Bidirectional Intention Inference Enhances LLMs' Defense Against Multi-Turn Jailbreak Attacks

2025-09-25

AI Summary

Existing LLM safety defenses primarily target single-turn jailbreaking attacks and struggle to mitigate multi-turn adversarial scenarios where malicious intent evolves covertly and progresses incrementally across turns. To address this, we propose a Bidirectional Intent Inference (BII) defense framework. BII innovatively integrates forward-looking request analysis with backward-looking response traceback, jointly leveraging multi-turn contextual modeling and risk consistency verification to dynamically track and jointly infer latent malicious intent. Extensive experiments on three mainstream LLMs and two security benchmarks demonstrate that BII significantly reduces multi-turn attack success rates—by an average of 42.6% compared to seven state-of-the-art defenses—while preserving high user usability. Notably, BII achieves new state-of-the-art robustness in multi-turn safety defense, establishing a principled approach for detecting evolving adversarial behavior across conversational turns.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Abstract

The remarkable capabilities of Large Language Models (LLMs) have raised significant safety concerns, particularly regarding "jailbreak" attacks that exploit adversarial prompts to bypass safety alignment mechanisms. Existing defense research primarily focuses on single-turn attacks, whereas multi-turn jailbreak attacks progressively break through safeguards through by concealing malicious intent and tactical manipulation, ultimately rendering conventional single-turn defenses ineffective. To address this critical challenge, we propose the Bidirectional Intention Inference Defense (BIID). The method integrates forward request-based intention inference with backward response-based intention retrospection, establishing a bidirectional synergy mechanism to detect risks concealed within seemingly benign inputs, thereby constructing a more robust guardrails that effectively prevents harmful content generation. The proposed method undergoes systematic evaluation compared with a no-defense baseline and seven representative defense methods across three LLMs and two safety benchmarks under 10 different attack methods. Experimental results demonstrate that the proposed method significantly reduces the Attack Success Rate (ASR) across both single-turn and multi-turn jailbreak attempts, outperforming all existing baseline methods while effectively maintaining practical utility. Notably, comparative experiments across three multi-turn safety datasets further validate the proposed model's significant advantages over other defense approaches.

Problem

• Defends against multi-turn jailbreak attacks on LLMs
• Detects concealed malicious intent through bidirectional inference
• Reduces attack success rate while maintaining model utility

Innovation

• Bidirectional intention inference detects hidden risks
• Forward and backward analysis prevents harmful content
• Synergy mechanism enhances defense against jailbreak attacks