Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Technical Summary: Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Problem Statement
Current safety defenses for Large Language Models (LLMs) are predominantly trained and evaluated on single-turn prompts. This creates a vulnerability gap where adversaries can bypass safety filters by using indirect, multi-turn probing to elicit prohibited information (e.g., instructions for building a bomb) without triggering keyword-based or single-turn heuristics. Existing detection methods often rely on black-box classifiers or token-level cues that fail to generalize across rephrasing and varying conversation lengths. Furthermore, generating realistic datasets to train detectors for this specific threat is costly and difficult when relying solely on human data.

Methodology
The authors propose a unified, two-stage pipeline: Synthetic Data Generation and Explainable Geometric Detection.

1. Synthetic Data Generation (Evolutionary Framework):

   • Approach: The authors utilize a multi-objective evolutionary framework to generate realistic, multi-turn deceptive question sets. The system co-evolves candidate LLM prompts and their mutation operators.
   • Algorithm: They employ NSGA-II (Non-dominated Sorting Genetic Algorithm II) to manage the trade-off between deception quality (how effectively the questions elicit sensitive info) and policy adherence (avoiding explicit prohibited keywords like "bomb").
   • Process: Starting with an initial population of "codons" (prompt templates combining relevance and obfuscation instructions), the system iterates through selection, mutation (LLM-based rewording), and evaluation.
   • Validation: A Human-in-the-Loop (HITL) study validated the generated data. Participants rated 350 questions (52 participants) in two phases: individually and as a set of five. This confirmed that while individual questions appeared benign, the collective set revealed deceptive intent. The study also revealed that the first generation of optimization yielded the most convincing deception, while later generations suffered from over-optimization and policy violations.

2. Explainable Geometric Detection:

   • Hypothesis: Multi-turn deceptive intent leaves a stable "geometric footprint" in pre-trained sentence embedding space, distinct from benign conversations.
   • Feature Engineering: Instead of training end-to-end neural networks on raw text, the authors engineered a compact set of seven features computed from sentence embeddings (using all-MiniLM-L6-v2):
     • Geometric Features:
       • Angular Coverage: Measures how thoroughly questions "surround" the target topic in vector space.
       • Distance Ratio: The ratio of minimum to maximum distances from the target topic embedding.
       • Linearity: Derived from the eigenvalues of the covariance matrix of centered embeddings, measuring linear patterns.
     • Statistical Features: Mean, standard deviation, minimum, and maximum of pairwise cosine similarities between questions.
   • Classifier: These features feed into a lightweight, three-layer feed-forward neural network (MLP) with ReLU activations and dropout. The model is designed for transparency and near real-time deployment.

Key Contributions

• Multi-Objective Evolutionary Framework: A novel method for generating synthetic multi-turn deceptive datasets that balance deception efficacy with safety constraints, validated by human assessment.
• Geometric Signature Detection: The demonstration that deceptive multi-turn interactions possess a stable geometric structure in embedding space, detectable without expensive end-to-end training.
• Lightweight, Explainable Pipeline: A detection system that relies on interpretable geometric features rather than opaque deep learning models, facilitating explainability for decision-makers.

Results
The system was evaluated on a dataset comprising human-validated deceptive sets and benign conversational data from Scale AI.

• Baseline Performance: The model achieved a recall of 0.89 and an F1 score of 0.84 on the test set, correctly identifying deceptive sequences while maintaining high accuracy on control examples.
• Robustness to Lexical Variation: When tested on reworded questions (maintaining semantic intent but altering syntax), the model maintained an F1 score of 0.86, demonstrating resilience to surface-level text modifications.
• Robustness to Turn Constraints: Even when conversation context was truncated from five turns to three, the model maintained a high recall of 0.89 (F1: 0.74), suggesting viability for early intervention.
• HITL Insights: The human study revealed that early generations of the evolutionary process produced the most deceptive content. It also highlighted that LLMs struggle to perfectly mimic human variability in subjective reasoning and that approximately 18.6% of generated sets failed adherence filters (explicitly mentioning prohibited words).

Significance and Claims
The paper claims that multi-turn deceptive intent creates a detectable, stable geometric signature in embedding space. This finding supports the development of lightweight, transparent screening systems that do not require massive computational resources or opaque end-to-end training. The authors position their work as a defense mechanism, providing security researchers with tools to identify indirect information-seeking behaviors that bypass traditional keyword filters.

The authors remain modest regarding limitations, acknowledging that their dataset is synthetic and relatively small, and that the specific "bomb-making" scenario may not generalize perfectly to all domains without adaptation. They emphasize the dual-use nature of the technology, noting that while the generation framework could theoretically be misused, their publication focuses strictly on defensive detection and responsible disclosure, withholding the full set of optimized mutation operators.