# Jailbreak Defense

Multi-turn jailbreak attacks escalate gradually and coordinate across turns, while existing defenses either need costly retraining or judge each turn in isolation and miss how risk accumulates. THRD combines current-turn risk, historical intent escalation and the previous response's facilitation into one time-evolving risk score, deciding at inference time whether to answer normally, answer under constraints, or refuse, with no training. On Qwen2.5-7B and Llama3-8B against the X-Teaming and Tempest multi-turn attacks, THRD brings attack success rate to 0.2–4.0% while keeping MMLU and GSM8K utility loss within 1.5%.

Multi-turn jailbreak attacks escalate gradually and coordinate across turns, while existing defenses either need costly retraining or judge each turn in isolation and miss how risk accumulates. THRD combines current-turn risk, historical intent escalation and the previous response's facilitation into one time-evolving risk score, deciding at inference time whether to answer normally, answer under constraints, or refuse, with no training. On Qwen2.5-7B and Llama3-8B against the X-Teaming and Tempest multi-turn attacks, THRD brings attack success rate to 0.2–4.0% while keeping MMLU and GSM8K utility loss within 1.5%.