PaperlayerView exact revision on arXiv

Source-linked AI summary

Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking

Siyu Chen, Haoran Wang, Xiaojian Li, Yao Huang, Yinpeng Dong, Wei Xu

arXiv:2609.02414v1cs.CLcs.AI

TL;DR

Multi-turn jailbreak research lacks clear evidence about which conversational mechanisms make distributed harmful intent effective. BLUEPRINT separates theory-grounded influence-factor search from WORLDVIEWSIM’s coherent cross-turn context, achieving strong attack success with low query cost and revealing recurring operational recovery paths. The findings support trajectory-level, state-aware safety evaluation and defense, while remaining behavioral evidence built on a manually specified factor vocabulary.

  • Problem

    Existing methods obscure which conversational mechanisms drive vulnerability when harmful intent is distributed across multi-turn dialogue.

  • Method

    BLUEPRINT combines Monte Carlo Tree Search over 18 theory-grounded turn-level influence factors with WORLDVIEWSIM for coherent cross-turn situational context.

  • Results

    BLUEPRINT maintains 79.2% average ASR across six frontier models with the lowest average target-query cost, Avg. Q = 2.46, while exposing model-specific vulnerabilities and a recurring executable-task recovery pathway.

  • Takeaways & Limitations

    Robust multi-turn safety evaluation should monitor how dialogue state makes unsafe requests concrete and locally executable, alongside aggregate success rates.

  • Takeaways & Limitations

    The findings are behavioral rather than causal, and the 18-factor vocabulary is a manually specified, non-exhaustive operationalization whose generality requires further testing.

Abstract

from arXiv · show

Multi-turn jailbreak attacks demonstrate that harmful intent can be distributed across dialogue, yet existing methods obscure what conversational mechanisms drive vulnerability. We introduce BLUEPRINT, a safety-evaluation framework separating a factorized social-influence strategy space from WORLDVIEWSIM, a cross-turn situational context module. Monte Carlo Tree Search optimizes turn-level combinations of 18 theory-grounded influence factors across a four-turn trajectory. Across six frontier models, BLUEPRINT achieves near-ceiling ASR on major open-weight and proprietary models, while requiring the fewest average queries (2.46). The resulting trajectories further reveal model-specific vulnerability among resistant targets: each responds to distinct influence factors and strategy transitions, yet all share a common recovery pathway-shifting toward concrete, executable task framing consistently escapes hard-refusal states. Ablations confirm operational cues matter most: making requests actionable has the largest impact, gain framing is unusually potent, and some legitimacy appeals can backfire. These findings suggest robust multi-turn safety requires monitoring not only harmful content, but also how dialogue state makes unsafe requests appear concrete and locally executable.

1 Introduction

The introduction frames multi-turn jailbreak evaluation as a problem of identifying how factor combinations and evolving dialogue states shape compliance. BLUEPRINT addresses this by combining interpretable strategy search with coherent cross-turn situational context.

  • LLM deployment in high-stakes settings makes refusal robustness a central AI-safety evaluation problem.
  • Prompt-level jailbreak evaluation obscures which strategic components drive success and how their effectiveness varies with situational context.
  • Multi-turn compliance can depend on factor combinations whose effects change with dialogue state, role, task progression, and established rationale.
  • BLUEPRINT combines 18 theory-grounded influence factors with WORLDVIEWSIM, which maintains requester role, setting, temporal continuity, and institutional rationale across turns.Monte Carlo Tree Search selects turn-level factor combinations, and each trajectory records situated choices, model responses, and refusal-state transitions.
  • The framework treats evolving interaction state as central to shifting multi-turn attacks from refusal toward substantive compliance, rather than relying on a single strong prompt.
  • 79.2% average ASR across all six frontier models accompanies the lowest average target-query cost, Avg. Q = 2.46, compared with baselines.

2 Related Work

Related work moves from prompt-local jailbreak optimization toward factorized persuasion and multi-turn interaction, but leaves their cross-turn interplay underexplored. BLUEPRINT is motivated by treating situational continuity and influence factors as independently testable components.

