PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploits

AI summary

Overview

Research area: LLM security and adversarial red-teaming — specifically multi-turn jailbreak generation against large language models.

Technical level: Intermediate. The paper assumes familiarity with LLM APIs, jailbreaking terminology (attack success rate, refusal, ASR@K), and basic agentic/retrieval concepts, but the framework itself is described at a conceptual level.

Scope: The paper proposes PLAGUE, a three-phase plug-and-play framework (Planner, Primer, Finisher) with lifelong learning for generating multi-turn jailbreaks against black-box LLMs, evaluated on the 200-sample HarmBench standard set against leading commercial and open models.

What This Paper Is About

Most people interact with LLMs through multi-turn conversation, yet jailbreak research has focused largely on single-turn prompts, and existing multi-turn attacks struggle with adaptability, efficiency and effectiveness. PLAGUE breaks a multi-turn attack into three coordinated phases — Planner, Primer and Finisher — with a retrieval-based memory of previously successful strategies and a reflection module, so an attacker LLM can learn across attack attempts without access to model weights or gradients. The goal is a modular framework into which existing attacks such as GOAT, Crescendo and ActorBreaker can be plugged as individual components.

Key Contributions

1. A three-phase attack framework. PLAGUE decomposes a multi-turn attack into a Planner phase (plan initialization using retrieved in-context strategies), a Primer phase (context escalation through the first n−1 plan steps), and a Finisher phase (goal-based sampling using the frozen context).

2. A lifelong-learning memory architecture. Successful planning strategies are stored in a vector-embedding memory bank, indexed by the initial objective, and retrieved by semantic cosine similarity to seed future plans.

3. A fine-grained Rubric Scorer for intermediate feedback. A tertiary scorer rates responses on Compliance (2 points), Practicality (2 points), Level of detail (2 points) and Relevance (4 points), with maximum emphasis on goal relevance.

4. A plug-and-play modularity demonstration. The paper shows GOAT, Crescendo and ActorBreaker can each substitute for the Planning or Finisher module, and that swapping components changes downstream attack success and diversity.

Main Findings

• State-of-the-art attack success. PLAGUE achieves an SRE (StrongReject) of 81.4% on OpenAI's o3 and 67.3% on Claude's Opus 4.1 — two models the paper describes as highly resistant to jailbreaks in the safety literature.

• Relative improvement over prior best. The paper reports improving by a factor of 32.14% on OpenAI's o3 and 40.2% on Claude's Opus 4.1 relative to the previous state-of-the-art baselines.

• High absolute results on other models. Up to 97.8% success on Deepseek-R1 (SRE 0.978 in Table 2) and 93.1% SRE on OpenAI's o1, within six turns of budget. The introduction also cites up to 97.8% on Deepseek-R1, GPT-4o and Meta's Llama 3.3-70B; Table 2 reports SRE 0.958 for Llama 3.3 70B, and GPT-4o does not appear as a separate column in the table provided.

• Component ablation shows which pieces matter. Starting from GOAT alone on o3 (Bin-ASR 0.445, SRE 0.587), adding backtracking gives 0.47 / 0.612, adding reflection gives 0.59 / 0.761, adding the Planner gives 0.582 / 0.773, and adding retrieved successful strategies gives 0.662 / 0.814. The paper reports these additions improve performance by 30% in ASR for GOAT and 109% for Claude Opus 4.1.

• Model-specific bottlenecks differ. For o3, the largest single contribution came from reflection, followed by strategy retrieval. For Claude, backtracking was the most significant factor, with retrieval playing the next most important role.

• Claude Opus 4.1 resists the GOAT Finisher. Using GOAT as the Finisher, PLAGUE reaches Bin-ASR 0.318 and SRE 0.465 on Claude Opus 4.1, below Crescendo's 0.352 / 0.48. Switching the Finisher to Crescendo raises PLAGUE to Bin-ASR 0.467 and SRE 0.673.

• Diversity can be bought with planning modules. Incorporating ActorBreaker's planning module improves diversity by 15% with negligible degradation in ASR, even though ActorBreaker's overall performance falls behind PLAGUE by a factor of 30%–90% across evaluations.

• Query budgets are comparable, not inflated. PLAGUE invokes the target LLM roughly three times (e.g., 3.77 total with the Crescendo finisher variant on Claude Opus 4.1; 3.50 on o1; 3.85 on o3; 2.96 on Llama 3.3 70B; 2.56 on Deepseek-R1) — similar to Crescendo and within one call of GOAT. ActorBreaker averages 5.28–5.80 target calls plus 4.00 Planner calls.

• Performance plateaus at six turns. Figure 2 shows SRE scaling roughly linearly with conversation turns up to six and then plateauing; performance at eight turns is comparable to six turns, with the authors attributing this to context length causing the attacker to forget earlier turns and drift from the objective.

• Baseline weaknesses documented. Crescendo's ASR can be as low as 37.4% on OpenAI's o3, while fixed-strategy attacks like ActorBreaker plateau around 60% ASR for most models. The paper attributes X-Teaming's low performance to fewer TextGrad steps; the specific X-Teaming and FITD figures are stated to be in Table 6, which is not included in the provided content.

Methodology in Plain English

Each attack starts with a goal drawn from the HarmBench benchmark. An attacker LLM — Deepseek-R1 across all experiments — is paired with a rubric-scoring LLM and a separate evaluator judge.

