Multi‑turn jailbreaks adapt their queries using feedback from a victim LLM across several dialogue turns. This work evaluates how much of the early query history remains necessary after an effective attack trajectory has been discovered. By discarding the initial attacker queries and replaying the remaining ones in a fresh conversation while regenerating the victim's responses, we define the effective horizon as the shortest remaining query sequence that reproduces the same attack progress. Empirical results show that, on average, about half of the original queries suffice to achieve the same progress, a phenomenon we call effective‑horizon compression. The shortened history can recover the best point reached during an unsuccessful attack and provide a better starting point for continued attacks. It also reveals which early queries should receive reduced learning signal during attacker training; down‑weighting those queries improves performance. Further experiments indicate that short reward‑propagation windows preserve calibrated defense performance close to that of full‑trajectory returns. Overall, multi‑turn attacks often contain more queries than needed to recover later progress.
Review