Elamur Research⌕
☰
home / papers / 2026 / RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming

RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming

Paper · 2026 · Yize Liu, Yunyun Hou and Aina Sui

Summary

Multi-turn jailbreaks are a strong way to probe LLM safety. Current attacks, however, mostly chain ad-hoc tricks or depend on costly trained attacker agents. They have no shared model of states and actions, and they struggle to keep query counts low while succeeding often. RAMP addresses this by treating a multi-turn jailbreak as a risk-aware PDDL planning task. Each dialogue is reduced to a symbolic state built from predicates, such as the safety pattern of the response and accumulated prefix clues. Common jailbreak tactics become high-level actions. A closed loop then runs each turn:

  • a Judge labels the safety state and extracts clues;
  • a Transitioner, learned from attack logs, predicts how states evolve;
  • a Planner runs a risk-constrained lookahead search under a turn budget.

An attack model turns the chosen action into a prompt. On JailbreakBench and HarmBench, RAMP attacks open- and closed-source targets successfully even with tight turn limits, at favorable cost. This makes automated red-teaming more systematic and easier to interpret.

Key points

  • Each harmful task τ becomes a planning instance Π(τ) = (S, A, I_τ, G_τ, C). The state is a five-component discrete tuple.

  • Five strategy primitives make up the action space, namely Role Definition, Response Steering, Refusal Suppression, Boundary Blurring, and Scenario Assumption.

  • Re-judging the outputs with a second evaluator gave stable results:

    TargetStrongREJECT ASRGPT-4o-safety ASR
    GPT-4-Turbo89.0%92.0%
    Llama3.1-70B92.0%90.0%

  • The Planner's choices depend on the state. In Strict states it mostly picks Refusal Suppression or Role Definition. In Leaky states it chooses Response Steering about 65% of the time.

  • Limitations: the strategy set is fixed and finite, and the evaluation is mostly on JailbreakBench without stronger defenses.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

Also on the byline: Communication University of China.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Yize Liu, Yunyun Hou and Aina Sui. 2026. RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.925

@inproceedings{liu2026ramp,
  title = {{RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming}},
  author = {Yize Liu, Yunyun Hou and Aina Sui},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.925},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.925}
}

References

15 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. David Bai, Ishika Singh, David Traum, and Jesse Thomason. 2025. Twostep: Multi-agent task planning using classical planners and large language models. Preprint, arXiv:2403.17246. — [arXiv:2403.17246](https://arxiv.org/abs/2403.17246) find
  2. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In…
  3. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking black-box large language models in twenty queries. In Proceedings of the 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE.
  4. Gautier Dagan, Frank Keller, and Alex Lascarides. 2023. Dynamic planning with a llm. Preprint, arXiv:2308.06391.
  5. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. Preprint, arXiv:2311.08268. find
  6. Xiaohu Du, Fan Mo, Ming Wen, Tu Gu, Huadi Zheng, Hai Jin, and Jie Shi. 2025. Multi-turn jailbreaking large language models via attention shifting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23814–23822. find
  7. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El-Showk, Stanislav Fort, and 17 others. 2022. Red teaming…
  8. Yifan Jiang, Kriti Aggarwal, Tanmay Laud, Kashif Munir, Jay Pujara, and Subhabrata Mukherjee. 2024. Red queen: Safeguarding large language models against concealed multi-turn jailbreaking. Preprint, arXiv:2409.17458. — [arXiv:2409.17458](https://arxiv.org/abs/2409.17458) find
  9. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024a. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations.
  10. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024b. Jailbreaking chatgpt via prompt engineering: An empirical study. Preprint, arXiv:2305.13860.
  11. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. Preprint, arXiv:2402.04249.
  12. OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, and 262 others.… — GPT-4 Technical Report
  13. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Train…
  14. Maya Pavlova, Erik Brinkman, Krithika Iyer, Vitor Albiero, Joanna Bitton, Hailey Nguyen, Joe Li, Cristian Canton Ferrer, Ivan Evtimov, and Aaron Grattafiori. 2024. Automated red teaming with goat: the generative offensive agent tester. Preprint, arXiv:2410.01606. — [arXiv:2410.01606](https://arxiv.org/abs/2410.01606) find
  15. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. Preprint, arXiv:2202.03286.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-ramp-risk-aware-multi-turn/