Planning. The attacker retrieves strategies from a vector memory bank of previously successful attacks, selected by cosine similarity (threshold 0.6 between the current goal embedding and stored goal embeddings), capped at two in-context examples. If fewer than two are retrieved, a strategy is drawn at random from the library. The library is initialized with two strategies adapted from Crescendo examples. The Planner produces a two-step plan.

Priming. The final plan step is deliberately held back, and the first step is used to steer the conversation toward adversarial territory through seemingly benign exchange. Each turn is scored against the step-specific question with a strict bar of 7/10; falling below it triggers backtracking (removing the turn from the target's history but keeping it in the attacker's history) and reflection.

Finishing. Using the frozen context and the original goal, the attacker attempts the final blow. A relaxed bar of 3/10 triggers backtracking and a re-attempt with the remaining budget decremented by one. A score above 8/10 marks success; if successful, only the final query goes to the evaluator, otherwise the highest-scoring finisher round is used.

Lifelong learning and memory hygiene. Successful strategies (name, definition, and the exact questions that worked) are written back to the memory bank keyed by objective embedding. Conversation summarization — using a locally hosted Llama 3.1-8B Instruct — compresses past replies so the attacker does not forget earlier context as the window fills.

Setup. Evaluation uses HarmBench's 200-sample standard set. Qwen3-235B-A22B-fp8 serves as the evaluator, Deepseek-R1 as the attacker, and Qwen3-Embedding-0.6B for embeddings, all accessed via official API providers. The evaluator runs at temperature 0.0 and the rubric scorer at the Qwen-recommended 0.6. Two metrics are reported: binary-ASR (stricter, for comparability with prior work) and the StrongReject evaluation score (graded harmfulness). Results use ASR@K with K=2, averaging over three runs, under a six-call budget to the target model.

Why This Matters

The paper argues that multi-turn dialogue is the dominant interaction mode for LLMs and agentic workflows, yet it remains the least formally studied attack surface. The framework's modularity means safety researchers can systematically isolate which defense weaknesses a given component exploits, rather than treating a jailbreak as a monolithic artifact.

Real-world applications:

• Pre-deployment safety testing of commercial LLM APIs, where weights are inaccessible and only black-box querying is possible.
• Reproducible benchmarking of guardrails: a fixed six-call budget and consistent evaluator make cross-model comparisons fairer.
• Targeted hardening — the results showing Claude Opus 4.1 resists GOAT-style finishers but not Crescendo-style ones point to model-specific alignment gaps that defenders could prioritize.
• Diversity-aware auditing, where measuring how attacks vary (not just whether they succeed) informs broader threat modeling.

Industry relevance: The work originates from A10 Networks with a University of Massachusetts Amherst affiliation, and the code is publicly released, positioning it as a practical tool for enterprise security teams and model providers evaluating model vulnerability.

Future Directions

1. Better diversity-inducing Planners. The authors explicitly leave development of a stronger diversity-inducing Planner to future work, noting ActorBreaker currently leads on diversity.

2. Formal prompt optimization for the Finisher. They suggest leveraging a more formal prompt optimizer such as Khattab et al. (2023) to improve the Finisher phase.

3. Understanding why components help differently per model. The ablation reveals reflection dominates for o3 while backtracking dominates for Claude, but the underlying cause is described as an observation rather than explained.

4. Mitigating context drift and forgetting. The plateau at six turns is attributed to long-context forgetting and weak iterations on prior feedback, suggesting summarization or memory management improvements as a lever for scaling beyond six turns.

Target Audience

Safety and alignment researchers studying jailbreak robustness; red-teaming practitioners who need black-box attack tooling with a controlled query budget; LLM developers and platform security teams evaluating whether deployed guardrails hold under multi-turn pressure; and agentic-systems researchers interested in lifelong learning, retrieval-augmented memory, and reflection as design patterns that transfer beyond adversarial settings.

Authors’ abstract

Large Language Models (LLMs) are improving at an exceptional rate. With the advent of agentic workflows, multi-turn dialogue has become the de facto mode of interaction with LLMs for completing long and complex tasks. While LLM capabilities continue to improve, they remain increasingly susceptible to jailbreaking, especially in multi-turn scenarios where harmful intent can be subtly injected across the conversation to produce nefarious outcomes. While single-turn attacks have been extensively explored, adaptability, efficiency and effectiveness continue to remain key challenges for their multi-turn counterparts. To address these gaps, we present PLAGUE, a novel plug-and-play framework for designing multi-turn attacks inspired by lifelong-learning agents. PLAGUE dissects the lifetime of a multi-turn attack into three carefully designed phases (Primer, Planner and Finisher) that enable a systematic and information-rich exploration of the multi-turn attack family. Evaluations show that red-teaming agents designed using PLAGUE achieve state-of-the-art jailbreaking results, improving attack success rates (ASR) by more than 30% across leading models in a lesser or comparable query budget. Particularly, PLAGUE enables an ASR (based on StrongReject) of 81.4% on OpenAI's o3 and 67.3% on Claude's Opus 4.1, two models that are considered highly resistant to jailbreaks in safety literature. Our work offers tools and insights to understand the importance of plan initialization, context optimization and lifelong learning in crafting multi-turn attacks for a comprehensive model vulnerability evaluation.