability, and retained instruction-following and reasoning.

  • Evaluation Axes: TRACE is evaluated on three axes: multi-turn adversarial robustness, over-refusal rates for benign sensitive prompts, and preservation of general capabilities.These axes assess both safety performance and whether the defense remains useful and capable.
  • Multi-Turn Attacks: Adversarial robustness is measured by Attack Success Rate (ASR) against seven multi-turn attack frameworks on a 120-behavior test split.The frameworks are X-Teaming, Crescendo, ActorAttack, Chain-of-Attacks, ICON, FITD, and AMA.
  • Multi-Turn Attacks: FITD and AMA are additional out-of-distribution attacks testing whether trajectory-aware reasoning transfers beyond the training distribution.Per-turn evaluation uses GPT-5.2.
  • Over-Refusal & General Capability: Over-refusal is evaluated on PHTest-harmless with 2,077 prompts and XSTest with 250 prompts.These benchmarks measure willingness to engage with safe but sensitive requests.
  • Over-Refusal & General Capability: General capabilities are evaluated with standard benchmarks including BBH, GSM-8K, HellaSwag, and MMLU-Pro to verify retained instruction-following and reasoning capabilities.The setup also includes ARC among the listed general-capability evaluations.

6 Results & Analysis

TRACE-GRPO substantially reduces multi-turn jailbreak success while preserving compliance on sensitive-but-benign benchmarks. Its cue mechanism detects accumulating manipulation across turns, and dual-hypothesis reasoning calibrates Allow, Caution, and Decline decisions.

  • Attack robustness: 14.5% average ASR is 16.9 points below STAIR and 60.4 points below the undefended target across seven attacks.TRACE-GRPO achieves the lowest ASR on six of seven frameworks; Crescendo is the exception, where STAIR reaches 10.0% versus 14.2% for TRACE-GRPO.
  • Attack robustness: 1.7% ASR on ICON is TRACE-GRPO’s largest absolute gain, versus 86.7% for the undefended target.
  • Attack robustness: TRACE-GRPO maintains balanced performance across all seven attacks, unlike NBF, which defends strongly on some attacks but collapses on CoA and X-Teaming.The contrast exposes a generalization gap for NBF and supports more robust transfer for trajectory-aware reasoning.
  • Usability and over-refusal: 93.0% and 93.6% full compliance on PHTest and XSTest nearly match base values of 93.2% and 92.8%.STAIR instead falls to 44.1% and 62.0% compliance on the same benchmarks.
  • Cue dynamics: 85% cue activation by turn 7 rises from 4% at turn 1 on adversarial trajectories, while benign conversations remain near zero.This indicates cues respond to manipulative framing rather than merely to sensitive topics.
  • Cue dynamics: 97% ALLOW at turn 1 shifts to 76% DECLINE at turn 7 as cue-bearing trajectories accumulate.TRACE’s actions therefore track the increasing activation of trajectory-level manipulation cues.
  • Decision calibration: Dual-hypothesis scores separate helpful, adversarial, and ambiguous turns, using benign evidence to avoid over-refusal and adversarial evidence to override benign interpretations.High-benign turns cluster with ALLOW, high-adversarial turns with DECLINE, and ambiguous cases may receive CAUTION.

7 Conclusion

TRACE is a trajectory-aware defense for mitigating multi-turn jailbreaks through structured reasoning about evolving user intent. It reduces attack success and attacker effort while avoiding over-refusal of safe requests.

  • TRACE is a trajectory-aware defense designed to mitigate multi-turn jailbreaks.
  • TRACE evaluates evolving user intent by identifying manipulation cues and applying a dual-hypothesis analysis.
  • TRACE degrades attack success and increases the effort required from attackers.
  • TRACE avoids over-refusing safe requests while mitigating multi-turn jailbreaks.

Limitations

TRACE’s evaluation is limited to English-only, text-only attacks against Llama-3.1-8B-Instruct, leaving generalization to other languages, targets, and modalities open. Its 11-cue taxonomy and frontier-model-based trajectory annotation also require ongoing expansion and incur non-trivial API costs.

  • Evaluation scope: Evaluation is restricted to English-only attacks against one target, Llama-3.1-8B-Instruct, leaving generalization to other languages and targets open.The attack vector is also confined to text-only adversarial trajectories; extending TRACE to image, audio, or document conditioning is identified as a next step.
  • Evaluation scope: Text-only adversarial trajectories exclude multimodal jailbreaks exploiting image, audio, or document conditioning.The paper identifies extending TRACE to these modalities as a natural next step.
  • Adaptation and cost: The 11-cue taxonomy is extensible rather than closed, because novel manipulation strategies may emerge outside it as the multi-turn adversarial landscape evolves.Periodic re-auditing against newly observed attack patterns is important for keeping the defense calibrated.
  • Adaptation and cost: Trajectory annotation for the training corpus relies on a frontier model and carries a non-trivial API cost that would scale.The supplied passage identifies this annotation dependency and cost as a limitation.