  • Earlier jailbreak research largely optimized adversarial or automated prompt interventions within a single exchange, leaving cumulative interaction dynamics underexplained.
  • Social-influence and dual-process theories identify authority, urgency, gain–loss framing, capability, and consistency pressure as context-sensitive compliance cues.
  • Recent LLM safety research supports factorized persuasion analysis, but interactions between these factors and cross-turn social situations remain underexplored.
  • Worldview-conditioned compliance motivates combining cross-turn continuity with factorized strategy analysis because structured contexts shape which actions appear normal or permissible.Existing systems are described as treating scenarios as prompt wrappers rather than independently testable mechanisms.

3 Methodology

BLUEPRINT combines turn-level search over theory-grounded influence factors with WORLDVIEWSIM’s coherent cross-turn situational context, then uses MCTS to optimize complete attack trajectories.

  • BLUEPRINT Method: BLUEPRINT separates interpretable factor combinations from cross-turn situational context, using a factorized strategy space and WORLDVIEWSIM.The strategy space controls turn-level factors, while worldview simulation maintains requester role, setting, temporal continuity, and rationale.
  • Turn-Aligned Factorized Strategy Space: Each attack turn selects a binary factor vector, and the full K-turn strategy is encoded as g = [g1; . . . ; gK] ∈{0, 1}K×D.For four turns and D = 18 factors, the representation yields 272 possible configurations while preserving links between prompts and factor choices.
  • Turn-Aligned Factorized Strategy Space: The strategy space contains 18 social-influence factors covering task clarity, capability, legitimacy, authority, rapport, pressure, reward, loss, and continuity cues.The factors are theory-grounded and organized into five families for tractable, interpretable search and ablation.
  • WORLDVIEWSIM: Cross-Turn Worldview Simulation: WORLDVIEWSIM constructs a structured situation from the harmful query, turn index, prior history, and experience pool before prompt generation.It specifies temporal or event context, requester persona or role, respondent framing, and later-turn continuity in identity and project setting.
  • Prompt Generation: The prompt generator fuses selected factors with the simulated worldview, checks natural realization and coherence, and records realized factors for analysis.This makes factor-only search and worldview removal experimentally distinguishable, while preserving a mechanism trace of factor–worldview pairings and refusal-state transitions.
  • MCTS Optimization: MCTS explores partial and complete encodings with UCT selection, evaluates each rollout through the full pipeline, and uses the final judge score as fitness.Search terminates early when a score-5 trajectory is found, reducing target calls for easy behaviors.

4 Experiments

BLUEPRINT is evaluated across six target models and HarmBench behaviors using standardized attack, judge, cost, defense, mechanism, and ablation analyses. It achieves strong effectiveness with low selected target-query cost, while results show model-specific factor sensitivities, a common Task/Capability recovery pattern, and especially important Task/Capability and Reward/Gain families.

  • Evaluation setup: The evaluation covers all 80 HarmBench validation behaviors across six target models, using a fixed DeepSeek-V3.2 attack generator and unified 1–5 judge.The compared baselines span optimization-based, single-turn, and multi-turn attacks; reported metrics include ASR, MJS, and Avg. Q.
  • Main results: BLUEPRINT outperforms the strongest baseline on five of six targets while averaging 2.46 selected target queries.It reaches 100.0% ASR on Qwen3-Next-80B and Gemini-2.5-Flash, 98.8% on DeepSeek-V3.2, 75.0% on GLM-4.7, and 58.8% on GPT-5.1.
  • Main results: On DeepSeek-V3.2, BLUEPRINT achieves 98.8% ASR with 1.81 target calls-to-success and 3.7k target tokens-to-success.Trajectory-focused MCTS concentrates rollouts on promising strategy paths, while factorization supports incremental evaluation and early pruning.
  • Defense robustness: Static defenses provide limited disruption: paraphrasing increases ASR by 6.8 points, while guardrails block six prompts and reduce ASR by 2.5 points.PPL filtering reduces neither ASR nor selected prompts, with measured prompts below its threshold.
  • Mechanism analysis: The three resistant targets show distinct factor sensitivities, but Task/Capability is the only destination family associated with positive score recovery across all three.Among low-score transitions, Reward/Gain-to-Task/Capability has the highest observed eventual conversion rate at 30.0%.
  • Ablation study: Ablations identify Task/Capability and Reward/Gain as the most important factor families, reducing ASR by 18.8pp and 17.5pp respectively when removed.Removing WORLDVIEWSIM reduces ASR from 75.0% to 68.8%, while the authors characterize its primary role as maintaining continuity across turns.

