Technical Summary: THRD – A Training-Free Multi-Turn Defense Framework

1. Problem Statement

Large Language Models (LLMs) remain vulnerable to multi-turn jailbreak attacks, which exploit conversational dynamics to gradually erode safety guardrails. Unlike single-turn attacks that rely on explicit, engineered prompts, multi-turn attacks (e.g., Crescendo, X-Teaming, Tempest) utilize gradual escalation, cross-turn coordination, and seemingly benign intermediate responses to steer the model toward harmful compliance.

Existing defense mechanisms face two primary limitations in this context:

1. Training-based methods (e.g., SFT, RLHF) struggle to cover the combinatorial and adaptive space of interaction-driven attack trajectories without degrading model utility.
2. Inference-time defenses often rely on single-turn analysis, evaluating each input in isolation. This fails to capture how risk accumulates across a conversation history, where individual turns may appear benign while the aggregate context shifts the model toward harmful outcomes.

The core challenge is that safety behavior in multi-turn interactions is trajectory-dependent: dialogue history continuously reshapes the model's conditioning context, making isolated turn-level evaluation insufficient.

2. Methodology: The THRD Framework

The authors propose THRD, the first training-free framework designed to explicitly model temporal risk accumulation for multi-turn jailbreak defense. THRD operates at inference time and decomposes safety assessment into four integrated modules:

A. Turn-level Risk Assessor (TRA)

• Function: Estimates the instantaneous risk of the current input ($R_i$).
• Mechanism: Adopts a two-stage analysis paradigm to capture both semantic and structural signals. It assigns an ordinal score $R_i \in [1, 5]$.
• Calibration: To avoid false positives from benign keywords (e.g., "kill" in a process context), the authors explore prompt variants that shift focus from keyword content to request structure and require concrete structural evidence before assigning high risk.

B. Historical Context Analyzer (HCA)

• Function: Infers cumulative intent by analyzing the conversation as a temporally ordered interaction.
• Mechanism: Analyzes conversation structure across three dimensions:
  1. Conversational form: Role-play setups and framing.
  2. Evolution patterns: Progression of topic sensitivity.
  3. Attack chain completeness: Whether prior turns form a progression toward harmful objectives.
• Output: A binary judgment $J_h \in \{SAFE, UNSAFE\}$ indicating if the trajectory exhibits malicious intent.

C. Response Evaluator (RE)

• Function: Assesses whether a generated response (from the previous turn) may facilitate downstream harm, even if it technically complies with policy.
• Motivation: Addresses the "discriminator–generator gap," where models identify harmful content better during evaluation than generation.
• Mechanism: Evaluates content safety, information sensitivity, and boundary compliance. It operates post-hoc (after the response is issued) to feed into the next turn's decision.
• Output: A binary judgment $J_r \in \{MAY\_FACILITATE, WILL\_NOT\_FACILITATE\}$.

D. Decision Module

• Function: Integrates $R_i$, $J_h$, and $J_r$ into a time-evolving risk score ($F(i)$) to determine the response strategy (Normal, Controlled, or Refuse).
• Scoring Formula:
  $$F(i) = R_i + \Lambda(R_i) \cdot \Omega(\hat{J}^{(i-1)}_h, \hat{J}^{(i-1)}_r)$$
  • $\Lambda(R_i)$: An attenuation function modulating historical signal influence based on current severity.
  • $\Omega$: A composite function aggregating historical and response-level risks (using L2 Norm).
  • Trend Adjustment: Adds a penalty if risk scores exhibit monotonic increase across consecutive turns.
• Persistent Rejection: Once a high-risk refusal is triggered, all subsequent turns are refused unconditionally. This prevents attackers from recovering via evasive follow-ups, prioritizing security over interaction continuity.

3. Key Contributions

1. Temporal Risk Modeling: THRD is the first training-free framework to explicitly model how risk accumulates across conversation turns, moving beyond isolated single-turn analysis.
2. Modular Architecture: It introduces a unified inference-time framework combining instantaneous risk (TRA), cumulative intent (HCA), and facilitative output detection (RE).
3. Training-Free Efficiency: The framework requires no model retraining, relying instead on prompt-based semantic judgments and lightweight score aggregation.
4. Empirical Validation: Extensive experiments demonstrate that THRD effectively defends against state-of-the-art multi-turn attacks while preserving model utility.

4. Experimental Results

The framework was evaluated on Qwen2.5-7B and Llama-3-8B against X-Teaming (multi-agent collaborative) and Tempest (tree-search-based) attacks.

• Attack Success Rate (ASR): THRD reduced ASR to 0.2–4.0% across both models and attack types.
  • Comparison: Baseline single-turn defenses (PROACT, SAGE) failed significantly against X-Teaming (ASR > 47% for PROACT, >86% for SAGE on Qwen) or incurred severe utility loss.
• Model Utility: THRD preserved utility within 1.5% degradation on MMLU and GSM8K benchmarks, outperforming SAGE which suffered drops of >11%.
• Over-Refusal: THRD maintained acceptable over-refusal rates (12.4% on Qwen, 18.8% on Llama), significantly better than SAGE (up to 99.6%).
• Single-Turn Robustness: THRD achieved 0% ASR against the single-turn attack AutoDAN, confirming that multi-turn mechanisms do not compromise single-turn defense.
• Ablation Studies:
  • Removing TRA or HCA caused the largest performance degradation (~24% ASR increase), confirming both current-turn and cross-turn analyses are non-redundant.
  • Removing Persistent Rejection increased ASR from 1.59% to 5.15%, validating the necessity of blocking recovery attempts.
  • History Order Sensitivity: Shuffling conversation history increased ASR, confirming that temporal ordering is critical for detecting escalation patterns.

5. Significance and Claims

The paper claims that THRD addresses a critical gap in LLM safety: the inability of existing defenses to detect attacks that rely on gradual, cross-turn accumulation rather than explicit single-turn violations.

• Necessity of Multi-Turn Analysis: Analysis of first rejection triggers reveals that over 70% of multi-turn attacks require Turn 2 or later to detect, as attackers deliberately design Turn 1 to appear benign. This validates the necessity of explicit temporal aggregation.
• Trade-off Resolution: THRD demonstrates that it is possible to achieve strong defense performance against adaptive multi-turn attacks without the heavy cost of retraining or the severe utility degradation seen in other inference-time methods.
• Limitations: The authors acknowledge that HCA is the primary computational bottleneck (accounting for ~63–77% of latency) and that the framework relies on the reasoning capabilities of the underlying evaluator model. They note that future attacks optimized specifically against THRD's prompting patterns or attacks distributing intent over substantially longer trajectories may pose challenges.

In conclusion, THRD provides a robust, training-free approach to securing LLMs against the evolving threat of multi-turn jailbreaks by treating safety as a trajectory-dependent property rather than a static input filter.