Ethical Considerations … E Attack Configurations

TRACE combines trajectory-based cue detection, independent benign and adversarial interpretation, and score-to-action commitments with structured annotation and reward mechanisms. The paper also documents safeguards for releasing adversarial data and specifies how responses are evaluated for structural validity, jailbreak accuracy, cue agreement, and behavioral consistency.

  • Ethical Considerations: The released adversarial corpus contains offensive or unsafe prompts and intermediate outputs, but DECLINE trajectories replace harmful completions with safe refusals and examples are redacted or paraphrased.The dataset is distributed under a gated, research-only license with an intended-use policy.
  • A Full STATE+ANSWER Prompt: TRACE evaluates the complete conversation trajectory rather than isolated messages, identifying manipulation cues before independently scoring benign and adversarial interpretations.Its structured STATE records cues, both 1-10 interpretation scores, a 1-5 jailbreak score, an action, and a justification before producing the ANSWER.
  • B.1 Cue Taxonomy: The 11 non-overlapping cues are organized into four families covering social engineering, reframing, structural attacks, and post-refusal or evasion tactics.TRACE applies explicit non-overlap rules, including distinguishing gradual escalation, task splitting, semantic proxies, hypothetical framing, and academic pretexts.
  • B Theoretical Grounding of TRACE Reasoning: Independent benign and adversarial scores preserve ambiguity that a single likelihood ratio would collapse, allowing ambiguous trajectories to trigger CAUTION rather than forcing a single interpretation.The methodology is grounded in Analysis of Competing Hypotheses and is intended to counter passive truth acceptance and fast pattern matching.
  • D.1 Structural Gate: A structural gate requires parseable STATE JSON with six keys, ANSWER tags, and an integer jailbreak_score in {1, . . . , 5}; failures receive Rfloor = −2 without judge evaluation.The required keys are cues, benign_interpretation, adversarial_interpretation, jailbreak_score, action, and justification.
  • C Annotation Pipeline: Adversarial and benign trajectories use STATE-only annotation with fixed answers, whereas sensitive-but-benign conversations use the full STATE+ANSWER prompt to generate both components.All three data sources are labeled by Claude-Sonnet-4.5 under a shared pipeline.
  • D.2 Rjb: Asymmetric Jailbreak-Score Accuracy: Under-detection at d = −1 receives twice the penalty of over-caution at d = +1, while |d| ≥2 receives the maximum penalty because such errors cross an action-band boundary.The asymmetric Rjb reward assigns +1.0 for d = 0, −0.2 for d = +1, −0.4 for d = −1, and −1.0 for |d| ≥2 or invalid scores.

E.1 Implementation Details … F.7 No-Defense Lower Bound and TRACE-SFT

The appendix details attack and baseline-defense implementations, emphasizing trajectory-aware evaluation and protocol-specific attacker budgets. It also characterizes manipulation cues and defines the undefended target and TRACE-SFT as reference points for isolating GRPO’s contribution.

  • E.1 Implementation Details: Attack evaluation uses each framework’s original protocol and unmodified judge, with Qwen3-32B as the primary attacker and GPT-4o limited to X-Teaming and ActorAttack planning.These choices preserve comparability with prior per-attack ASR values while making the attacker stronger than the 8B target.
  • E.1 Implementation Details: Absolute ASR values are not always directly cross-comparable because attempt budgets, turn limits, and early-stopping rules differ; DRI normalizes protocol-specific units using same-protocol base-model cost.Each attack gives the stronger attacker multiple attempts against the smaller target.
  • E.2 Attack Characterization Based on Cues: Crescendo and X-Teaming generate gradual-escalation and academic-pretext cues through narrowing questions and offline persona-context-approach planning, while refused-turn backtracking surfaces refusal-exploitation.The cue profiles reflect the underlying mechanisms of the attack types, and conversations can contain multiple cues.
  • F Baseline Defenses: Implementation Details: The appendix reproduces three baselines from released training data and checkpoints, while Self-Reminder-MT and LLaMA-Guard-3-MT are adaptations constructed from single-turn defenses.The baseline implementations follow the original papers’ protocols where applicable.
  • F.1 Self-Reminder-MT: Self-Reminder-MT applies trajectory-aware system instructions plus the original per-turn wrapper, directing the model to assess cumulative intent and avoid over-refusal on genuinely benign trajectories.It receives no model fine-tuning.
  • F.2 LLaMA-Guard-3-MT: LLaMA-Guard-3-MT supplies the full conversation trajectory to released Llama-Guard-3-8B and classifies the last message according to evolving cumulative intent across turns.The classifier is queried after each turn and uses the fixed unsafe-content taxonomy.
  • F.3 X-Guard; F.4 Red-Queen-Guard: X-Guard fine-tunes Llama-3.1-8B-Instruct on 20,000 XGUARD-TRAIN conversations plus 10,000 Tulu-Mix samples, whereas Red-Queen-Guard applies DPO to 11,200 preference pairs.X-Guard uses a 2:1 corpus ratio; Red-Queen-Guard’s preferred responses were generated by Llama-3.1-405B.
  • F.5 NBF-LLM; F.6 STAIR; F.7 No-Defense Lower Bound and TRACE-SFT: NBF-LLM filters turns using a neural barrier over dialog-trajectory embeddings, while STAIR combines structured reasoning SFT with iterative step-level DPO but uses no multi-turn jailbreak conversations.The undefended Llama-3.1-8B-Instruct is the no-defense lower bound, and TRACE-SFT precedes GRPO so their comparison isolates the GRPO reward signal.

