PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploits

TL;DR

PLAGUE introduces a lifelong-learning, plug-and-play framework for generating high-signal multi-turn jailbreaks by decomposing attacks into Planner, Primer, and Finisher phases and leveraging a memory of successful strategies. The system uses embedding-based retrieval, reflection-based feedback, and conversation summarization to evolve attack tactics across turns while maintaining budget efficiency. Empirical results demonstrate state-of-the-art jailbreaking Performance across leading LLMs, with significant improvements over baselines in ASR and robust performance across diverse threat categories. The work provides actionable insights into how plan initialization, context-building, and lifelong learning interact to reveal vulnerabilities, offering a structured evaluation tool for model defenses and vulnerability assessments.

Abstract

Large Language Models (LLMs) are improving at an exceptional rate. With the advent of agentic workflows, multi-turn dialogue has become the de facto mode of interaction with LLMs for completing long and complex tasks. While LLM capabilities continue to improve, they remain increasingly susceptible to jailbreaking, especially in multi-turn scenarios where harmful intent can be subtly injected across the conversation to produce nefarious outcomes. While single-turn attacks have been extensively explored, adaptability, efficiency and effectiveness continue to remain key challenges for their multi-turn counterparts. To address these gaps, we present PLAGUE, a novel plug-and-play framework for designing multi-turn attacks inspired by lifelong-learning agents. PLAGUE dissects the lifetime of a multi-turn attack into three carefully designed phases (Primer, Planner and Finisher) that enable a systematic and information-rich exploration of the multi-turn attack family. Evaluations show that red-teaming agents designed using PLAGUE achieve state-of-the-art jailbreaking results, improving attack success rates (ASR) by more than 30% across leading models in a lesser or comparable query budget. Particularly, PLAGUE enables an ASR (based on StrongReject) of 81.4% on OpenAI's o3 and 67.3% on Claude's Opus 4.1, two models that are considered highly resistant to jailbreaks in safety literature. Our work offers tools and insights to understand the importance of plan initialization, context optimization and lifelong learning in crafting multi-turn attacks for a comprehensive model vulnerability evaluation.

Figures (4)

• Figure 1: PLAGUE Framework: Three-phase method with a: 1) Planner Phase: the diverse plan sampler that retrieves successful past attack examples from memory and adaptively generates a plan for the current goal, 2) Primer Phase: the precursor step that subtly steers the context towards adversarial directions through multiple rounds of seemingly benign questions, and 3) Finisher Phase: for goal-based query sampling with frozen context generated by the Primer.
• Figure 2: Performance across threat categories: PLAGUE outperforms the strongest attack based on our ASR results across categories, demonstrating its effectiveness across diverse attack scenarios.
• Figure 3: PLAGUE scales linearly with the number of conversation turns until it plateaus at six rounds. Attack Success Rate - SRE.
• Figure 4: Ablation on Attack Diversity: Diversity improves significantly using the ActorBreaker plan creation module without a strategy library.