用时序建模检测大模型对话中的渐进式恶意意图,提升安全防护能力。
DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMs
- 采用RNN架构追踪对话中逐轮积累的意图风险,实现状态感知监控。
- 在多轮攻击检测中达到0.84的F1分数,显著优于现有主流模型。
- 推理延迟低于20ms,适合实时应用,兼顾性能与效率。
尽管大型语言模型能力持续增强,其安全防护机制仍多为无状态设计,将多轮对话视为独立事件。这种缺乏时间连续性的缺陷导致‘安全缺口’,使攻击者如Crescendo和ActorAttack能逐步渗入恶意意图以绕过无状态过滤器。我们提出DeepContext,一种有状态监控框架,用于追踪用户意图的时序演化轨迹。该框架摒弃孤立评估模式,采用循环神经网络(RNN)结构,输入经微调的逐轮嵌入序列,并通过传递隐藏状态捕捉被忽略的风险累积过程。实验表明,DeepContext在多轮越狱攻击检测中表现卓越,取得0.84的F1分数,大幅领先于主流云厂商防护系统及Llama-Prompt-Guard-2(0.67)与Granite-Guardian(0.67)等开源模型。此外,其在T4 GPU上推理延迟低于20ms,具备实时部署可行性。结果表明,建模意图的序列演化是比部署庞大无状态模型更高效、更有效的安全策略。
原文摘要 · Abstract (English)
While Large Language Model (LLM) capabilities have scaled, safety guardrails remain largely stateless, treating multi-turn dialogues as a series of disconnected events. This lack of temporal awareness facilitates a "Safety Gap" where adversarial tactics, like Crescendo and ActorAttack, slowly bleed malicious intent across turn boundaries to bypass stateless filters. We introduce DeepContext, a stateful monitoring framework designed to map the temporal trajectory of user intent. DeepContext discards the isolated evaluation model in favor of a Recurrent Neural Network (RNN) architecture that ingests a sequence of fine-tuned turn-level embeddings. By propagating a hidden state across the conversation, DeepContext captures the incremental accumulation of risk that stateless models overlook. Our evaluation demonstrates that DeepContext significantly outperforms existing baselines in multi-turn jailbreak detection, achieving a state-of-the-art F1 score of 0.84, which represents a substantial improvement over both hyperscaler cloud-provider guardrails and leading open-weight models such as Llama-Prompt-Guard-2 (0.67) and Granite-Guardian (0.67). Furthermore, DeepContext maintains a sub-20ms inference overhead on a T4 GPU, ensuring viability for real-time applications. These results suggest that modeling the sequential evolution of intent is a more effective and computationally efficient alternative to deploying massive, stateless models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。