高效检测长对话中渐进式越狱攻击，准确率超主流模型。
Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations
- 分层结构先编码单轮对话，再用轻量模块捕捉对话动态
- 在1.4万条对话上达F1 0.9394，误报率减半且优于最强基线
- 结合交叉注意力与自注意力设计，显著降低误报
多轮越狱攻击通过逐步升级、重构意图和角色扮演，在对话中分散不安全意图以规避逐轮审查。本文将多轮越狱检测建模为对话级分类任务，提出一种高效的分层检测器，避免昂贵的长上下文拼接，同时保持跨轮推理能力。模型先对各轮对话进行编码生成紧凑表示，再通过轻量级对话模块捕捉对话演化规律，并在需要时细粒度关注证据。在包含14,038条对话的挑战性评估基准上，该方法取得0.9394的F1分数，优于最强基线Claude Opus 4.7（高出0.07），且误报率降低一半。消融实验表明，各组件均有贡献，尤其在对话模块中结合交叉注意力与自注意力，相比仅使用自注意力的变体，误报率降低2.26个百分点。
原文摘要 · Abstract (English)
Multi-turn jailbreaks can evade turn-level moderation by spreading unsafe intent across a dialogue through gradual escalation, reframing, and role manipulation. We address multi-turn jailbreak detection as a conversation-level classification problem and introduce an efficient hierarchical detector that avoids expensive long-context concatenation while retaining cross-turn reasoning. The model encodes individual turns to form compact turn representations and applies a lightweight conversation module that captures dialogue dynamics and selectively attends to fine-grained evidence when needed. On a challenging evaluation benchmark of 14,038 conversations, our approach achieves an F1 of 0.9394, outperforming Claude Opus 4.7, the strongest competing baseline, by 0.07 while halving its false-positive rate. Ablation studies confirm that each architectural component contributes meaningfully, with combining cross-attention and self-attention in the conversation module yielding a 2.26 percentage point reduction in false-positive rate over the self-attention-only variant.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。