Multi-Turn Interactional Safety

• Multi-turn interactional safety is the ability of AI systems to resist harmful content by managing evolving, context-rich adversarial dialogues.
• Research shows that multi-turn approaches can increase attack success rates by 20–40% compared to single-turn interactions, highlighting unique vulnerabilities.
• Advanced defense strategies like dialogue-level moderators and guardrail compression are being developed to mitigate risks in large language and multimodal models.

Multi-turn interactional safety refers to the property of an AI system, especially LLMs and multimodal LLMs, to sustain robust, contextually coherent, and consistent defenses against attempts to elicit harmful content when adversaries distribute or escalate malicious intent over multiple conversational turns. Unlike single-turn safety—which evaluates a model’s response to one prompt in isolation—multi-turn interactional safety interrogates the system’s ability to withstand composite, evolving, or context-dependent attacks that progressively circumvent alignment mechanisms by leveraging dialogue history, shifting user intent, and context accumulation. Research demonstrates that multi-turn dialogues can expose unique vulnerabilities and substantially degrade LLM safety performance, motivating a surge of methodological innovation in benchmarking, attack generation, and defensive techniques.

1. Threat Characterization: Multi-Turn Attack and Interaction Models

Multi-turn adversarial interactions exploit the compositionality of dialogue, decomposing a forbidden target query $Q$ into a sequence of innocuous sub-queries $q_1,\ldots,q_n$, such that each turn appears policy-compliant but their combination reconstructs the original hazardous intent. This is formalized as $f: \mathcal{Q} \to \{q_1,\ldots,q_n\}$, transforming $Q$ into a conversational trajectory $D = (q_1, r_1, \ldots, q_n, r_n)$ where $r_k = \mathrm{LLM}(q_k \mid \text{history})$ and the attack succeeds when $r_n$ reveals restricted content (Zhou et al., 2024).

Empirical studies, including role-play and purpose inversion schemes, show that models exhibiting robust single-turn refusal frequently fail under stepwise escalation. For example, "Speak Out of Turn" finds GPT-4 models can be jailbroken in multi-turn setups at 20–40% rates—substantially above the near-zero single-turn baseline—especially when faced with chained, intent-masked prompts (Zhou et al., 2024). Advanced simulation frameworks introduce controlled attacker/defender roles (e.g., ScamBot/VictimBot), quantifying metrics such as attacker success rate and error breakdowns in real or simulated scam interactions (Yuan et al., 6 Jan 2026).

Moreover, psychological manipulation strategies such as Foot-in-the-Door (FITD) are systematically operationalized in red-teaming at scale: users escalate from benign initial queries to high-risk requests, as in "[Automating Deception: Scalable Multi-Turn LLM Jailbreaks]" (Kumarappan et al., 24 Nov 2025), resulting in attack success rate (ASR) increases of up to +32 percentage points in multi-turn over single-turn scenarios for GPT-family models.

2. Benchmarking, Taxonomies, and Evaluation Metrics

Robust evaluation of multi-turn interactional safety demands novel datasets, taxonomies, and metrics explicitly capturing the compositional threat surface.

• Scenario and Dialogue Construction: Benchmarks such as SafeDialBench (Cao et al., 16 Feb 2025), SafeMT (Zhu et al., 14 Oct 2025), and MMDS (Huang et al., 30 Sep 2025) generate adversarial conversations—spanning 3–10 turns, often bilingual and multimodal—across diverse domains (legal, medical, financial, ethical, physical harm, etc.). Attacks employ reference, role-play, purpose inversion, topic drift, and targeted coreference, including in vision-language contexts.
• Taxonomies: Safety evaluation typically leverages hierarchical taxonomies, e.g., SafeDialBench’s six top-level safety dimensions broken into fine-grained "safety points" (Cao et al., 16 Feb 2025), or MMDS’s 8-dimension multimodal policy set (Huang et al., 30 Sep 2025).
• Metrics: Classical ASR is extended by turn-wise and session-wise metrics. SafeMT introduces the Safety Index (SI), combining attack success as a function of dialogue length with consistency penalties:

$$\mathrm{SI} = \left(1 - \sum_{k=1}^{n} w_k\,\mathrm{ASR}_k\right) \times \left(1 - \mathrm{mean}(\sigma[I_j,\ldots,I_n])\right),$$

where $w_k$ are turn-weights and $\sigma$ captures defense variability (Zhu et al., 14 Oct 2025). Multi-turn evaluation protocols further require that models sustain safe refusals across every history length (Cao et al., 16 Feb 2025).

