DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMs
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
While Large Language Model (LLM) capabilities have scaled, safety guardrails remain largely stateless, treating multi-turn dialogues as a series of disconnected events. This lack of temporal awareness facilitates a "Safety Gap" where adversarial tactics, like Crescendo and ActorAttack, slowly bleed malicious intent across turn boundaries to bypass stateless filters. We introduce DeepContext, a stateful monitoring framework designed to map the temporal trajectory of user intent. DeepContext discards the isolated evaluation model in favor of a Recurrent Neural Network (RNN) architecture that ingests a sequence of fine-tuned turn-level embeddings. By propagating a hidden state across the conversation, DeepContext captures the incremental accumulation of risk that stateless models overlook. Our evaluation demonstrates that DeepContext significantly outperforms existing baselines in multi-turn jailbreak detection, achieving a state-of-the-art F1 score of 0.84, which represents a substantial improvement over both hyperscaler cloud-provider guardrails and leading open-weight models such as Llama-Prompt-Guard-2 (0.67) and Granite-Guardian (0.67). Furthermore, DeepContext maintains a sub-20ms inference overhead on a T4 GPU, ensuring viability for real-time applications. These results suggest that modeling the sequential evolution of intent is a more effective and computationally efficient alternative to deploying massive, stateless models.
Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 14 of its 31 references that are in the map. First posted on arXiv 18 Feb 2026.
Builds on
14 of 31 references.
Closest ancestors · 6
Same direction, newest first
- 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models18 Apr
- 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents15 Apr
- 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMs27 Feb
- 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models16 Feb
- 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
Other references · 8
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
- 2024CoSafe: Evaluating Large Language Model Safety in Multi-Turn Dialogue Coreferencecited by 51
- 2025MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teamingcited by 31
- 2025Sliding Window Attention Training for Efficient Large Language Modelscited by 21
- 2025LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challengecited by 20
- 2023PRODIGy: a PROfile-based DIalogue Generation datasetcited by 16
- 2024Trust-Oriented Adaptive Guardrails for Large Language Modelscited by 8
- 2025JavelinGuard: Low-Cost Transformer Architectures for LLM Securitycited by 4
Built on by
Citing papers per year: 2026: 8.
8 papers.
- 2026TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectoriescited by 12
- 2026Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Rewardcited by 3
- 2026Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Familiescited by 2
- 2026The Workload-Router-Pool Architecture for LLM Inference Optimization: A Vision Paper from the vLLM Semantic Router Projectcited by 1
- 2026Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Modelscited by 1
- 2026Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detectioncited by 0
- 2026Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulationcited by 0
- 2026Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verificationcited by 0
- 2026Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models16 Sep 2026
- 2026Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification28 Aug 2026
- 2026Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Families8 Aug 2026
- 2026Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation3 Aug 2026
- 2026Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detection30 Apr 2026
- 2026Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward10 Apr 2026
- 2026TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories8 Apr 2026
- 2026The Workload-Router-Pool Architecture for LLM Inference Optimization: A Vision Paper from the vLLM Semantic Router Project22 Mar 2026