The Challenge of Multi-Turn Adversarial Attacks

Modern Large Language Models (LLMs) are increasingly vulnerable to multi-turn attacks, where adversaries use a series of seemingly benign prompts to gradually steer the model toward generating restricted or harmful content. Unlike single-turn attacks, which are often caught by static input filters, multi-turn attacks exploit the model's memory of the conversation history, making them significantly harder to detect using traditional safety guardrails.

The Robust Critics Framework

The authors propose 'Robust Critics,' a defensive architecture that shifts the focus from simple input filtering to contextual evaluation. Instead of relying on a single pass of the user's input, the system employs a 'critic' model that monitors the entire dialogue history. This critic is specifically trained to identify adversarial patterns—such as persona adoption, gradual escalation, or obfuscation—that characterize multi-turn jailbreaking attempts. By analyzing the trajectory of the conversation rather than isolated inputs, the framework can intervene before the LLM produces a harmful response.

Implementation and Efficacy

The framework functions as an intermediary layer between the user and the primary LLM. When a user sends a prompt, the Robust Critic evaluates the current turn in the context of previous interactions. If the critic detects an adversarial trajectory, it triggers a mitigation strategy, such as refusing to answer, redirecting the conversation, or sanitizing the context window. The research demonstrates that this approach significantly reduces the success rate of complex, multi-step jailbreak attempts compared to standard safety fine-tuning or simple input-based moderation tools. The key insight is that security in LLM-powered applications must be stateful and context-aware to effectively defend against evolving adversarial tactics.