Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations

2026-06-19

AI Summary

This work addresses multi-turn jailbreaking attacks, which evade single-turn safety filters by progressively steering conversations, rephrasing prompts, and employing role-playing to obscure harmful intent. The problem is formulated as a dialogue-level classification task, and a hierarchical Transformer architecture is proposed: individual utterances are first encoded into compact representations, then fused via a lightweight dialogue module that integrates cross-turn self-attention and cross-attention mechanisms to dynamically highlight critical evidence while avoiding the computational burden of concatenating long contexts. The resulting scalable hierarchical attention mechanism preserves cross-turn reasoning capability while significantly improving efficiency. Evaluated on a benchmark of 14,038 dialogues, the model achieves an F1 score of 0.9394—outperforming the strongest baseline, Claude Opus, by 0.07—and reduces false positive rates by 50%.

Abstract

Multi-turn jailbreaks can evade turn-level moderation by spreading unsafe intent across a dialogue through gradual escalation, reframing, and role manipulation. We address multi-turn jailbreak detection as a conversation-level classification problem and introduce an efficient hierarchical detector that avoids expensive long-context concatenation while retaining cross-turn reasoning. The model encodes individual turns to form compact turn representations and applies a lightweight conversation module that captures dialogue dynamics and selectively attends to fine-grained evidence when needed. On a challenging evaluation benchmark of 14,038 conversations, our approach achieves an F1 of 0.9394, outperforming Claude Opus 4.7, the strongest competing baseline, by 0.07 while halving its false-positive rate. Ablation studies confirm that each architectural component contributes meaningfully, with combining cross-attention and self-attention in the conversation module yielding a 2.26 percentage point reduction in false-positive rate over the self-attention-only variant.

Problem

• multi-turn jailbreak
• long conversations
• dialogue safety
• moderation evasion
• conversation-level classification

Innovation

• Hierarchical Attention
• Multi-turn Jailbreak Detection
• Long Conversations
• Cross-Attention
• Scalable Transformers