D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting

2026-05-31

AI Summary

Existing defense methods struggle to disrupt the iterative optimization process in multi-turn jailbreaking attacks that rely on feedback from evaluator models. This work proposes a semantics-preserving adversarial output rewriting mechanism that intervenes before the victim large language model’s response is evaluated by the attacker, generating semantically equivalent but differently rated alternative formulations to mislead the attacker’s prompt optimization. It introduces, for the first time, semantics-invariant adversarial perturbations into the multi-turn jailbreaking feedback loop. The approach constructs a dedicated dataset and trains the rewriter using supervised fine-tuning combined with direct preference optimization. Experiments demonstrate that the method substantially reduces the success rate of state-of-the-art multi-turn jailbreaking attacks on HarmBench while preserving performance on benign tasks.

Abstract

Multi-turn jailbreak attacks pose a growing threat to large language model (LLM) safety because they exploit feedback from auxiliary judge models to iteratively refine prompts toward harmful goals. Existing defenses largely detect or block unsafe content at individual turns or at the final response, leaving the judge-driven refinement loop intact and allowing attackers to extract informative feedback from intermediate interactions. We introduce D-Judge, a semantics-preserving output rewriting defense that intervenes directly in this loop by rewriting the victim LLM's responses before they are evaluated by the attacker's judge. By misaligning the judge's feedback signal without changing the meaning of the original response, D-Judge derails the attacker's prompt-refinement process, causing subsequent queries to be optimized against a distorted signal of attack progress. To improve D-Judge's ability to produce such rewrites, we construct a dataset of semantically equivalent response pairs that induce different judge-assigned harmfulness scores, and use it for supervised fine-tuning followed by direct preference optimization. Experiments on HarmBench show that D-Judge reduces the success rate of state-of-the-art multi-turn jailbreaks while preserving performance on benign benchmarks.

Problem

• multi-turn jailbreak
• LLM safety
• judge feedback
• harmful prompts
• adversarial attacks

Innovation

• multi-turn jailbreak
• semantics-preserving rewriting
• judge model
• output perturbation
• LLM safety