• Empirical Results: Across SafeMT, GPT-4o’s ASR rises from 0.1539 (single prompt) to 0.5083 (8 turns), and the SI for best models (Llama-3.2-90B-Vision-Instruct) is $\approx 0.7080$, with many standard baselines showing considerably lower (less safe) scores (Zhu et al., 14 Oct 2025).

3. Attack Surfaces and Mechanisms of Multi-Turn Jailbreaking

Research demonstrates that multi-turn attacks exploit distinct vulnerabilities absent in single-turn setups:

• Contextual Drift and History Accumulation: Each conversational step amplifies context, gradually weakening refusal triggers or causing "history toxicity"—where prior benign or hedged responses prime subsequent model generations for policy violations (Tang et al., 22 Jun 2025).
• Semantic Manipulation: Techniques such as role-play, context referencing, and coreference ("that thing we discussed") effectively mask intent and penetrate shallow safety filters, as in CoSafe, which formalizes multi-turn coreference attacks (Yu et al., 2024).
• Psychological and Narrative Schemas: FITD, sunk-cost traps, and escalation ladders (see "[Automating Deception: Scalable Multi-Turn LLM Jailbreaks]") systematically increase compliance probability with each successive, more harmful request (Kumarappan et al., 24 Nov 2025).
• Modality Bridging in MLLMs: Attacks in Multi-modal LLMs can coordinate text and vision inputs to reconstruct harmful intent across turns and modalities, e.g., by leveraging image reference attacks, as documented in SafeMT (Zhu et al., 14 Oct 2025) and MMDS (Huang et al., 30 Sep 2025).
• Distribution Shifts: The divergence between training (i.i.d. single-turn or shallow-context) and inference (multi-turn, stateful) distributions is quantified through KL divergence measures in ActorAttack, which demonstrates that LLMs exhibit safety breakdowns on natural conversational trajectories not covered by alignment data (Ren et al., 2024).

4. Defensive Architectures, Guardrail Compression, and Efficiency

Defensive methods address multi-turn safety both by architectural interventions and scalable guardrail design:

• Dialogue-Level Moderators and Early Intervention: Plug-and-play moderators (e.g., STREAM (Kuo et al., 31 May 2025), ChatShield in SafeMT (Zhu et al., 14 Oct 2025)) parse dialogue histories to detect latent malicious signals, emitting natural-language warnings or policy prompts to enforce refusal policies at each turn. This context-aware moderation reduces ASR by 20–30 percentage points beyond single-turn-trained baselines.
• Guardrail Model Compression with Defensive M2S: Defensive M2S (Kim, 1 Jan 2026) compresses the entire sequence of user turns in a multi-turn conversation into a single prompt via hyphenize, numberize, or pythonize templates, reducing guardrail training and inference complexity from $O(n^2)$ to $O(n)$. Qwen3Guard + hyphenize achieves 93.8% recall, 94.6% token reduction, and a 38.9 point improvement in attack detection recall over baseline at 93× lower training cost. However, critical trade-offs include the loss of assistant-side cues (reducing detection of behavioral attacks) and high sensitivity to template-model pairing.
• Representation-Space Boundary Methods: X-Boundary (Lu et al., 14 Feb 2025) targets mechanism-level interpretability, enforcing explicit separation in representation space between harmful and "boundary-safe" examples, reducing ASR by 40–60% and more than halving over-refusal, without affecting general capabilities.
• Barrier Function and Invariant Safety: Control-theoretic techniques such as "neural barrier functions" (NBFs) enforce per-turn invariant safety by modeling dialogue as a latent state-space dynamical system and filtering queries when the predicted probability of unsafe continuation exceeds a threshold (Hu et al., 28 Feb 2025). This approach achieves low ASR and favorable safety-utility trade-offs.
• Multi-Turn RLHF with Future Rewards: MTSA (Guo et al., 22 May 2025) extends RLHF protocols to optimize over future, not just per-turn, rewards, integrating strategic red-teaming and preference optimization to close the gap between last-turn-only and all-turn safety (reducing multi-turn ASR by up to 71%).

