Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking

2609.02414 ↗ · 2026-09-02 · cs.CL, cs.AI

Siyu Chen, Haoran Wang, Xiaojian Li, Yao Huang, Yinpeng Dong, Wei Xu

19 pages, 7 figures. Accepted to Findings of EMNLP 2026

The finding

Headline claim

A multi-turn jailbreak that searches over 18 psychologically grounded influence factors while maintaining a simulated worldview achieves near-ceiling attack success on most frontier models at low query cost, and the dominant vulnerable cues are operational (concrete, executable task framing) rather than purely contextual.

The test

All 80 HarmBench validation behaviors attacked via MCTS over a turn-aligned binary factor encoding (max 4 turns), with WorldviewSim supplying cross-turn persona/setting continuity; six target models (Qwen3-Next-80B, DeepSeek-V3.2, GLM-4.7, Gemini-2.5-Flash, GPT-OSS-120B, GPT-5.1), fixed DeepSeek-V3.2 as attacker and 1-5 LLM judge, compared to 11 baselines including PAIR, Crescendo, TAP, and AutoDAN-Turbo.

Effect size & scope

Average ASR 79.2% at 2.46 average target queries, versus best baseline CL-GSO at 51.4% ASR but 50.8 queries. Per-model: 100% on Qwen3-Next-80B and Gemini-2.5-Flash, 98.8% on DeepSeek-V3.2, 75% on GLM-4.7, 58.8% on GPT-5.1, and only 42.5% on GPT-OSS-120B, so the 'near-ceiling' claim holds on four of six targets and breaks on GPT-OSS-120B and partially GPT-5.1.

Limitations

The authors concede the factor vocabulary is not exhaustive, the attack and judge are both DeepSeek-V3.2 (same-family judge/attacker risk), Avg. Q excludes total MCTS optimization cost, and legitimacy appeals can backfire unpredictably. Unstated: n=80 behaviors is modest, the LLM judge's 1-5 scoring is calibrated by the authors themselves, no human-verified harm on successful outputs is reported in the provided text, and GPT-OSS-120B's 42.5% shows results are highly target-dependent.

Counterpoint

LLM-as-judge ASR near 100% is notoriously inflated; a judge sharing the attacker's family and no reported independent human harm audit means 'success' may be scoring artifact. The comparison also conflates efficiency and effectiveness since Avg. Q excludes search cost, and the psychological factor framing may be a post-hoc narrative wrapped around generic multi-turn prompt search.

Economy implication

Little or nothing yet for AI economics directly. The marginal signal is defensive: if concrete executable framing is the dominant vulnerability, enterprise safety spend may shift from content filtering to dialogue-state monitoring, a modest cost line, not a valuation driver.

Who this matters for

Technical Capability: Frontier safety training remains brittle under structured multi-turn persuasion, with failure modes that differ per model, meaning reported refusal robustness overstates real robustness.

Regulatory & Legal: Regulators drafting model-safety requirements should note that single-turn eval regimes systematically miss the multi-turn state-based failures this paper documents.

Abstract

Multi-turn jailbreak attacks demonstrate that harmful intent can be distributed across dialogue, yet existing methods obscure what conversational mechanisms drive vulnerability. We introduce BLUEPRINT, a safety-evaluation framework separating a factorized social-influence strategy space from WORLDVIEWSIM, a cross-turn situational context module. Monte Carlo Tree Search optimizes turn-level combinations of 18 theory-grounded influence factors across a four-turn trajectory. Across six frontier models, BLUEPRINT achieves near-ceiling ASR on major open-weight and proprietary models, while requiring the fewest average queries (2.46). The resulting trajectories further reveal model-specific vulnerability among resistant targets: each responds to distinct influence factors and strategy transitions, yet all share a common recovery pathway-shifting toward concrete, executable task framing consistently escapes hard-refusal states. Ablations confirm operational cues matter most: making requests actionable has the largest impact, gain framing is unusually potent, and some legitimacy appeals can backfire. These findings suggest robust multi-turn safety requires monitoring not only harmful content, but also how dialogue state makes unsafe requests appear concrete and locally executable.