Xunjian Yin / Research

EMNLP 2025Safety across a conversation

DAMON: A Dialogue-Aware MCTS Framework for Jailbreaking Large Language Models

Xu Zhang, Xunjian Yin, Dinghao Jing, Huixuan Zhang, Xinyu Hu, Xiaojun Wan

Peking University

Paper Code

Safety failures can emerge over an evolving conversation; DAMON evaluates this risk with dialogue-aware search, showing why model defenses need testing beyond isolated prompts.

Result
On HarmBench against GPT-3.5, DAMON reaches 92.0% attack success rate vs 84.0% for MPA, the strongest baseline; on GPT-4o, ActorAttack edges it (84.5% vs 84.0%).
New vs prior
ActorAttack and other multi-turn attacks follow predefined decomposition patterns, and PAIR and TAP refine single-turn prompts; this work searches over decomposition strategies turn by turn with MCTS.
Limitation
Attack objectives and the three decomposition strategies are manually designed, and success is judged by GPT-4o, with only 20 HarmBench instances checked by human annotators.
DAMON's search loop: a Monte Carlo tree whose nodes are attack states and whose edges are decomposition strategies, searched by repeated selection (maximum UCT value), expansion, simulated dialogue evaluation, and backpropagation. Left panel of original Figure 2 from the paper; the right panel is omitted.
DAMON's search loop: a Monte Carlo tree whose nodes are attack states and whose edges are decomposition strategies, searched by repeated selection (maximum UCT value), expansion, simulated dialogue evaluation, and backpropagation. Left panel of original Figure 2 from the paper; the right panel is omitted. Full size ↗
01 / The research question

Conversation history belongs in the safety test

A model that refuses a harmful request in one turn may still answer its parts across several, because earlier turns change how later ones are read. DAMON (Dialogue-Aware MONte Carlo Tree Search Attack) is a red-teaming method that searches for a sequence of sub-instructions that hides a refused request's intent yet still elicits a harmful response.

The paper names two requirements: query-aware decomposition, because requests need different splits, and strategy-aware refinement, because the plan must change when the victim model refuses part of it.

Closest prior work

Single-turn jailbreaks either optimize adversarial suffixes with gradients, as in GCG, or refine a whole prompt with an attack LLM, as in PAIR and TAP. Multi-turn attacks decompose a harmful query into less harmful sub-questions or escalate gradually from benign topics, as in Crescendo (Russinovich et al., 2025), but the paper notes that they follow a static, manually designed dialogue pattern; ActorAttack, for instance, builds its interactions from predefined decomposition patterns. DAMON instead treats decomposition as a search problem and chooses among strategies at each turn according to the victim model's responses.

02 / Inside the method

Tree search chooses how to decompose each refused turn

Each tree node is an attack state: the answered part of the dialogue, the sub-instructions still refused, an evaluation score, and a visit count. An action is one of three hand-designed decomposition strategies (progressive inquiry, step-by-step questioning, or story-driven imagination), applied by an attack LLM to the first refused sub-instruction.

Algorithm 1 · illustrative judge scores

Run the search one iteration at a time

An abstract search tree: nodes are dialogue states and the three decomposition strategy names, with no request content. Rewards are illustrative judge scores you can adjust; the UCT values and visit counts are computed live with the paper’s formulas. Step through selection, expansion, simulation and backpropagation.

Monte Carlo search tree over decomposition strategiesRoot initial request state with three strategy branches, each holding two sub-question states. All visit counts start at zero.Initial request stateQ 1.00 · N 0ProgressiveQ 1.00 · N 0Sub-question 1score 3 · N 0Sub-question 2score 4 · N 0Step-by-stepQ 1.00 · N 0Sub-question 1score 4 · N 0Sub-question 2score 3 · N 0Story-drivenQ 1.00 · N 0Sub-question 1score 2 · N 0Sub-question 2score 2 · N 0
Selection pathExpanded this iterationPruned branch

What one iteration does

  1. Selection Descend from the root by maximum UCT value (eq. 4).
  2. Expansion Decompose the selected state with the strategies.
  3. Simulation Read the illustrative judge score at the reached leaf.
  4. Backpropagation Update mean score Q and visit count N up the path (eq. 5).

No iterations run yet. Each strategy starts at Q 1.00, N 0; leaf scores are illustrative.

Responsible use. This is a schematic of the search procedure only. Every label is an abstract dialogue state or a strategy name; no harmful request, sub-question, or response text is shown or generated.

Selection uses the paper’s UCT rule (eq. 4): a child’s score is its mean reward Q plus ω·√(ln N(parent) / N(child)), with ω = 1; an unvisited child is taken first. Backpropagation uses eq. 5: Q ← (Q·N + score)/(N + 1) and N ← N + 1 along the path, with the same leaf score. A leaf score of 5 meets the early-exit threshold τ. Because the exploration term grows as a branch is left unvisited, the search returns to a less-visited branch even when another branch has a higher mean reward; raising a leaf’s score changes which decomposition path is pursued. Rewards are illustrative inputs to the paper’s formulas, computed in your browser; no model is queried.