5 Discussion

Multi-turn attack effectiveness depends on accumulated interaction state and locally executable framing, with resistant models showing distinct vulnerability profiles. The findings motivate defenses that track how unsafe requests become concrete across dialogue.

  • Accumulated interaction state, rather than any single prompt, governs multi-turn attack effectiveness.Relevant state includes accepted or refused content, established rationale, and the local framing of the next request.
  • Resistant targets exhibit distinct vulnerability profiles, so identical surface strategies can produce compliance in one model but refusal in another.
  • Reframing a refused request as a bounded, executable task is the most reliable recovery path across resistant targets.Broader persuasion is less reliable than operational specificity for recovering from hard refusal.
  • Ablations indicate that concrete or benefit-oriented framing converts unsafe goals into ordinary-looking subrequests, distributing the harmful signal across dialogue state.This makes isolated keyword, paraphrase, or per-turn detection poorly aligned with the attack surface.

6 Conclusion

BLUEPRINT separates turn-level social-influence strategies from the cross-turn worldview in which they are realized. Across six HarmBench targets, it combines high attack success with low selected target-query cost and reveals recurring, model-specific refusal dynamics.

  • BLUEPRINT separates factorized social-influence strategies from the cross-turn worldview in which those strategies are realized.
  • Across six HarmBench targets, BLUEPRINT achieves high ASR with low selected target-query cost without simply lengthening conversations.
  • Resistant targets differ in which factor dimensions activate near conversion, while concrete, actionable framing provides a recurring recovery route from low-score states.
  • Practical defenses should monitor how conversations become concrete and reward-framed over time rather than detecting isolated persuasion tactics or suspicious surface forms.The paper identifies broader testing across model families, domains, and counterfactual interventions as future work.

Limitations

The findings are behavioral rather than causal, and the 18-factor vocabulary is a theory-guided, manually specified operationalization rather than an exhaustive account of adversarial interaction.

  • The study does not isolate causal effects of individual worldview fields, factors, or state transitions on model compliance.Future work should use counterfactual interventions, human validation, and natural red-teaming traces to test generality.
  • The 18-factor vocabulary is manually specified and extensible, not an exhaustive ontology of social influence.The paper proposes testing and refining it across cultural, affective, institutional, multimodal, and tool-mediated contexts.

Ethics Statement

The paper frames BLUEPRINT as controlled, research-oriented safety evaluation and describes its theory-guided components, search procedures, generation checks, and evaluation setup. It also notes semantic overlap among worldview dimensions and reports safeguards around dual-use risks.

  • Ethics Statement: The work studies adversarial LLM safety vulnerabilities to inform stronger defenses, using research-accessible models and established benchmarks in controlled settings.The authors state that they neither deploy attacks nor distribute generated harmful content.
  • Methodological safeguards: The 18 social-influence factors form a theory-guided, extensible vocabulary, with individual factors used for turn-level search and families used for leave-one-family-out ablations.
  • Methodological safeguards: Monte Carlo Tree Search mutates next-turn factor bits, simulates complete trajectories, backpropagates final judge scores, and can stop early when a score of 5 is found.
  • Methodological safeguards: WORLDVIEWSIM jointly instantiates event setting, requester role, and requester–respondent relationship within a coherent situation state.These dimensions can semantically overlap because roles may convey setting or relationship information.
  • Methodological safeguards: Each turn selects active factors, generates worldview context and a user-facing message, applies self-checks, judges the response, and stores successful experiences for later rollouts.
  • Methodological safeguards: Dimension-level worldview ablations are diagnostic because information can remain recoverable through other dimensions, exemplars, or conversation history.The whole-module ablation is treated as the primary estimate of WORLDVIEWSIM’s contribution.
  • Methodological safeguards: The attack generator and judge are fixed to DeepSeek-V3.2, with factor dimension D = 18 and rollout budget R = 24 as an upper bound.Target-model calls along the selected trajectory measure execution cost rather than total MCTS optimization cost.

