{"id":"https://openalex.org/W7163200636","doi":"https://doi.org/10.48550/arxiv.2606.01738","title":"THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models","display_name":"THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163200636","doi":"https://doi.org/10.48550/arxiv.2606.01738"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.01738","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01738","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.01738","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137626747","display_name":"Zhiqing Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Zhiqing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137655191","display_name":"Zhonghao Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Zhonghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137677216","display_name":"Dong Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Dong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137666959","display_name":"Chen Kang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kang, Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137658885","display_name":"Changliang Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Changliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137672850","display_name":"Pengyuan Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Pengyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.22529999911785126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.22529999911785126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.10379999876022339,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10201","display_name":"Speech Recognition and Synthesis","score":0.05959999933838844,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.632099986076355},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.46070000529289246},{"id":"https://openalex.org/keywords/mechanism","display_name":"Mechanism (biology)","score":0.4489000141620636},{"id":"https://openalex.org/keywords/retraining","display_name":"Retraining","score":0.37869998812675476},{"id":"https://openalex.org/keywords/context-model","display_name":"Context model","score":0.35030001401901245},{"id":"https://openalex.org/keywords/dynamics","display_name":"Dynamics (music)","score":0.33309999108314514}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6877999901771545},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.632099986076355},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4830000102519989},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.46070000529289246},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4569000005722046},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.4489000141620636},{"id":"https://openalex.org/C2778712577","wikidata":"https://www.wikidata.org/wiki/Q3505966","display_name":"Retraining","level":2,"score":0.37869998812675476},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.35420000553131104},{"id":"https://openalex.org/C183322885","wikidata":"https://www.wikidata.org/wiki/Q17007702","display_name":"Context model","level":3,"score":0.35030001401901245},{"id":"https://openalex.org/C145912823","wikidata":"https://www.wikidata.org/wiki/Q113558","display_name":"Dynamics (music)","level":2,"score":0.33309999108314514},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32030001282691956},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.30070000886917114},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.2718999981880188},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.2667999863624573}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.01738","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01738","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.01738","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01738","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.8227797150611877,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Multi-turn":[0],"jailbreak":[1,96],"attacks":[2,152,204],"pose":[3],"a":[4,102,111,121,130,138],"growing":[5],"threat":[6],"to":[7,42,71,170,209],"LLMs":[8],"by":[9,78],"exploiting":[10],"conversational":[11],"dynamics":[12],"such":[13],"as":[14],"gradual":[15],"escalation":[16,119],"and":[17,129,145,156,181,189],"cross-turn":[18,117],"coordination.":[19],"Existing":[20],"defenses":[21],"either":[22],"rely":[23],"on":[24,179],"costly":[25],"retraining":[26],"--":[27,32,153,160],"often":[28],"degrading":[29],"model":[30,174],"utility":[31,175],"or":[33,207],"apply":[34],"single-turn":[35],"analysis":[36],"independently":[37],"at":[38],"each":[39,73],"turn,":[40],"failing":[41],"capture":[43],"how":[44],"risk":[45,92,109],"accumulates":[46],"along":[47],"interaction":[48,57],"trajectories.":[49],"We":[50],"observe":[51],"that":[52,88,133,166,199],"safety":[53],"behavior":[54],"in":[55,75],"multi-turn":[56,95,151,203],"is":[58],"trajectory-dependent:":[59],"dialogue":[60],"history":[61],"continuously":[62],"reshapes":[63],"the":[64,84,212],"model's":[65],"conditioning":[66],"context,":[67],"making":[68],"it":[69],"insufficient":[70],"evaluate":[72],"turn":[74],"isolation.":[76],"Motivated":[77],"this":[79],"insight,":[80],"we":[81],"present":[82],"THRD,":[83],"first":[85,195],"training-free":[86],"framework":[87],"explicitly":[89],"models":[90,164],"temporal":[91,216],"accumulation":[93],"for":[94,107,116,125],"defense.":[97],"THRD":[98,167],"integrates":[99],"four":[100],"modules:":[101],"Turn-level":[103],"Risk":[104],"Assessor":[105],"(TRA)":[106],"instantaneous":[108],"estimation,":[110],"Historical":[112],"Context":[113],"Analyzer":[114],"(HCA)":[115],"intent":[118],"detection,":[120],"Response":[122],"Evaluator":[123],"(RE)":[124],"identifying":[126],"facilitative":[127],"outputs,":[128],"Decision":[131],"Module":[132],"combines":[134],"these":[135],"signals":[136],"through":[137],"time-evolving":[139],"scoring":[140],"mechanism":[141],"with":[142],"attenuation-based":[143],"modulation":[144],"trend-aware":[146],"adjustment.":[147],"Experiments":[148],"against":[149],"state-of-the-art":[150],"including":[154],"tree-search-based":[155],"multi-agent":[157],"collaborative":[158],"methods":[159],"across":[161],"two":[162],"target":[163],"show":[165],"reduces":[168],"ASR":[169],"0.2--4.0%":[171],"while":[172],"preserving":[173],"within":[176],"1.5%":[177],"degradation":[178],"MMLU":[180],"GSM8K.":[182],"Ablation":[183],"studies":[184],"confirm":[185],"non-redundant":[186],"module":[187],"contributions":[188],"stable":[190],"cross-architecture":[191],"generalization.":[192],"Analysis":[193],"of":[194,202,214],"rejection":[196],"triggers":[197],"reveals":[198],"over":[200],"70%":[201],"require":[205],"Turn~2":[206],"later":[208],"detect,":[210],"validating":[211],"necessity":[213],"explicit":[215],"aggregation.":[217]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-03T00:00:00"}