5. Multi-Turn Red Teaming Frameworks and Dataset Generation

Multi-turn adversarial data generation frameworks have become central to benchmarking and defense:

• Automated Multi-Turn Agents: X-Teaming (Rahman et al., 15 Apr 2025) employs collaborative agent teams for planning, attack, and verification, escalating from neutral to harmful requests through diverse, adaptive plans. Its XGuard-Train dataset (>30k multi-turn jailbreaks) supersedes prior resources by an order of magnitude. Attack success rates exceed 90% on state-of-the-art models, underscoring the completeness of automation.
• Search-Based and Frame-Semantic Strategies: The MUSE framework (Yan et al., 18 Sep 2025) leverages frame semantics and MCTS-driven search, maximizing ASR under multi-turn constraints—nearly doubling prior methods’ attack success rates.
• Multilingual, Multimodal, and Turn-Depth Exploration: MM-ART (Singhania et al., 4 Apr 2025) demonstrates that ASR increases monotonically with depth (e.g., 21%→36% in 5-turn English conversations) and rises faster in non-English (up to +195% in Japanese), highlighting overlooked vulnerabilities in multilingual deployments.
• Application to Multimodal Models: MLLMs present aggravated vulnerabilities due to visual context manipulation; SafeMT (Zhu et al., 14 Oct 2025), LLaVAShield (Huang et al., 30 Sep 2025), and AM$^3$Safety (Zhu et al., 8 Jan 2026) provide datasets (e.g. SafeMT: 10k multimodal dialogues, 17 risk scenarios) and adversarial pipelines that repeatedly expose risks—such as ASR climbing from 0.15 to over 0.5 as dialogue length increases.

6. Alignment, Deployment Trade-offs, and Ongoing Challenges

• Alignment Degradation: Domain-specific fine-tuning, especially on helpfulness-optimized corpora (e.g., in medical LLMs), can catastrophically compromise multi-turn safety, as documented in JMedEthicBench (Liu et al., 4 Jan 2026) (median safety drop from 9.5 to 5.0 within three dialogue turns).
• Dependencies on Model-Template Fit and Data Diversity: Defensive M2S (Kim, 1 Jan 2026) reveals that model-template incompatibilities can result in recall loss >70%; effectiveness hinges on matching the right guardrail instantiation to the conversational surface.
• Over-Refusal and Usability vs. Safety: Explicit representational control (X-Boundary) and turn-aware reward functions (AM$^3$Safety (Zhu et al., 8 Jan 2026)) are crucial to balancing robustness against over-refusal and loss of general capabilities.
• Realistic Threat Surfaces: Benchmarks confirm that single-turn, monolingual evaluation grossly underestimates risk. Multi-turn, multilingual, and multimodal assessments are now mandatory for safety certification (Singhania et al., 4 Apr 2025, Zhu et al., 14 Oct 2025, Huang et al., 30 Sep 2025).

7. Best Practices and Prospective Directions

• Integrated, Context-Aware Defense: Optimal safety is achieved using context-sensitive, plug-and-play moderators (e.g., ChatShield), stateless prompt re-evaluation (pretext stripping), dialogue-level anomaly detectors, and scenario-specific policy prompts (Zhu et al., 14 Oct 2025, Kumarappan et al., 24 Nov 2025, Kuo et al., 31 May 2025).
• Continuous Adversarial Training and Data Refresh: Embedding automated adversarial agents and continually regenerating multi-turn jailbreak sets are necessary to keep pace with model capability evolution and uncover previously unseen weaknesses (Liu et al., 4 Jan 2026).
• Hybrid Guardrails and System-Level Monitors: Combine model-level alignment with session-level monitors and hybrid approaches (including human-in-the-loop for high-risk regimes) (Zhu et al., 14 Oct 2025, Singhania et al., 4 Apr 2025).
• Evaluation and Reporting: Employ multi-turn, minimum-score aggregation and consistency-aware metrics (e.g., SafeMT’s SI); report ASR vs. turn count and scenario; and document trade-offs between capability, safety, and over-refusal rigorously.

Multi-turn interactional safety thus requires a paradigm shift: context-agnostic single-step defenses are provably insufficient; scalable, context-aware, and dynamic alignment strategies—spanning automated red-teaming, efficient guardrail compression, and per-turn intervention—are essential for any robust LLM deployment (Kim, 1 Jan 2026, Kumarappan et al., 24 Nov 2025, Lu et al., 14 Feb 2025, Zhu et al., 14 Oct 2025).