Each iteration runs the four MCTS stages. Selection descends the tree by UCT (Upper Confidence bounds applied to Trees), adding an exploration bonus for rarely visited children to each child's mean score. Expansion decomposes the selected node with every strategy. Simulation sends the remaining sub-instructions to the victim, a GPT-4o reward model scores the dialogue for harm, and turns before the first new refusal join the stored dialogue. Backpropagation updates mean scores and visit counts up to the root.

Refusal pruning skips states in which every sub-instruction was answered: further splitting rarely restores the original objective once the dialogue has drifted. The attacker needs only black-box access to the victim's outputs and the reward scores.

  1. 01

    Evaluate complete dialogues

    Treat multi-turn interactions as the evaluation unit, so the test can capture dependencies between a response and its conversational history.

  2. 02

    Search conversational alternatives

    Use Monte Carlo Tree Search to study adaptive dialogue paths rather than relying only on a fixed conversation pattern.

  3. 03

    Compare robustness

    Compare against six baseline methods and analyze safety outcomes, evaluation cost, and the influence of conversational context.

03 / Reading the evidence

Adaptive search outperforms fixed-pattern attacks in most settings

Across 15 model–dataset pairs (five victim models on AdvBench, MaliciousInstruct, and HarmBench), DAMON has the highest attack success rate in 14; the exception is GPT-4o on HarmBench. A small human check agrees: on 20 HarmBench instances with GPT-4o, three annotators judge 85.0% of DAMON's responses harmful and on-task, versus 75.0% for ActorAttack.

Context matters: replaying DAMON's sub-instructions with no preceding dialogue lowers success substantially, and even random unrelated context raises it above the no-context level. Among defenses, a moderation guardrail barely changes success, perplexity filtering lowers it modestly, and paraphrasing works best, yet average success under paraphrasing is still 71%. The authors hypothesize that a gap between pretraining data and safety-alignment data underlies such failures.

Table 1 (HarmBench rows, transposed so that methods are rows and victim models are columns). Attack success rate (%), the share of test instructions whose response the GPT-4o judge rated 5 on a 1-5 harmfulness scale; higher means more safety failures were elicited. ActorAttack exceeds DAMON on GPT-4o (84.5% vs. 84.0%). Source ↗

MethodQwen2.5-7BLLaMA2-13BLLaMA3-8BGPT-3.5GPT-4o
GCG59.2%30.0%34.5%55.8%12.5%
AutoDAN47.3%4.8%7.2%2.0%0.5%
PAIR50.2%14.2%12.0%41.0%39.0%
TAP53.0%15.0%13.0%83.5%59.0%
MPA79.5%53.5%82.5%84.0%48.5%
ActorAttack80.5%85.0%79.0%78.5%84.5%
DAMON83.0%86.5%84.5%92.0%84.0%

Method proposed in the paper

Scope. Results depend on the tested model versions, manually specified objectives, and evaluation protocol. The study diagnoses vulnerabilities; it does not establish comprehensive safety or a complete defense. Read the study ↗

Further reading in the paperEMNLP 2025 paper · evaluation, context ablation, human study, and limitations ↗
Read the abstract

While large language models (LLMs) demonstrate remarkable capabilities across a wide range of tasks, they remain vulnerable to generating outputs that are potentially harmful. Red teaming, which involves crafting adversarial inputs to expose vulnerabilities, is a widely adopted approach for evaluating the robustness of these models. Prior studies have indicated that LLMs are susceptible to vulnerabilities exposed through multi-turn interactions as opposed to single-turn scenarios. Nevertheless, existing methods for multi-turn attacks mainly utilize a predefined dialogue pattern, limiting their effectiveness in realistic situations. Effective attacks require adaptive dialogue strategies that respond dynamically to the initial user prompt and the evolving context of the conversation. To address these limitations, we propose DAMON, a novel multi-turn jailbreak attack method. DAMON leverages Monte Carlo Tree Search (MCTS) to systematically explore multi-turn conversational spaces, efficiently identifying sub-instruction sequences that induce harmful responses. We evaluate DAMON’s efficacy across five LLMs and three datasets. Our experimental results show that DAMON can effectively induce undesired behaviors.

Full paper ↗
Citation BibTeX 
@inproceedings{zhang-etal-2025-damon,
    title = {{DAMON}: A Dialogue-Aware {MCTS} Framework for Jailbreaking Large Language Models},
    author = {Zhang, Xu and Yin, Xunjian and Jing, Dinghao and Zhang, Huixuan and Hu, Xinyu and Wan, Xiaojun},
    booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
    year = {2025},
    url = {https://aclanthology.org/2025.emnlp-main.323/},
    pages = {6350--6366}
}