@inproceedings{liu-etal-2026-ramp,
title = "{RAMP}: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming",
author = "Liu, Yize and
Hou, Yunyun and
Sui, Aina",
editor = "Liakata, Maria and
Moreira, Viviane P. and
Zhang, Jiajun and
Jurgens, David",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
month = jul,
year = "2026",
address = "San Diego, California, United States",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-acl.925/",
doi = "10.18653/v1/2026.findings-acl.925",
pages = "18553--18564",
ISBN = "979-8-89176-395-1",
abstract = "Multi-turn jailbreaking is a critical approach for evaluating the safety of large language models (LLMs). However, existing methods largely rely on heuristic strategies or trained attack agents, lacking a unified state-action formulation and systematic search over strategy compositions, and often struggling to balance attack success rate with query overhead. We propose RAMP, which formulates multi-turn jailbreaking as a risk-aware PDDL planning problem. Specifically, we characterize dialogue safety using predicate-based states, abstract common jailbreak strategies as high-level actions, and introduce a closed-loop framework that iteratively plans and executes each turn via a Judge, a Transitioner, and a Planner. Experimental results show that RAMP achieves consistently strong attack performance across both open-source and closed-source target models, while remaining effective under stricter turn budgets and yielding a favorable efficiency{--}effectiveness trade-off. Ablation studies, interpretability analyses, and extended experiments further show that multi-step planning, clue accumulation, and consistent findings across evaluator settings are key factors underlying these gains."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="liu-etal-2026-ramp">
<titleInfo>
<title>RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yize</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yunyun</namePart>
<namePart type="family">Hou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Aina</namePart>
<namePart type="family">Sui</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-07</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: ACL 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Maria</namePart>
<namePart type="family">Liakata</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Viviane</namePart>
<namePart type="given">P</namePart>
<namePart type="family">Moreira</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jiajun</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">David</namePart>
<namePart type="family">Jurgens</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">San Diego, California, United States</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-395-1</identifier>
</relatedItem>
<abstract>Multi-turn jailbreaking is a critical approach for evaluating the safety of large language models (LLMs). However, existing methods largely rely on heuristic strategies or trained attack agents, lacking a unified state-action formulation and systematic search over strategy compositions, and often struggling to balance attack success rate with query overhead. We propose RAMP, which formulates multi-turn jailbreaking as a risk-aware PDDL planning problem. Specifically, we characterize dialogue safety using predicate-based states, abstract common jailbreak strategies as high-level actions, and introduce a closed-loop framework that iteratively plans and executes each turn via a Judge, a Transitioner, and a Planner. Experimental results show that RAMP achieves consistently strong attack performance across both open-source and closed-source target models, while remaining effective under stricter turn budgets and yielding a favorable efficiency–effectiveness trade-off. Ablation studies, interpretability analyses, and extended experiments further show that multi-step planning, clue accumulation, and consistent findings across evaluator settings are key factors underlying these gains.</abstract>
<identifier type="citekey">liu-etal-2026-ramp</identifier>
<identifier type="doi">10.18653/v1/2026.findings-acl.925</identifier>
<location>
<url>https://aclanthology.org/2026.findings-acl.925/</url>
</location>
<part>
<date>2026-07</date>
<extent unit="page">
<start>18553</start>
<end>18564</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming
%A Liu, Yize
%A Hou, Yunyun
%A Sui, Aina
%Y Liakata, Maria
%Y Moreira, Viviane P.
%Y Zhang, Jiajun
%Y Jurgens, David
%S Findings of the Association for Computational Linguistics: ACL 2026
%D 2026
%8 July
%I Association for Computational Linguistics
%C San Diego, California, United States
%@ 979-8-89176-395-1
%F liu-etal-2026-ramp
%X Multi-turn jailbreaking is a critical approach for evaluating the safety of large language models (LLMs). However, existing methods largely rely on heuristic strategies or trained attack agents, lacking a unified state-action formulation and systematic search over strategy compositions, and often struggling to balance attack success rate with query overhead. We propose RAMP, which formulates multi-turn jailbreaking as a risk-aware PDDL planning problem. Specifically, we characterize dialogue safety using predicate-based states, abstract common jailbreak strategies as high-level actions, and introduce a closed-loop framework that iteratively plans and executes each turn via a Judge, a Transitioner, and a Planner. Experimental results show that RAMP achieves consistently strong attack performance across both open-source and closed-source target models, while remaining effective under stricter turn budgets and yielding a favorable efficiency–effectiveness trade-off. Ablation studies, interpretability analyses, and extended experiments further show that multi-step planning, clue accumulation, and consistent findings across evaluator settings are key factors underlying these gains.
%R 10.18653/v1/2026.findings-acl.925
%U https://aclanthology.org/2026.findings-acl.925/
%U https://doi.org/10.18653/v1/2026.findings-acl.925
%P 18553-18564
Markdown (Informal)
[RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming](https://aclanthology.org/2026.findings-acl.925/) (Liu et al., Findings 2026)
ACL