{"id":"https://openalex.org/W7161030552","doi":"https://doi.org/10.48550/arxiv.2605.11002","title":"MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks","display_name":"MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks","publication_year":2026,"publication_date":"2026-05-10","ids":{"openalex":"https://openalex.org/W7161030552","doi":"https://doi.org/10.48550/arxiv.2605.11002"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.11002","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11002","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.11002","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136071026","display_name":"Xinkai Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Xinkai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136007669","display_name":"Zhipeng Wei","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wei, Zhipeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125502321","display_name":"Huanli Gong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gong, Huanli","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136009034","display_name":"Jing Ting Zheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zheng, Jing Ting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136065689","display_name":"Yuchen Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yuchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136048286","display_name":"Yue Dong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dong, Yue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136023073","display_name":"N. Benjamin Erichson","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Erichson, N. Benjamin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.14000000059604645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.14000000059604645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12268","display_name":"Deception detection and forensic psychology","score":0.08940000087022781,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.0868000015616417,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8093000054359436},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.7281000018119812},{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.5741000175476074},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4855000078678131},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.4571000039577484},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.41359999775886536},{"id":"https://openalex.org/keywords/resource","display_name":"Resource (disambiguation)","score":0.39750000834465027}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8093000054359436},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.76910001039505},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.7281000018119812},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.5741000175476074},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4855000078678131},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.4571000039577484},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.41359999775886536},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.39750000834465027},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.38420000672340393},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3781000077724457},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.311599999666214},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2874999940395355},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C28420585","wikidata":"https://www.wikidata.org/wiki/Q2665075","display_name":"Timing attack","level":4,"score":0.26010000705718994},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.2563000023365021}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.11002","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11002","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.11002","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11002","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Multi-turn":[0],"jailbreaks":[1,85],"exploit":[2],"the":[3,28,147,152,196,226],"ability":[4],"of":[5,17,119,149,228],"large":[6],"language":[7],"models":[8],"to":[9],"accumulate":[10],"and":[11,53,105,116,131,143,164,209,230],"act":[12],"on":[13],"conversational":[14],"context.":[15],"Instead":[16],"stating":[18],"a":[19,58,78,185,200,218],"harmful":[20],"request":[21],"directly,":[22],"an":[23,31],"attacker":[24],"can":[25,188],"gradually":[26],"steer":[27],"conversation":[29],"toward":[30],"unsafe":[32],"answer.":[33],"Recent":[34],"methods":[35,115],"demonstrate":[36],"this":[37],"risk,":[38],"but":[39],"they":[40],"are":[41,134],"usually":[42],"evaluated":[43],"as":[44,93],"black-box":[45],"pipelines":[46],"with":[47],"different":[48,72],"budgets,":[49],"judges,":[50],"retry":[51],"rules,":[52],"strategy":[54,176,187],"generation":[55,156,177],"procedures.":[56],"As":[57],"result,":[59],"it":[60],"is":[61,178],"often":[62],"unclear":[63],"whether":[64],"reported":[65],"gains":[66],"reflect":[67],"stronger":[68,232],"attack":[69,92,99,114,122,202],"mechanisms":[70],"or":[71],"experimental":[73],"conditions.":[74,88],"We":[75,170],"introduce":[76],"MT-JailBench,":[77,125],"modular":[79,219],"evaluation":[80,97,132],"framework":[81,220],"for":[82,158,221],"benchmarking":[83],"multi-turn":[84,223],"under":[86],"fixed":[87,186],"MT-JailBench":[89,215],"implements":[90],"each":[91],"five":[94],"interacting":[95],"modules:":[96],"function,":[98],"strategy,":[100],"prompt":[101,103,155],"generation,":[102],"refinement,":[104],"flow":[106,165],"control.":[107],"This":[108],"design":[109],"enables":[110],"fair":[111],"comparison":[112],"across":[113,211],"component-wise":[117],"analysis":[118],"what":[120],"drives":[121],"success.":[123],"Using":[124],"we":[126],"find":[127,172],"that":[128,173,204],"resource":[129],"budgets":[130],"functions":[133],"major":[135],"confounders:":[136],"controlling":[137],"turns,":[138],"retries,":[139],"interactions,":[140],"sampled":[141],"strategies,":[142],"judges":[144],"substantially":[145],"change":[146],"ranking":[148],"attacks.":[150],"At":[151],"component":[153],"level,":[154],"accounts":[157],"most":[159],"performance":[160],"variation,":[161],"while":[162],"refinement":[163],"control":[166],"provide":[167],"moderate":[168],"gains.":[169],"also":[171],"explicit":[174],"dynamic":[175],"not":[179],"always":[180],"necessary;":[181],"stochastic":[182],"sampling":[183],"from":[184],"rival":[189],"more":[190],"elaborate":[191],"diversification":[192],"mechanisms.":[193],"Finally,":[194],"recomposing":[195],"best":[197],"components":[198],"yields":[199],"strong":[201],"configuration":[203],"outperforms":[205],"its":[206],"source":[207],"attacks":[208],"generalizes":[210],"diverse":[212],"target":[213],"LLMs.":[214],"therefore":[216],"provides":[217],"comparing":[222],"jailbreaks,":[224],"understanding":[225],"impact":[227],"components,":[229],"guiding":[231],"red-teaming":[233],"evaluations.":[234]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-14T00:00:00"}