D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting

Multi-turn jailbreak attacks pose a growing threat to large language model (LLM) safety because they exploit feedback from auxiliary judge models to iteratively refine prompts toward harmful goals. Existing defenses largely detect or block unsafe content at individual turns or at the final response, leaving the judge-driven refinement loop intact and allowing attackers to extract informative feedback from intermediate interactions. We introduce D-Judge, a semantics-preserving output rewriting defense that intervenes directly in this loop by rewriting the victim LLM’s responses before they are evaluated by the attacker’s judge. By misaligning the judge’s feedback signal without changing the meaning of the original response, D-Judge derails the attacker’s prompt-refinement process, causing subsequent queries to be optimized against a distorted signal of attack progress. To improve D-Judge’s ability to produce such rewrites, we construct a dataset of semantically equivalent response pairs that induce different judge-assigned harmfulness scores, and use it for supervised fine-tuning followed by direct preference optimization. Experiments on HarmBench show that D-Judge reduces the success rate of state-of-the-art multi-turn jailbreaks while preserving performance on benign benchmarks.

Modern AI assistants are often used in conversations with many back-and-forth turns. This makes them more useful, but it also creates new safety risks: attackers can gradually steer a conversation toward harmful content by using feedback from separate AI systems that judge whether the attack is making progress. Existing defenses often focus on detecting or blocking harmful content after it appears, but they may leave this feedback loop intact. We propose D-Judge, a defense that intervenes earlier in the process. Instead of changing the meaning of the assistant’s response, D-Judge rewrites the response so that the attacker’s judging system receives misleading feedback. This makes it harder for the attacker to refine future prompts toward a harmful goal. Our experiments show that D-Judge substantially reduces the success of multi-turn attacks while preserving performance on benign tasks.