Multi-turn jailbreaks stop being judged one turn at a time: a training-free defense cuts attack success to 0.2–4.0% while MMLU slips 1.5%

Multi-turn jailbreak defense moves from per-turn judgment to risk accumulated along the conversation trajectory. Earlier inference-time defenses mostly relied on single-turn analysis or static rules, which struggle to catch attacks that only become visible through cross-turn accumulation and response-level facilitation. On Qwen2.5-7B and Llama3-8B against X-Teaming and Tempest, THRD's attack success rate falls in the 0.2–4.0% range, whereas PROACT applied independently at each turn still leaves 63.5% and 67.0% on Qwen and 47.4% and 24.0% on Llama under X-Teaming.

The framework splits conversational safety into current-turn, historical and response signals, then fuses them into one time-evolving score. The three signals come from a Turn-level Risk Assessor (TRA, scoring the current input from 1 to 5), a Historical Context Analyzer (HCA, reading the full conversation history to judge intent escalation) and a Response Evaluator (RE, judging whether the previous output may facilitate downstream harm). The Decision Module uses an attenuation function to scale historical signal weight by current-turn severity and adds a penalty when risk scores rise monotonically across consecutive turns; under Tempest with 100 AdvBench instructions, all seven decision-formula configurations keep attack success below 2%.

Cross-turn information is what makes the defense work, and most attacks are only caught at the second turn. Looking at the first turn alone would let most attacks through. On X-Teaming (up to 7 turns), only 18.0% (Qwen) and 29.1% (Llama) of attacks are caught at Turn 1, 55.8% and 61.8% first trigger a rejection at Turn 2, and 26.2% and 9.1% need Turn 3 or later.

Removing any module clearly weakens the defense, so the three signals are not redundant. Turn-level assessment alone still gives baseline protection but does not cover cross-turn escalation. On Llama3-8B with X-Teaming and HarmBench, the full framework reaches 1.59% attack success; removing TRA raises it to 25.37%, removing HCA to 26.07%, removing RE to 17.07%, and removing both HCA and RE to 33.30%.

The demonstrated scope is two target models, Qwen2.5-7B-Instruct and Llama-3-8B-Instruct, against the X-Teaming and Tempest multi-turn attacks, plus single-turn AutoDAN as a generalization check; safety and utility are measured with HarmBench, AdvBench, MMLU, GSM8K and XSTest. The authors propose improving context compression and module unification to reduce overhead.

The authors note that TRA, HCA and RE all rely on prompt-driven semantic judgments, so the framework partly depends on the evaluator model's reasoning ability, and attacks optimized specifically against its prompting patterns or scoring dynamics may reduce effectiveness; temporal dynamics are modeled by lightweight score aggregation rather than sequential learning, which may limit effectiveness against attacks spreading intent over much longer trajectories; once a refusal triggers, all later turns are refused unconditionally, which may be overly conservative for general-purpose systems; HCA is the main latency bottleneck at 17.24 seconds per call on Llama3-8B, and a compressed state cuts it to 8.39 seconds while raising attack success from 1.6% to 3.5%.