{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2510-17947","title":"PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploits","arxiv_id":"2510.17947","date":"2025-10-20","proceeding":"ICLR","authors":["Neeladri Bhuiya","Madhav Aggarwal","Diptanshu Purwar"],"abstract":"Large Language Models (LLMs) are improving at an exceptional rate. With the advent of agentic workflows, multi-turn dialogue has become the de facto mode of interaction with LLMs for completing long and complex tasks. While LLM capabilities continue to improve, they remain increasingly susceptible to jailbreaking, especially in multi-turn scenarios where harmful intent can be subtly injected across the conversation to produce nefarious outcomes. While single-turn attacks have been extensively explored, adaptability, efficiency and effectiveness continue to remain key challenges for their multi-turn counterparts. To address these gaps, we present PLAGUE, a novel plug-and-play framework for designing multi-turn attacks inspired by lifelong-learning agents. PLAGUE dissects the lifetime of a multi-turn attack into three carefully designed phases (Primer, Planner and Finisher) that enable a systematic and information-rich exploration of the multi-turn attack family. Evaluations show that red-teaming agents designed using PLAGUE achieve state-of-the-art jailbreaking results, improving attack success rates (ASR) by more than 30% across leading models in a lesser or comparable query budget. Particularly, PLAGUE enables an ASR (based on StrongReject) of 81.4% on OpenAI's o3 and 67.3% on Claude's Opus 4.1, two models that are considered highly resistant to jailbreaks in safety literature. Our work offers tools and insights to understand the importance of plan initialization, context optimization and lifelong learning in crafting multi-turn attacks for a comprehensive model vulnerability evaluation.","url_abs":"https://arxiv.org/abs/2510.17947","url_pdf":"https://arxiv.org/pdf/2510.17947","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2510.17947","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2510.17947"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/madhavaggar/PLAGUE","reach":{"status":"ok"}}],"summary":{"unverified":10},"by_repo_kind":{"found_in_text":{"samples":10,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":10,"samples":[{"code_sha256_prefix":"9cd436c3e8b74032","entry":"calculate_similarity","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/strategy_utils.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/strategy_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9cd436c3e8b74032"}},{"code_sha256_prefix":"a7328524c16482f8","entry":"extract_between_tags","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/rubric_based_scorer.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/rubric_based_scorer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a7328524c16482f8"}},{"code_sha256_prefix":"ec6b352f99722f30","entry":"extract_json_code_block","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/candidate_generator/crescendo_attack.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/candidate_generator/crescendo_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ec6b352f99722f30"}},{"code_sha256_prefix":"d92c0e235eb4abc9","entry":"get_primer_user_prompt","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/prompt_utils.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/prompt_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d92c0e235eb4abc9"}},{"code_sha256_prefix":"f463cf70aaa8e5b0","entry":"get_strong_reject_rubric_prompt","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/evaluator.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/evaluator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f463cf70aaa8e5b0"}},{"code_sha256_prefix":"0ac05cef2632052d","entry":"get_summariser_user_prompt","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/prompt_utils.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/prompt_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0ac05cef2632052d"}},{"code_sha256_prefix":"0196ccb6f658b82a","entry":"iterative_prompting_refusal_prompt","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/prompt_utils.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/prompt_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0196ccb6f658b82a"}},{"code_sha256_prefix":"cae7f518fa53d26d","entry":"query_anthropic","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/infer.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/infer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cae7f518fa53d26d"}},{"code_sha256_prefix":"7ff98c4bf3d1b7eb","entry":"query_openai","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/infer.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/infer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7ff98c4bf3d1b7eb"}},{"code_sha256_prefix":"3b65bad5337c16b5","entry":"query_together","repo":"madhavaggar/PLAGUE","repo_kind":"found_in_text","path":"src/plague/infer.py","file_url":"https://github.com/madhavaggar/PLAGUE/blob/HEAD/src/plague/infer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3b65bad5337c16b5"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CR","source":"arxiv_api"},"syntology_extracted_results":null}