Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking
This repository is the Hugging Face project page for TRACE (TuRn-level Assignment for CrEdit),
a framework for turn-aware credit assignment in reinforcement-learning-based multi-turn red
teaming. It collects the paper links, official model releases, a lightweight inference example,
and release documentation. Model weights and model-specific settings remain in each model
repository.
Dual-use warning: TRACE studies adversarial prompts designed to reveal language-model safety
failures. Use the released artifacts only for authorized, controlled safety research. Do not test
systems without permission, expose the attacker as an unrestricted service, or automatically
execute generated content.
Overview
Multi-turn jailbreak strategies can distribute harmful intent across apparently benign dialogue
turns. TRACE addresses the resulting credit-assignment problem: individual turns can contribute
unequally, at different phases of an attack, and against different target models. The method uses
leave-one-turn-out semantic masking to assign credit in successful trajectories and harmfulness and
semantic-relevance signals to assign penalties in failed trajectories. The same turn-level signals
can also support earlier defensive intervention.
Paper
Title: Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking
The model repository contains the weights, tokenizer, Transformers configuration, exact prompt
contract, decoding settings, license, and model-specific safety information.
Interactive inference
inference.py is a lightweight manual orchestration example. It generates one
attacker query at a time and asks the operator to paste the response from a separately operated,
authorized target model. It deliberately does not contact a target endpoint or run a safety judge.
The script automatically downloads prompt_template.json from the selected model repository. For
a local model directory, place that file beside the checkpoint or pass --prompt-config PATH.
The defaults reproduce the attacker-side validation sampling configuration:
Setting
Value
Maximum new tokens
128
Sampling
enabled
Temperature
0.5
Top-p
0.9
Top-k
disabled (-1 in vLLM; 0 in Transformers)
Maximum interaction turns
5
The target model's response is intentionally appended as a user message in the attacker model's
conversation. Attacker queries occupy the assistant role. The exact system message, initial user
template, and role convention are model-specific and are documented in the
prompt_template.json
file and Model Card.
Results
The paper reports ASR@1 (%) under a five-turn limit using the HarmBench Classifier. HB, JBB, and WJB
denote HarmBench, JailbreakBench, and WildJailbreak, respectively.
Evaluation target
HB
JBB
WJB
Target average
Qwen2.5-7B-Instruct
90.57
87.72
90.50
89.60
Llama-3.1-8B-Instruct
84.48
89.09
88.67
87.41
gpt-oss-20b
83.64
86.06
83.17
84.29
Overall
86.23
87.62
87.45
87.10
See the paper for baselines, alternative judges, transfer evaluations, confidence intervals, and
the complete protocol.
Repository contents
File
Purpose
README.md
Project overview, paper, models, usage, and reported results
inference.py
Interactive multi-turn attacker inference example
requirements.txt
Minimal dependencies for the inference example
Citation
bibtex
1@misc{he2026turnsmattercreditassignment,
2 title = {Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking},
3 author = {Zhida He and Xiaoyu Wen and Han Qi and Ziyuan Zhou and Peng Yu and
4 Xingcheng Xu and Dongrui Liu and Xia Hu and Chaochao Lu and Qiaosheng Zhang},
5 year = {2026},
6 eprint = {2605.08778},
7 archivePrefix = {arXiv},
8 primaryClass = {cs.AI},
9 url = {https://arxiv.org/abs/2605.08778}
10}
