---
title: "RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming"
description: "Multi-turn jailbreaks are a strong way to probe LLM safety. 15 references. Among them: 0."
authors: ["Yize Liu", "Yunyun Hou", "Aina Sui"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.925/"
doi: "10.18653/v1/2026.findings-acl.925"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/liu-2026-ramp-risk-aware-multi-turn/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/liu-2026-ramp-risk-aware-multi-turn/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/46/) / RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming

# RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming

**Authors:** Yize Liu, Yunyun Hou and Aina Sui · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.925/) · [PDF](https://aclanthology.org/2026.findings-acl.925.pdf) · [DOI 10.18653/v1/2026.findings-acl.925](https://doi.org/10.18653/v1/2026.findings-acl.925) · [OpenAlex](https://openalex.org/W7166862841)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Multi-turn jailbreaks are a strong way to probe LLM safety. Current attacks, however, mostly chain ad-hoc tricks or depend on costly trained attacker agents. They have no shared model of states and actions, and they struggle to keep query counts low while succeeding often. RAMP addresses this by treating a multi-turn jailbreak as a risk-aware PDDL planning task. Each dialogue is reduced to a symbolic state built from predicates, such as the safety pattern of the response and accumulated prefix clues. Common jailbreak tactics become high-level actions. A closed loop then runs each turn:
- a Judge labels the safety state and extracts clues;
- a Transitioner, learned from attack logs, predicts how states evolve;
- a Planner runs a risk-constrained lookahead search under a turn budget.

An attack model turns the chosen action into a prompt. On JailbreakBench and HarmBench, RAMP attacks open- and closed-source targets successfully even with tight turn limits, at favorable cost. This makes automated red-teaming more systematic and easier to interpret.

## Key points
- Each harmful task τ becomes a planning instance Π(τ) = (S, A, I_τ, G_τ, C). The state is a five-component discrete tuple.
- Five strategy primitives make up the action space, namely Role Definition, Response Steering, Refusal Suppression, Boundary Blurring, and Scenario Assumption.
- Re-judging the outputs with a second evaluator gave stable results:

  | Target | StrongREJECT ASR | GPT-4o-safety ASR |
  |---|---|---|
  | GPT-4-Turbo | 89.0% | 92.0% |
  | Llama3.1-70B | 92.0% | 90.0% |

- The Planner's choices depend on the state. In Strict states it mostly picks Refusal Suppression or Role Definition. In Leaky states it chooses Response Steering about 65% of the time.
- Limitations: the strategy set is fixed and finite, and the evaluation is mostly on JailbreakBench without stronger defenses.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

Also on the byline: [Communication University of China](https://ror.org/04facbs33).

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Yize Liu, Yunyun Hou and Aina Sui. 2026. RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{liu2026ramp,
  title = {{RAMP: Risk-Aware Multi-Turn Planning for Jailbreak Red-Teaming}},
  author = {Yize Liu, Yunyun Hou and Aina Sui},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.925},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.925}
}
```

- [← previous RAG or Learning? Understanding the Limits of LLM Adaptation under Continuous Knowledge Drift in the Real World](https://md.research.elamur.ai/free/en/papers/liu-2026-rag-or-learning-understanding-limits/)
- [next → Ranking Human and LLM Texts Using Locality Statistics](https://md.research.elamur.ai/free/en/papers/wang-2026-ranking-human-llm-texts-locality/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/46/)

## References

15 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. David Bai, Ishika Singh, David Traum, and Jesse Thomason. 2025. Twostep: Multi-agent task planning using classical planners and large language models. Preprint, arXiv:2403.17246. — [arXiv:2403.17246](https://arxiv.org/abs/2403.17246) [find](https://scholar.google.com/scholar?q=David+Bai%2C+Ishika+Singh%2C+David+Traum%2C+and+Jesse+Thomason%2E+2025%2E+Twostep%3A+Multi%2Dagent+task+planning+using+classical+planners+and+large+language+models%2E+Preprint%2C+arXiv%3A2403%2E17246%2E+%E2%80%94+%5BarXiv%3A2403%2E17246%5D%28)
2. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. 2024. [Jailbreakbench: An open robustness benchmark for jailbreaking large language models](https://md.research.elamur.ai/free/en/papers/chao-2024-jailbreakbench-open-robustness-benchmark-jailbreaking/). In…
3. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. [Jailbreaking black-box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). In Proceedings of the 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE.
4. Gautier Dagan, Frank Keller, and Alex Lascarides. 2023. [Dynamic planning with a llm](https://md.research.elamur.ai/free/en/papers/dagan-2023-dynamic-planning-llm/). Preprint, arXiv:2308.06391.
5. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. [A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily](https://md.research.elamur.ai/free/en/papers/ding-2023-wolf-sheep-s-clothing-generalized/). Preprint, arXiv:2311.08268.
6. Xiaohu Du, Fan Mo, Ming Wen, Tu Gu, Huadi Zheng, Hai Jin, and Jie Shi. 2025. Multi-turn jailbreaking large language models via attention shifting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23814–23822. [find](https://scholar.google.com/scholar?q=Xiaohu+Du%2C+Fan+Mo%2C+Ming+Wen%2C+Tu+Gu%2C+Huadi+Zheng%2C+Hai+Jin%2C+and+Jie+Shi%2E+2025%2E+Multi%2Dturn+jailbreaking+large+language+models+via+attention+shifting%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial+I)
7. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El-Showk, Stanislav Fort, and 17 others. 2022. [Red teaming…](https://md.research.elamur.ai/free/en/papers/ganguli-2022-red-teaming-language-models-reduce/)
8. Yifan Jiang, Kriti Aggarwal, Tanmay Laud, Kashif Munir, Jay Pujara, and Subhabrata Mukherjee. 2024. Red queen: Safeguarding large language models against concealed multi-turn jailbreaking. Preprint, arXiv:2409.17458. — [arXiv:2409.17458](https://arxiv.org/abs/2409.17458) [find](https://scholar.google.com/scholar?q=Yifan+Jiang%2C+Kriti+Aggarwal%2C+Tanmay+Laud%2C+Kashif+Munir%2C+Jay+Pujara%2C+and+Subhabrata+Mukherjee%2E+2024%2E+Red+queen%3A+Safeguarding+large+language+models+against+concealed+multi%2Dturn+jailbreaking%2E+Preprint%2C+a)
9. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024a. [AutoDAN: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). In The Twelfth International Conference on Learning Representations.
10. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024b. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/). Preprint, arXiv:2305.13860.
11. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). Preprint, arXiv:2402.04249.
12. OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, and 262 others.… — [GPT-4 Technical Report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/)
13. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. [Train…](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
14. Maya Pavlova, Erik Brinkman, Krithika Iyer, Vitor Albiero, Joanna Bitton, Hailey Nguyen, Joe Li, Cristian Canton Ferrer, Ivan Evtimov, and Aaron Grattafiori. 2024. Automated red teaming with goat: the generative offensive agent tester. Preprint, arXiv:2410.01606. — [arXiv:2410.01606](https://arxiv.org/abs/2410.01606) [find](https://scholar.google.com/scholar?q=Maya+Pavlova%2C+Erik+Brinkman%2C+Krithika+Iyer%2C+Vitor+Albiero%2C+Joanna+Bitton%2C+Hailey+Nguyen%2C+Joe+Li%2C+Cristian+Canton+Ferrer%2C+Ivan+Evtimov%2C+and+Aaron+Grattafiori%2E+2024%2E+Automated+red+teaming+with+goat%3A+the)
15. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/). Preprint, arXiv:2202.03286.

*Updated 2 November 2026*