D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting

Abstract

Multi-turn jailbreak attacks pose a growing threat to large language model (LLM) safety because they exploit feedback from auxiliary judge models to iteratively refine prompts toward harmful goals. Existing defenses largely detect or block unsafe content at individual turns or at the final response, leaving the judge-driven refinement loop intact and allowing attackers to extract informative feedback from intermediate interactions. We introduce D-Judge, a semantics-preserving output rewriting de

Categories

Framework mappings

Suggested from the entry's categories.

@misc{gong2026djudge,
  title = {{D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting}},
  author = {Huanli Gong and Zhipeng Wei and Yu Fu and Haz Sameen Shahgir and Ananya Gupta and Yue Dong and N. Benjamin Erichson},
  year = {2026},
  month = may,
  eprint = {2606.02640},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02640}
}