Skip to content
AI News HubLIVE
Original source3 min read

One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue

Summary

Large language models face threats from hidden malicious intent in multi-turn dialogues, where attackers distribute harmful objectives across benign-looking turns. The proposed TurnGate monitor detects the earliest turn where delivering a response would enable harmful action, and the MTID dataset supports training and evaluation. TurnGate outperforms baselines in detection while maintaining low over-refusal rates and generalizes across domains and models.

SourcearXiv Computational LinguisticsAuthor: Xinjie Shen, Rongzhe Wei, Peizhi Niu, Haoyu Wang, Ruihan Wu, Eli Chien, Bo Li, Pin-Yu Chen, Pan Li
One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue
Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions
Read article

[2605.05630] One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue

Skip to main content

Learn about arXiv becoming an independent nonprofit.

We gratefully acknowledge support from the Simons Foundation, member institutions, and all contributors. Donate

> cs > arXiv:2605.05630

Help | Advanced Search

All fields Title Author Abstract Comments Journal reference ACM classification MSC classification Report number arXiv identifier DOI ORCID arXiv author ID Help pages Full text

Search

GO

quick links

Login

Help Pages

About

-->

Computer Science > Computation and Language

arXiv:2605.05630 (cs)

[Submitted on 7 May 2026]

Title:One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue

Authors:Xinjie Shen, Rongzhe Wei, Peizhi Niu, Haoyu Wang, Ruihan Wu, Eli Chien, Bo Li, Pin-Yu Chen, Pan Li

View a PDF of the paper titled One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue, by Xinjie Shen and 8 other authors

View PDF HTML (experimental)

Abstract:Hidden malicious intent in multi-turn dialogue poses a growing threat to deployed large language models (LLMs). Rather than exposing a harmful objective in a single prompt, increasingly capable attackers can distribute their intent across multiple benign-looking turns. Recent studies show that even modern commercial models with advanced guardrails remain vulnerable to such attacks despite advances in safety alignment and external guardrails. In this work, we address this challenge by detecting the earliest turn at which delivering the candidate response would make the accumulated interaction sufficient to enable harmful action. This objective requires precise turn-level intervention that identifies the harm-enabling closure point while avoiding premature refusal of benign exploratory conversations. To further support training and evaluation, we construct the Multi-Turn Intent Dataset (MTID), which contains branching attack rollouts, matched benign hard negatives, and annotations of the earliest harm-enabling turns. We show that MTID helps enable a turn-level monitor TurnGate, which substantially outperforms existing baselines in harmful-intent detection while maintaining low over-refusal rates. TurnGate further generalizes across domains, attacker pipelines, and target models. Our code is available at this https URL.

Comments: Project Website: this https URL

Subjects:

Computation and Language (cs.CL); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)

Cite as: arXiv:2605.05630 [cs.CL]

(or arXiv:2605.05630v1 [cs.CL] for this version)

https://doi.org/10.48550/arXiv.2605.05630

Focus to learn more

arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Xinjie Shen [view email] [v1] Thu, 7 May 2026 03:35:31 UTC (907 KB)

Full-text links:

Access Paper:

View a PDF of the paper titled One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue, by Xinjie Shen and 8 other authors

View PDF

HTML (experimental)

TeX Source

view license

Current browse context:

cs.CL

new | recent | 2026-05

Change to browse by:

cs cs.AI cs.CR

References & Citations

NASA ADS

Google Scholar

Semantic Scholar

export BibTeX citation Loading...

BibTeX formatted citation

×

loading...

Data provided by:

Bookmark

Bibliographic Tools

Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer (What is the Explorer?)

Connected Papers Toggle

Connected Papers (What is Connected Papers?)

Litmaps Toggle

Litmaps (What is Litmaps?)

scite.ai Toggle

scite Smart Citations (What are Smart Citations?)

Code, Data, Media

Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv (What is alphaXiv?)

Links to Code Toggle

CatalyzeX Code Finder for Papers (What is CatalyzeX?)

DagsHub Toggle

DagsHub (What is DagsHub?)

GotitPub Toggle

Gotit.pub (What is GotitPub?)

Huggingface Toggle

Hugging Face (What is Huggingface?)

ScienceCast Toggle

ScienceCast (What is ScienceCast?)

Demos

Demos

Replicate Toggle

Replicate (What is Replicate?)

Spaces Toggle

Hugging Face Spaces (What is Spaces?)

Spaces Toggle

TXYZ.AI (What is TXYZ.AI?)

Related Papers

Recommenders and Search Tools

Link to Influence Flower

Influence Flower (What are Influence Flowers?)

Core recommender toggle

CORE Recommender (What is CORE?)

Author

Venue

Institution

Topic

About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)

About

Help

contact arXivClick here to contact arXiv Contact

subscribe to arXiv mailingsClick here to subscribe Subscribe

Copyright

Privacy Policy

Web Accessibility Assistance

arXiv Operational Status

Key points and analysis

Article intelligence

EngineersAdvanced

Key points

  • Multi-turn dialogue attacks spread malicious intent across several turns to evade guardrails.
  • TurnGate identifies the precise turn at which the accumulated interaction becomes harmful, enabling early intervention without falsely refusing benign conversations.
  • The new MTID dataset includes branching attacks, benign hard negatives, and annotations of the earliest harm-enabling turns.
  • TurnGate achieves superior harmful-intent detection and low over-refusal, with strong generalization across domains, attack pipelines, and target models.

Highlights and analysis are generated automatically and may contain errors. Check the original source.

More recent stories on this topic · Models