Dipto084/Llama3.1-8B-TRACE
Dipto084/Llama3.1-8B-TRACE is an 8 billion parameter model based on Llama-3.1-8B-Instruct, specifically designed as a trajectory-aware defense against multi-turn jailbreaks. It explicitly assesses the entire conversation history to determine safety, achieving an average attack success rate (ASR) of 14.5% across seven multi-turn attack benchmarks. This model maintains high compliance on benign prompts (93.3%), making it suitable for robust and safe conversational AI applications.
Loading preview...
Dipto084/Llama3.1-8B-TRACE: Trajectory-Aware Jailbreak Defense
Dipto084/Llama3.1-8B-TRACE is an 8 billion parameter model built upon meta-llama/Llama-3.1-8B-Instruct, engineered to provide a robust defense against multi-turn jailbreak attempts. Unlike traditional safety models that evaluate messages in isolation, TRACE performs a "trajectory-aware" assessment of the entire conversation history, committing to a safety evaluation in a <STATE> block before generating its reply in an <ANSWER> block.
Key Capabilities & Performance
- Superior Jailbreak Resistance: Achieves an average Attack Success Rate (ASR) of 14.5% across seven multi-turn attack benchmarks, significantly outperforming baselines (e.g., 31.4% for the strongest baseline and 74.9% for the undefended target).
- High Benign Compliance: Maintains an average compliance rate of 93.3% on over-refusal benchmarks, matching the undefended Llama-3.1-8B-Instruct and avoiding excessive refusals on legitimate requests.
- Structured Safety Reasoning: Generates an internal
<STATE>block with detailed cues, dual-hypothesis scores, and a jailbreak score, allowing for explicit safety assessment and action (ALLOW, CAUTION, DECLINE) before generating the user-facing<ANSWER>. - Enhanced Single-Turn Robustness: Improves single-turn robustness against strong attackers like AutoDAN-Turbo, more than doubling the average attempts required for a successful jailbreak (from 3.5 to 8.0).
Training Methodology
TRACE was developed using a two-stage training process:
- Stage 1 (SFT): A LoRA adapter was trained on 12.5k multi-turn trajectories, including adversarial, benign, and harm-adjacent conversations, annotated with full reasoning traces by a frontier LLM.
- Stage 2 (GRPO): The SFT adapter was further fine-tuned using Group-decoupled GRPO (GDPO) reinforcement learning, optimizing for jailbreak-score accuracy, behavioral consistency, and cue-set agreement, while integrating over-refusal considerations directly into the gradient steps.
Usage Considerations
This model requires a specific TRACE system prompt to ensure well-formed <STATE> blocks. Conversations must be formatted as a single user message containing the entire trajectory. Only the <ANSWER> block should be shown to end-users, with the <STATE> block serving for internal logging and auditing. The model's full capabilities are best utilized with the provided TRACE reference package.