D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting

[Download Paper] [Source Code]

Multi-turn jailbreaks succeed in part because attackers use an auxiliary judge to score intermediate replies and refine the next prompt. D-Judge sits in that loop: it rewrites the victim model’s output before the judge sees it, keeping the meaning (checked by a semantic gate) while changing the harmfulness signal the attacker relies on. Trained with SFT and DPO on semantically equivalent pairs that induce different judge scores, D-Judge lowers the success of strong multi-turn attacks on HarmBench without collapsing benign benchmark performance.