[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-training-method-cuts-multi-turn-jailbreaks-in-llms":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},9524,"new-training-method-cuts-multi-turn-jailbreaks-in-llms","New Training Method Cuts Multi-Turn Jailbreaks in LLMs","TRACE training achieved the lowest jailbreak success rate across 35 tested model-attack pairs, trimming safety risk without gutting model performance.","A new training method makes language models harder to manipulate across a multi-turn conversation, without dulling the model underneath.\n\nResearchers built TRACE (Trajectory Return Attribution and Contrastive Erasure), a token-level training objective for safety-aligned models. It scores each token in a safe response using the discounted return of a refusal-attributable advantage, comparing a frozen reference model against a refusal-ablated copy of itself. That lets early turns in a conversation get credit - or blame - for a refusal that only shows up several messages later. The team tested it on five open-weight models against seven multi-turn jailbreak attacks, 35 model-attack pairs in all, and TRACE produced the lowest attack success rate in every single one. Utility scores on MMLU and HellaSwag fell by at most 1.23 points.\n\nThat's the gap current safety training ignores. Standard preference tuning judges one prompt and one response at a time, so it has no way to notice a harmful request being assembled piece by piece across a conversation. TRACE's trick - tracing later refusal signals back to earlier tokens - is a structural fix for that blind spot, not just a bigger blocklist.\n\nLowest attack success rate across 35 pairings is a real result, but it's not the same as closing the hole. The paper tested seven known multi-turn attack styles; it says nothing about the eighth one someone hasn't published yet.","[\"ai-safety\",\"jailbreaks\",\"multi-turn-attacks\",\"llm-training\"]","2026-10-02T04:00:00.000Z","2026-10-02T23:10:07.554Z","2026-10-02T23:10:12.911Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The dek claims TRACE \"blocked\" multi-turn jailbreaks across all 35 pairs, but the body and source only support it achieving the lowest attack success rate, not full blocking — rewrite the dek to match the substantiated claim.","resolved","ai",[32,33,34,35],"ai-safety","jailbreaks","multi-turn-attacks","llm-training",[37],{"name":38,"url":39},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.01323",0,{"sections":42},[43,46,50,54,59,63,67,72,77,82,87,92,97,102],{"name":44,"slug":30,"count":45,"latest_published_at":18},"AI",5886,{"name":47,"slug":48,"count":49,"latest_published_at":18},"Security","security",835,{"name":51,"slug":52,"count":53,"latest_published_at":18},"Policy","policy",438,{"name":55,"slug":56,"count":57,"latest_published_at":58},"Deals","deals",317,"2026-10-01T22:00:00.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":18},"Hardware","hardware",199,{"name":64,"slug":65,"count":66,"latest_published_at":18},"Science","science",171,{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",155,"2026-10-01T19:54:10.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Dev Tools","dev-tools",96,"2026-10-01T16:57:03.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",93,"2026-09-30T21:41:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",90,"2026-10-01T21:55:22.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Gaming","gaming",53,"2026-10-02T02:50:39.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",50,"2026-09-30T21:37:54.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"How-To","how-to",7,"2026-10-01T09:00:00.000Z"]