arXiv cs.AI· Zhipeng Wei, Michael Lee, N. Benjamin Erichson·· 13 小时前AI 评分34
多轮越狱攻击的有效视界压缩：约一半查询序列即可恢复同等攻击进展
Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks
AI 导读
研究提出“有效视界”概念，衡量多轮越狱攻击中恢复同等攻击进展所需的最短查询序列，实验发现平均约一半的原始查询序列就足够，称为有效视界压缩。该短历史可恢复未成功攻击所达到的最佳点，并为继续攻击提供更好起点；据此对早期查询降低学习信号权重可提升攻击者训练效果。短奖励传播窗口还能保持接近全轨迹回报的校准防御性能。
正文 · 原文
Abstract:Multi-turn jailbreaks use feedback from a victim large language model to adapt their queries over several turns. However, once an effective trajectory has been found, it is unclear how much of the earlier query history is still needed. In this work, we study this by removing early attacker queries and running the remaining queries again in a new conversation while regenerating the victim's responses. We define the effective horizon as the shortest remaining query sequence that recovers the same attack progress. Empirically, we find that roughly half of the original query sequence is sufficient on average to recover the same attack progress. We call this phenomenon effective-horizon compression. We show that this shorter history can recover the best point reached during an unsuccessful attack and provide a better starting point for continuing the attack. It also helps identify which earlier queries should receive less learning signal during attacker training, and downweighting those queries improves performance. We further find that short reward-propagation windows preserve calibrated defense performance close to full-trajectory returns. These results show that multi-turn attacks can contain more queries than are needed to recover the progress reached later in the interaction.
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.22928 [cs.AI] |
| (or arXiv:2610.22928v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.22928 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Zhipeng Wei [view email]
[v1]
Fri, 16 Oct 2026 04:44:43 UTC (170 KB)
来源：arXiv cs.AI · arxiv.org