Beijing University's THRD Cuts Multi-Turn Jailbreak Success Rates to Near Zero
THRD is a plug-in defense framework that tracks risk across conversation turns to stop multi-turn jailbreaks without retraining the model
- THRD is a training-free, plug-in defense framework that models risk accumulation across conversation turns to block multi-turn jailbreak attacks on LLMs.
- It cuts attack success rates to 0.2-4.0% on both Qwen2.5-7B and Llama-3-8B, compared to 63-100% for existing single-turn defenses against the same attacks.
- Model utility is preserved within 1.5% degradation on MMLU and GSM8K, while competing defenses cause up to 24% utility drops and near-total over-refusal.
- Over 70% of multi-turn attacks are undetectable at Turn 1 -- they deliberately appear benign until Turn 2 or later, proving single-turn defenses are structurally insufficient.
- The framework uses four modules (TRA, HCA, RE, Decision) with a time-evolving risk score; once a refusal is triggered, all subsequent turns are blocked unconditionally.
- Main limitations: per-turn latency of 15-22 seconds (dominated by historical context analysis) and no public code release; paper available on arXiv.
Safety alignment in LLMs has a blind spot: it was largely designed for single questions, not conversations. A new paper from Beijing Language and Culture University introduces THRD (Temporal History Risk Defense), the first training-free framework that explicitly models how danger accumulates across a multi-turn dialogue -- and it cuts attack success rates to near zero without touching the underlying model weights.
The Slow Burn Problem
Most jailbreak defenses evaluate each user message in isolation. That works fine when an attacker sends a single malicious prompt. But modern attacks don't work that way. With newer models seeing increases in the size of their context window, multi-turn prompting is becoming an increasingly legitimate option for jailbreak attacks -- harmful instructions can be spread over multiple inputs, thereby potentially reducing the perceived harmfulness of each individual input and exploiting safety measures that assess each one in isolation.
The numbers are alarming. A comprehensive study evaluating multi-turn jailbreaks across 8 models with approximately 8,000 test cases found a 65% average attack success rate within just three conversation turns. More recently, the overall jailbreak success rate across all attacker-target combinations in a major 2026 study was 97.14%. The attack surface is not shrinking.
The core mechanic attackers exploit is what the THRD paper calls trajectory dependence: dialogue history continuously reshapes the model's conditioning context. Turn 1 might ask about chemistry in general. Turn 2 might ask about a specific compound. By Turn 3, the model is already primed to answer questions it would have refused cold. For example, an attacker might spend two turns discussing legitimate cybersecurity concepts before pivoting to specific exploit techniques in turn three, when the model's context is saturated with security-related discussion.
Why Existing Defenses Fall Short
The field currently has two categories of defense, and both have serious problems in multi-turn settings:
- Training-based methods (fine-tuning, RLHF) are expensive and degrade general model utility. They also can't easily cover the combinatorial space of adaptive, conversation-driven attack trajectories.
- Inference-time methods like PROACT and SAGE apply single-turn analysis independently at each message. They work reasonably well against structured, tree-search attacks like Tempest, but collapse against more sophisticated multi-agent attacks like X-Teaming, which coordinate across turns in ways that each individual turn can't reveal.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
