Multiple Turns, Short Horizons: Measuring Effective-Horizon Compression in Jailbreaks
The paper studies multi-turn LLM jailbreaks by truncating early attacker turns, replaying only the later queries in a fresh conversation with regenerated victim responses, and measuring the shortest suffix that can recover the same attack progress, which it calls the effective horizon. The interesting bit is the finding that about half the query history is often enough, and that this compression can help resume failed attacks, improve attacker training via downweighted early turns, and keep defense evaluation calibrated with short reward windows, though the claims seem empirical and depend on how “same attack progress” is defined and measured.
Abstract
Multi-turn jailbreaks use feedback from a victim large language model to adapt their queries over several turns. However, once an effective trajectory has been found, it is unclear how much of the earlier query history is still needed. In this work, we study this by removing early attacker queries and running the remaining queries again in a new conversation while regenerating the victim's responses. We define the effective horizon as the shortest remaining query sequence that recovers the same attack progress. Empirically, we find that roughly half of the original query sequence is sufficient on average to recover the same attack progress. We call this phenomenon effective-horizon compression. We show that this shorter history can recover the best point reached during an unsuccessful attack and provide a better starting point for continuing the attack. It also helps identify which earlier queries should receive less learning signal during attacker training, and downweighting those queries improves performance. We further find that short reward-propagation windows preserve calibrated defense performance close to full-trajectory returns. These results show that multi-turn attacks can contain more queries than are needed to recover the progress reached later in the interaction.