@inproceedings{ma-etal-2026-thrd,
title = "{THRD}:A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models",
author = "ma, Zhiqing and
Xu, Zhonghao and
Yu, Dong and
Kang, Chen and
Li, Changliang and
Liu, Pengyuan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1657/",
doi = "10.18653/2026.findings-emnlp.1657",
pages = "35313--35337",
ISBN = "979-8-89176-462-0",
abstract = "Multi-turn jailbreak attacks pose a growing threat to LLMs by exploiting gradual escalation and cross-turn coordination. Many existing defenses either rely on costly retraining{---}often degrading utility{---}or analyze each turn independently, failing to capture risk accumulation across interactions. We observe that safety behavior in multi-turn interaction is trajectory-dependent: dialogue history reshapes the model{'}s conditioning context, making isolated turn-level evaluation insufficient. We present THRD, a training-free framework that explicitly models temporal risk accumulation for multi-turn jailbreak defense. THRD integrates four modules: a Turn-level Risk Assessor (TRA) for instantaneous risk estimation, a Historical Context Analyzer (HCA) for cross-turn intent escalation detection, a Response Evaluator (RE) for identifying facilitative outputs, and a Decision Module that combines these signals through a time-evolving scoring mechanism with attenuation-based modulation and trend-aware adjustment. Experiments against representative multi-turn attacks{---}including tree-search-based and multi-agent collaborative methods{---}across two target models show that THRD reduces ASR to 0.2{--}4.0{\%} while preserving model utility within 1.5{\%} degradation on MMLU and GSM8K. Ablation studies confirm non-redundant module contributions and consistent performance across both models. Over 70{\%} of attacks require Turn 2 or later to detect, highlighting the importance of cross-turn information."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="ma-etal-2026-thrd">
<titleInfo>
<title>THRD:A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Zhiqing</namePart>
<namePart type="family">ma</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhonghao</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Dong</namePart>
<namePart type="family">Yu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chen</namePart>
<namePart type="family">Kang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Changliang</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Pengyuan</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Multi-turn jailbreak attacks pose a growing threat to LLMs by exploiting gradual escalation and cross-turn coordination. Many existing defenses either rely on costly retraining—often degrading utility—or analyze each turn independently, failing to capture risk accumulation across interactions. We observe that safety behavior in multi-turn interaction is trajectory-dependent: dialogue history reshapes the model’s conditioning context, making isolated turn-level evaluation insufficient. We present THRD, a training-free framework that explicitly models temporal risk accumulation for multi-turn jailbreak defense. THRD integrates four modules: a Turn-level Risk Assessor (TRA) for instantaneous risk estimation, a Historical Context Analyzer (HCA) for cross-turn intent escalation detection, a Response Evaluator (RE) for identifying facilitative outputs, and a Decision Module that combines these signals through a time-evolving scoring mechanism with attenuation-based modulation and trend-aware adjustment. Experiments against representative multi-turn attacks—including tree-search-based and multi-agent collaborative methods—across two target models show that THRD reduces ASR to 0.2–4.0% while preserving model utility within 1.5% degradation on MMLU and GSM8K. Ablation studies confirm non-redundant module contributions and consistent performance across both models. Over 70% of attacks require Turn 2 or later to detect, highlighting the importance of cross-turn information.</abstract>
<identifier type="citekey">ma-etal-2026-thrd</identifier>
<identifier type="doi">10.18653/2026.findings-emnlp.1657</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1657/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>35313</start>
<end>35337</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T THRD:A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models
%A ma, Zhiqing
%A Xu, Zhonghao
%A Yu, Dong
%A Kang, Chen
%A Li, Changliang
%A Liu, Pengyuan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F ma-etal-2026-thrd
%X Multi-turn jailbreak attacks pose a growing threat to LLMs by exploiting gradual escalation and cross-turn coordination. Many existing defenses either rely on costly retraining—often degrading utility—or analyze each turn independently, failing to capture risk accumulation across interactions. We observe that safety behavior in multi-turn interaction is trajectory-dependent: dialogue history reshapes the model’s conditioning context, making isolated turn-level evaluation insufficient. We present THRD, a training-free framework that explicitly models temporal risk accumulation for multi-turn jailbreak defense. THRD integrates four modules: a Turn-level Risk Assessor (TRA) for instantaneous risk estimation, a Historical Context Analyzer (HCA) for cross-turn intent escalation detection, a Response Evaluator (RE) for identifying facilitative outputs, and a Decision Module that combines these signals through a time-evolving scoring mechanism with attenuation-based modulation and trend-aware adjustment. Experiments against representative multi-turn attacks—including tree-search-based and multi-agent collaborative methods—across two target models show that THRD reduces ASR to 0.2–4.0% while preserving model utility within 1.5% degradation on MMLU and GSM8K. Ablation studies confirm non-redundant module contributions and consistent performance across both models. Over 70% of attacks require Turn 2 or later to detect, highlighting the importance of cross-turn information.
%R 10.18653/2026.findings-emnlp.1657
%U https://aclanthology.org/2026.findings-emnlp.1657/
%U https://doi.org/10.18653/2026.findings-emnlp.1657
%P 35313-35337
Markdown (Informal)
[THRD:A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models](https://aclanthology.org/2026.findings-emnlp.1657/) (ma et al., Findings 2026)
ACL