---
title: "Beijing University's THRD Cuts Multi-Turn Jailbreak Success Rates to Near Zero"
subtitle: "THRD is a plug-in defense framework that tracks risk across conversation turns to stop multi-turn jailbreaks without retraining the model"
url: "https://alphasignal.ai/news/beijing-university-s-thrd-cuts-multi-turn-jailbreak-success-rates-to-near-zero"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-01T00:00:00.000Z"
updated: "2026-06-09T09:40:05.840Z"
type: "Paper"
topics:
  - "Security"
  - "Llms"
subtopics:
  - "Red Teaming"
  - "Jailbreaks"
  - "Hallucinations"
upvotes: 1247
source_url: "https://arxiv.org/abs/2606.01738"
comments: 0
truncated: true
---

# Beijing University's THRD Cuts Multi-Turn Jailbreak Success Rates to Near Zero

> THRD is a plug-in defense framework that tracks risk across conversation turns to stop multi-turn jailbreaks without retraining the model

Safety alignment in LLMs has a blind spot: it was largely designed for single questions, not conversations. A new paper from Beijing Language and Culture University introduces [THRD (Temporal History Risk Defense)](https://arxiv.org/abs/2606.01738), the first training-free framework that explicitly models how danger accumulates across a multi-turn dialogue -- and it cuts attack success rates to near zero without touching the underlying model weights.

## The Slow Burn Problem

Most jailbreak defenses evaluate each user message in isolation. That works fine when an attacker sends a single malicious prompt. But modern attacks don't work that way. With newer models seeing increases in the size of their context window, multi-turn prompting is becoming an increasingly legitimate option for jailbreak attacks -- harmful instructions can be spread over multiple inputs, thereby potentially reducing the perceived harmfulness of each individual input and exploiting safety measures that assess each one in isolation.

The numbers are alarming. A comprehensive study evaluating multi-turn jailbreaks across 8 models with approximately 8,000 test cases found a 65% average attack success rate within just three conversation turns. More recently, the overall jailbreak success rate across all attacker-target combinations in a major 2026 study was 97.14%. The attack surface is not shrinking.

The core mechanic attackers exploit is what the THRD paper calls **trajectory dependence**: dialogue history continuously reshapes the model's conditioning context. Turn 1 might ask about chemistry in general. Turn 2 might ask about a specific compound. By Turn 3, the model is already primed to answer questions it would have refused cold. For example, an attacker might spend two turns discussing legitimate cybersecurity concepts before pivoting to specific exploit techniques in turn three, when the model's context is saturated with security-related discussion.

## Why Existing Defenses Fall Short

The field currently has two categories of defense, and both have serious problems in multi-turn settings:

* **Training-based methods** (fine-tuning, RLHF) are expensive and degrade general model utility. They also can't easily cover the combinatorial space of adaptive, conversation-driven attack trajectories.
* **Inference-time methods** like PROACT and SAGE apply single-turn analysis independently at each message. They work reasonably well against structured, tree-search attacks like Tempest, but collapse against more sophisticated multi-agent attacks like X-Teaming, which coordinate across turns in ways that each individual turn can't reveal.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models](https://arxiv.org/abs/2606.01738)
- [LLM Jailbreaking in 2026: 97% Success Rates, Autonomous Attacks, and the Arms Race That Isn't Working](https://redteams.ai/blog/llm-jailbreaking-2026)
- [MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety](https://arxiv.org/html/2605.01687v1)
- [LLM Jailbreaks 2024-2026: Techniques, Risks & Defense Strategies](https://startup-house.com/blog/llm-jailbreak-techniques)