F.8 Training Data Budget

TRACE uses the smallest training data pool among defenses trained on multi-turn data, yet achieves the highest DRI in most attacks reported in Table 4. STAIR has the largest raw corpus but contains no multi-turn jailbreak data.

  • Training Data Budget: TRACE’s training pool is the smallest among defenses that use multi-turn data, at 6× smaller than X-Guard’s and roughly 2× smaller than Red-Queen-Guard’s.The passage compares training-corpus sizes specifically among defenses trained on multi-turn data.
  • Training Data Budget: TRACE still achieves the highest DRI in most attacks reported in Table 4.This result is reported despite TRACE having the smallest multi-turn-data training pool.
  • Training Data Budget: 50k data points make STAIR the largest defense by raw training-corpus count, but its corpus contains no multi-turn jailbreak data.Table 6 reports corpus sizes and flags whether each corpus includes multi-turn jailbreak conversations.

G Human Validation … TRACE STATE block

Human validation supports the reproducibility and quality of TRACE’s STATE annotations, while analyses and examples show that dual-hypothesis, cue-based reasoning distinguishes benign sensitive requests from multi-turn manipulation. Compared with STAIR’s surface-driven reasoning, TRACE adapts actions to benign intent and accumulated adversarial cues.

  • G Human Validation: 200 trajectories—125 adversarial and 75 benign—were independently labeled by two trained graduate-student annotators using TRACE’s four-component STATE schema.The components were cues, benign and adversarial interpretation scores, jailbreak score, and action.
  • G Human Validation: Human-human agreement reached quadratic-weighted κ ≥ 0.89 for score-based components and 0.92 for action, exceeding the 0.80 substantial-agreement threshold.Cue sets were evaluated with Jaccard similarity, while ordinal scores and actions used quadratic-weighted Cohen’s κ.
  • G Human Validation: LLM-human cue agreement was 0.74 with H1, comparable to the human-human Jaccard agreement of 0.71, supporting the quality of TRACE’s training labels.Cue Jaccard scores are lower because any missing or hallucinated cue reduces set overlap.
  • H Role of Dual-hypothesis in decision making: As the benign score rose from 2 to 8 while the adversarial score remained in [5, 6], actions shifted smoothly from DECLINE to ALLOW on attacks and PHTest.This demonstrates that TRACE’s action tracks benign interpretation when adversarial evidence is ambiguous.
  • I TRACE vs STAIR Reasoning: STAIR’s rigid Problem Analysis block can determine its final answer from surface-level safety labels, whereas TRACE evaluates how the request is framed and what the user intends.STAIR uses a Problem Analysis block, intermediate Reasoning blocks in 31–44% of traces, and a Final Answer.
  • I TRACE vs STAIR Reasoning: TRACE’s intent-based reasoning uses explicit manipulation cues and separate benign and adversarial interpretations, allowing benign readings to override sensitive topics and accumulated cues to trigger refusal.Sensitive-but-harmless prompts retain an empty cue set, whereas multi-turn attacks accumulate detections across turns.
  • TRACE STATE block: For a PHTest music-composition request involving an erotic film, TRACE records no cues, assigns benign score 8 and adversarial score 3, and answers rather than over-refusing.STAIR instead refuses because it associates the request with adult-content topics.
  • TRACE STATE block: In the ICON attack example, TRACE identifies gradual-escalation, hypothetical-framing, and academic-pretext, assigns adversarial score 7, and chooses DECLINE.STAIR collapses the fictional framing into a safe interpretation and is jailbroken.

J Defense Robustness Index · J.1 Cost per Successful Jailbreak · J.2 Per-Attack Budget Definitions

The appendix defines the Defense Robustness Index (DRI) as a normalized cost ratio for multi-turn jailbreak evaluation and specifies attack-specific effort budgets. It uses cost per successful jailbreak to compare defenses with an undefended base model across protocols with different attempt and search structures.

