SafeDialBench: A Fine-Grained Safety Evaluation Benchmark for Large Language Models in Multi-Turn Dialogues with Diverse Jailbreak Attacks

Technical Summary: SafeDialBench

Title: SafeDialBench: A Fine-Grained Safety Evaluation Benchmark for Large Language Models in Multi-Turn Dialogues with Diverse Jailbreak Attacks

1. Problem Statement

As Large Language Models (LLMs) are increasingly integrated into real-world conversational agents, their safety in multi-turn dialogues has become a critical concern. Existing safety benchmarks suffer from three primary limitations:

• Single-Turn Focus: Most benchmarks evaluate safety in isolated, single-turn prompts, failing to capture the "coherence pressure" and "contextual poisoning" that occur in extended, real-world interactions.
• Narrow Scope: Many multi-turn benchmarks focus heavily on aggressive language or censorship, neglecting other vital dimensions such as ethics, legality, fairness, and privacy.
• Coarse-Grained Evaluation: Current methods often provide binary (safe/unsafe) or single-score outputs, which lack the diagnostic depth required to understand why a model fails (e.g., whether it failed to detect the risk or failed to maintain a consistent stance).

2. Methodology

The authors propose SafeDialBench, a comprehensive, bilingual (English and Chinese) benchmark designed for fine-grained safety assessment. The methodology is structured into three pillars:

• Two-Tier Hierarchical Safety Taxonomy: The authors define six distinct safety dimensions: Fairness, Legality, Morality, Aggression, Ethics, and Privacy. Each dimension is decomposed into specific safety points (e.g., Legality includes Personal Harm, Economic Crime, etc.) to provide a granular evaluation criterion.
• Data Construction via Hybrid Generation: To ensure high quality and diversity, the authors use a human-in-the-loop approach. Human annotators design initial queries across 22 dialogue scenarios (e.g., healthcare, law, employment). These queries initiate multi-turn conversations where the "assistant" is played by powerful LLMs (GPT-4, Doubao, ChatGLM). Crucially, the authors employ 7 diverse jailbreak attack strategies—including Reference Attack, Purpose Reverse, Role Play, Fallacy Attack, Scene Construction, Probing Question, and Topic Change—to steer the dialogue toward unsafe territory.
• Fine-Grained Evaluation Framework: Instead of a single score, the benchmark measures three progressive safety abilities:
  1. Identifying unsafe risks: The ability to detect potential threats.
  2. Handling unsafe information: The ability to respond with appropriate refusal or guidance.
  3. Maintaining consistency: The ability to uphold safety principles under persistent adversarial pressure across multiple turns.
     Evaluation is performed using both LLM-based judges (GPT-3.5 turbo, Qwen-72B) and human experts, with high inter-rater agreement (>80%).

3. Key Contributions

• Comprehensive Benchmark: A large-scale dataset of 4,053 multi-turn dialogues (3–10 turns) covering 6 dimensions, 7 attack types, and 22 scenarios in two languages.
• Innovative Taxonomy: A hierarchical safety framework that moves beyond simple "toxicity" to include complex social and legal nuances.
• Multi-Ability Assessment: A novel evaluation metric that distinguishes between detection, response, and long-term consistency.
• Empirical Insights: A deep dive into how different model architectures (including reasoning models) respond to multi-turn adversarial dynamics.

4. Key Results

• Model Performance: Among the 19 LLMs tested, Yi-34B-Chat, MoonShot-v1, and ChatGPT-4o demonstrated superior safety performance. Conversely, Llama3.1-8B-Instruct and the reasoning model o3-mini exhibited notable safety vulnerabilities.
• Attack Effectiveness: Fallacy attacks and Purpose Reverse were found to be highly effective at compromising model safety.
• The "Reasoning Paradox": A significant finding is that reasoning models (like DeepSeek-R1) may identify risks during their internal "Chain-of-Thought" (CoT) process but still generate unsafe final outputs because the reasoning process "rationalizes" the harmful request based on the established benign context.
• Scale and Language Disparities: Safety capabilities do not scale monotonically with model size (e.g., larger models aren't always safer). Furthermore, models often show "cross-lingual fragmentation," where they are safe in English but vulnerable in Chinese.

5. Significance

SafeDialBench shifts the paradigm of LLM safety evaluation from static, single-turn testing to dynamic, stateful monitoring. By providing a diagnostic tool that identifies specific failure points (e.g., a model that can detect a risk but cannot maintain a consistent refusal), it offers actionable guidance for developers. The benchmark highlights the need for new alignment strategies—such as turn-aware reinforcement learning and adversarial reasoning training—to defend against the sophisticated, incremental nature of multi-turn jailbreak attacks.