C.2 Evaluation Provenance and Uncertainty

BLUEPRINT is evaluated on all 80 HarmBench validation behaviors across six target models under documented procedure-level conditions. Reported uncertainty uses Wilson 95% intervals for observed score-5 ASR estimates, not broader-population or pairwise significance claims.

  • BLUEPRINT is evaluated on all 80 behaviors in the HarmBench validation split across six target models, using score 5 as the stopping rule.
  • The comparison preserves differences in structure, search procedure, turn or attempt budgets, early stopping, target adaptation, and evaluator provenance.
  • Wilson 95% binomial confidence intervals summarize observed score-5 ASR estimates for BLUEPRINT across the six targets.
  • These intervals are not pairwise significance tests and do not estimate performance over a broader population of harmful behaviors.

C.3 Evaluator Sensitivity and Human Calibration

The audit separates evaluator variation on fixed terminal responses from the online judge’s role in steering search. Human calibration supports the stricter score thresholds, while target-level vulnerability rankings remain stable across evaluators.

  • 2,842 of 2,862 attempted scores were successfully parsed in a fixed-output audit using six stateless LLM judges.
  • Score 3 contains a substantial gray zone, with 44/142 binary-safe judgments receiving exactly score 3.
  • At score ≥4, 73/75 judgments were paired with binary-harmful labels, while no binary-safe judgment received score 5.
  • The 4-of-6 judge panel agreed with the human median on 42/46 samples at score 5, with Cohen’s κ = 0.618.
  • DeepSeek-V3.2 was third-strictest at score 5, but its endpoint rates are not comparable to main-results ASR because it operated inside the search loop there.
  • The more-vulnerable versus more-resistant target split was unchanged across all six evaluators and three reporting thresholds, although absolute ASR under another online judge is unresolved.

C.5 Trajectory Dynamics

Successful BLUEPRINT trajectories generally improve through successive turns rather than jumping at the endpoint. More resistant targets separate from successful cases early, while vulnerable targets often reach score 5 by Turn 2.

  • 95.7–100.0% of successful selected trajectories are monotone non-decreasing in judge-score space.
  • DeepSeek-V3.2, Gemini-2.5-Flash, and Qwen3-Next-80B usually terminate successful trajectories by Turn 2.
  • Successful and failed trajectories differ at Turn 1 by 0.64–1.58 judge-score points across GLM-4.7, GPT-5.1, and GPT-OSS-120B.
  • Within successful trajectories, all five opening factor families converge to score 5 by the final reached turn.

C.6 WORLDVIEWSIM Dimension Diagnostics

WORLDVIEWSIM’s complete situation scaffold improves cross-turn score progression, but individual dimension ablations are difficult to interpret because omitted semantics often reappear in generated scenarios.

  • The full WORLDVIEWSIM condition raises selected-trajectory mean judge scores monotonically from 3.09 at Turn 1 to 3.78 at Turn 4.
  • Removing WORLDVIEWSIM as a whole reduces final ASR to 68.8%, versus 75.0% for the full system.
  • Removing D1, D2, or D3 individually yields 76.3%, 78.8%, and 72.5% final ASR, respectively, versus 75.0% for the full system.
  • Omitted semantics remain present at rates of 70–85% for D3, 25–47% for D2, and 8–18% for D1.
  • Because dimensions are integrated into one situation state, later generation context can reconstruct omitted semantics, limiting interpretation of individual-dimension null results.
Loading 2609.02414v1…