Making a safety decision explicit helps models resist multi-turn attacks
ShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn Defender · arXiv:2610.40627
In plain words
A model can miss a harmful request when a person builds it across several ordinary-looking messages. This paper introduces Assess → Decide → Respond, a defense that has the model assess intent, state whether to comply or refuse, and then answer based on that decision.
The authors train that decision using either a simple rule based on whether the conversation is harmful or benign, or an outside judge that scores the reply.
In tests on Qwen3-8B, the rule-trained version had a higher average judged-safe rate than a comparison method across five safety suites, though it did not lead on every suite.
The research
When a harmful request unfolds over several turns, can a model keep track of the user’s intent even if each message seems harmless on its own? The paper addresses this gap by asking whether making the model commit to a safety decision before it replies can help it resist the request as it develops.
The authors train a model to commit to an explicit safety decision before replying, then test whether that helps resist multi-turn harmful requests.
On Qwen3-8B, the authors compared the self-verified defense with MUSE-D, training both on the same data.
GPT-5-mini judged final replies using the full conversation and target behavior. The self-verified method’s mean SAFE rate, the share of dialogues judged safe, was 93.4% across five held-out safety suites, versus 85.7% for MUSE-D.
That average supports an advantage over MUSE-D across those suites, while an ablation on Llama3.1-8B found that removing the explicit decision lowered safety in that external-reward setup.
Together, these results support the decision as a useful part of the defense, with the ablation scoped to its tested model and reward.
The main comparison is on Qwen3-8B, and the paper does not establish that the methods began from identical checkpoints. On the hardest safety suite, the self-verified method’s interval overlaps MTSA’s, so the average does not establish that it beats every method on every test.
What the evidence shows
- A decision across turns
Assess → Decide → Respond is a reinforcement-learning-trained defense for language models facing multi-turn conversations. The problem is that an attacker can spread harmful intent across messages that appear harmless one at a time.
The paper’s approach has the model assess intent, commit to a parseable decision, and then reply based on that decision. This makes the safety decision an explicit part of the response process.
- Two ways to train it
The authors train that commitment with either a self-verified rule or an external judge. The rule checks whether the final-turn decision matches the known nature of the training conversation: refuse if harmful, comply if benign, and produce a reply.
It needs no judge or annotation, but cannot distinguish refusal from safe redirection. The judge-based option evaluates the final reply and permits safe redirection.
- A higher mean safe rate
On Qwen3-8B, GPT-5-mini judged whether each final reply was safe using the full conversation and target behavior. The self-verified defender’s mean SAFE rate, the share of dialogues judged safe, was 93.4% across five held-out safety suites; MUSE-D’s was 85.7%.
This average comparison supports an advantage over MUSE-D across those suites, while the interval overlap with MTSA on MHJ qualifies the result on the hardest suite.
- The commitment matters
A separate ablation tested whether the explicit decision mattered in the full design. On Llama3.1-8B with external reward, removing the Decision line while retaining assessment, reward, and data lowered safety on every suite; under human red-teaming it fell below the undefended base model.
This supports a role for the commitment in that setup, though the control does not establish the same effect across all model and reward variants.
- A pattern across judges
The authors also used five additional judges not involved in training. On Qwen3-8B, the self-verified method ranked first or second in all 25 judge-by-suite comparisons.
That extends the pattern beyond the primary evaluator, but one baseline led on MHJ under Qwen3Guard, and judge agreement was moderate. The finding is a recurring relative advantage, not a universal ranking across evaluators and tests.
Deep
- Original paper authors
- Qiyao Ma, Xiaodong Liu, Weiwei Yang, Mingqian Feng, Chengquan Guo
- Submitted to arXiv
- License
- CC BY 4.0