TRACE

TRACE

Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking

This repository is the Hugging Face project page for TRACE (TuRn-level Assignment for CrEdit), a framework for turn-aware credit assignment in reinforcement-learning-based multi-turn red teaming. It collects the paper links, official model releases, a lightweight inference example, and release documentation. Model weights and model-specific settings remain in each model repository.

Dual-use warning: TRACE studies adversarial prompts designed to reveal language-model safety failures. Use the released artifacts only for authorized, controlled safety research. Do not test systems without permission, expose the attacker as an unrestricted service, or automatically execute generated content.

Overview

Multi-turn jailbreak strategies can distribute harmful intent across apparently benign dialogue turns. TRACE addresses the resulting credit-assignment problem: individual turns can contribute unequally, at different phases of an attack, and against different target models. The method uses leave-one-turn-out semantic masking to assign credit in successful trajectories and harmfulness and semantic-relevance signals to assign penalties in failed trajectories. The same turn-level signals can also support earlier defensive intervention.

Paper

• Title: Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking
• Authors: Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Peng Yu, Xingcheng Xu, Dongrui Liu, Xia Hu, Chaochao Lu, Qiaosheng Zhang
• ^* Equal contribution.
• arXiv: https://arxiv.org/abs/2605.08778
• PDF: https://arxiv.org/pdf/2605.08778
• DOI: https://doi.org/10.48550/arXiv.2605.08778

The PDF is linked from arXiv rather than duplicated here so that readers receive the current paper version.

Code

The complete training and evaluation implementation is maintained at:

• https://github.com/xsddys/TRACE

Model releases

The model repository contains the weights, tokenizer, Transformers configuration, exact prompt contract, decoding settings, license, and model-specific safety information.

Interactive inference

inference.py is a lightweight manual orchestration example. It generates one attacker query at a time and asks the operator to paste the response from a separately operated, authorized target model. It deliberately does not contact a target endpoint or run a safety judge.

Install the inference-only dependencies:

pip install -r requirements.txt

Run the released TRACE (mix) checkpoint:

python inference.py \
  --model XiaoyuWen/TRACE-Mix-Qwen2.5-3B-Instruct \
  --objective "<AUTHORIZED_RED_TEAM_OBJECTIVE>"

The script automatically downloads prompt_template.json from the selected model repository. For a local model directory, place that file beside the checkpoint or pass --prompt-config PATH.

The defaults reproduce the attacker-side validation sampling configuration:

The target model's response is intentionally appended as a user message in the attacker model's conversation. Attacker queries occupy the assistant role. The exact system message, initial user template, and role convention are model-specific and are documented in the prompt_template.json file and Model Card.

Results

The paper reports ASR@1 (%) under a five-turn limit using the HarmBench Classifier. HB, JBB, and WJB denote HarmBench, JailbreakBench, and WildJailbreak, respectively.

See the paper for baselines, alternative judges, transfer evaluations, confidence intervals, and the complete protocol.

Repository contents

Citation

@misc{he2026turnsmattercreditassignment,
  title         = {Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking},
  author        = {Zhida He and Xiaoyu Wen and Han Qi and Ziyuan Zhou and Peng Yu and
                   Xingcheng Xu and Dongrui Liu and Xia Hu and Chaochao Lu and Qiaosheng Zhang},
  year          = {2026},
  eprint        = {2605.08778},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  url           = {https://arxiv.org/abs/2605.08778}
}