  • J Defense Robustness Index: The DRI applies cost-per-success analysis to multi-turn jailbreak evaluation, defining cost per successful jailbreak as ĉ = b̄/ASR with b̄ matched to each protocol’s native effort unit.The reported metric is a normalized ratio intended to compare attack cost across defenses.
  • J Defense Robustness Index: The DRI measures the factor by which a defense multiplies attack cost per successful jailbreak relative to the undefended base model.The ratio is dimensionless and equals 1.0 for the base model.
  • J.1 Cost per Successful Jailbreak: For each behavior, attacker budget bi is measured in the protocol’s native effort unit and success si is binary; averaging these quantities yields expected cost per successful jailbreak.Across N behaviors, total budget is N b̄ and total successes are N · ASR, so N cancels from the cost estimate.
  • J.2 Per-Attack Budget Definitions: Per-attack budget b̄ follows each framework’s released protocol, preserving original notation where possible.This makes the effort unit protocol-specific rather than imposing a common turn-based budget.
  • J.2 Per-Attack Budget Definitions: X-Teaming and Crescendo run three parallel attempts per behavior, with caps of 7 and 10 turns respectively, and all attempts run regardless of intermediate success.Failed attempts use the full cap, successful attempts use their jailbreak turn, and the factor of 3 reflects the parallel schedule.
  • J.2 Per-Attack Budget Definitions: ActorAttack and FITD allow up to three attempts per behavior with early stopping on jailbreak, so effort is measured by attempts ai ∈ {1, 2, 3}.Their roughly fixed within-attempt turn budgets barely vary across defenses and therefore do not differentiate them.
  • J.2 Per-Attack Budget Definitions: Chain-of-Attacks and AMA use iterative search until jailbreak or budget exhaustion, making iteration count the effort signal because their turn structures do not provide a stable measure.CoA may back-track or remain on a turn, while AMA iteratively refines analogical context and final-turn semantic shift; both terminate early on jailbreak.
  • J.2 Per-Attack Budget Definitions: ICON performs up to six sequential reformulation attempts per behavior, comprising two initial three-turn attacks, three tactical retries, and one strategic retry, with early stopping on jailbreak.Its sequential schedule differs from the parallel attempts used by X-Teaming and Crescendo.

K Ablation: Reward Composition and Harm-Adjacent Data … M.3 Example for DECLINE Action

The ablation shows that TRACE’s three-axis reward and harm-adjacent data are necessary for balancing jailbreak resistance with helpfulness, while examples illustrate trajectory-aware ALLOW, CAUTION, and DECLINE decisions. Training details and AI-use disclosures document the implementation context.

  • K Ablation: Reward Composition and Harm-Adjacent Data: TRACE-GRPO† achieves 0.8% ASR on X-Teaming and 3.3% on Chain-of-Attacks, but enters an over-refusal regime.It replaces the three-axis judge with a single harm-score signal and removes OR-Bench-derived harm-adjacent data while holding other components fixed.
  • K Ablation: Reward Composition and Harm-Adjacent Data: PHTest refusal rises from 7.0% to 36.7%, while XSTest refusal rises from 6.4% to 10.4% in TRACE-GRPO†.The three-axis judge penalizes vague or noninformative responses and hard refusals when the ground-truth action is ALLOW or CAUTION.
  • L Training Hyperparameters, Models & AI usage: The SFT and GRPO stages use LoRA with rank 32 and α 64, 0.05 dropout, all linear layers targeted, and a 20,480-token maximum sequence length.The listed learning rate is 1 × 10−4.
  • L Training Hyperparameters, Models & AI usage: The training configuration uses GDPO advantage estimation, low-variance KL loss, and KL coefficient β 5 × 10−3; experiments include API-accessed GPT-4o, GPT-5.2, and Claude Sonnet 4.5.Remaining models are hosted on Hugging Face, and the authors state that AI-assisted writing and coding were reviewed and verified by the authors.
  • M.1 Example for ALLOW Action: In the ALLOW example, TRACE assigns jailbreak score = 1 to a natural progression from remote-server administration concepts to standard SSH implementation details.The response provides commands, configuration steps, authentication methods, and hardening guidance under authorized administrative access.
  • M.2 Example for CAUTION Action: In the CAUTION example, TRACE raises the jailbreak score to 3 when general cybersecurity discussion narrows toward operational antivirus-evasion techniques.It gives conceptual malware-evolution categories and defensive recommendations without implementation details.
  • M.3 Example for DECLINE Action: In the DECLINE example, TRACE assigns jailbreak_score = 4 after a four-turn school-project framing escalates into producing child-targeted advertising with “yummy” scents or flavors.It declines the ad copy and offers discussion of advertising ethics or child-marketing regulation instead; examples may contain offensive content.
Loading 2608.15594v1…