用压缩对话训练安全模型，提速93倍还更准。
Defensive M2S: Training Guardrail Models on Compressed Multi-turn Conversations
- 把多轮对话压缩成单轮再训练，降低计算开销
- 训练只需16.9万词元，比原方法少93倍
- 检测攻击召回率达93.8%，推理耗能降94.6%
Guardrail模型对保障大语言模型部署安全至关重要，但处理完整多轮对话历史会带来巨大计算成本。本文提出Defensive M2S，一种在压缩多轮对话（M2S）上微调安全模型的训练范式，而非使用完整的对话历史。我们提供形式化复杂度分析，表明M2S将n轮对话的训练成本从O(n²)降至O(n)。实验证明，在包含779个样本、平均10.6轮的训练数据集上，M2S仅需16.9万词元，相较多轮基线的1570万词元减少93倍。我们在SafeDialBench基准上评估了三种安全模型家族（LlamaGuard、Nemotron、Qwen3Guard）与三种压缩模板（hyphenize、numberize、pythonize）。最佳配置（Qwen3Guard + hyphenize）实现93.8%攻击检测召回率，同时将每轮对话推理词元数从3,231降至173，降低94.6%。相比基线，性能提升38.9个百分点，且大幅降低训练与推理成本。结果表明，M2S压缩可作为高效的安全筛查技术，支持长对话场景的规模化安全部署。
原文摘要 · Abstract (English)
Guardrail models are essential for ensuring the safety of Large Language Model (LLM) deployments, but processing full multi-turn conversation histories incurs significant computational cost. We propose Defensive M2S, a training paradigm that fine-tunes guardrail models on Multi-turn to Single-turn (M2S) compressed conversations rather than complete dialogue histories. We provide a formal complexity analysis showing that M2S reduces training cost from $O(n^2)$ to $O(n)$ for $n$-turn conversations. Empirically, on our training dataset (779 samples, avg. 10.6 turns), M2S requires only 169K tokens compared to 15.7M tokens for the multi-turn baseline -- a 93$\times$ reduction. We evaluate Defensive M2S across three guardrail model families (LlamaGuard, Nemotron, Qwen3Guard) and three compression templates (hyphenize, numberize, pythonize) on SafeDialBench, a comprehensive multi-turn jailbreak benchmark. Our best configuration, Qwen3Guard with hyphenize compression, achieves 93.8% attack detection recall while reducing inference tokens by 94.6% (from 3,231 to 173 tokens per conversation). This represents a 38.9 percentage point improvement over the baseline while dramatically reducing both training and inference costs. Our findings demonstrate that M2S compression can serve as an effective efficiency technique for guardrail deployment, enabling scalable safety screening of long multi-turn conversations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。