mlsanityData to 14 Oct 2026

Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures

arXiv 2609.27773 ↗First posted 17 Aug 2026cs.CL cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

As Large Language Models (LLMs) move from conversational assistants to advanced agentic systems, guardrail failures can convert adversarial intents into harmful executions. However, most evaluation frameworks focus only on whether a user request is unsafe. This is insufficient for multi-turn failures, where adversarial intent may be distributed across turns and emerge only from accumulated context. This motivates us to go beyond detection to localize the evidence that pushes the conversation toward unsafe trajectories. We introduce MTAG-Bench, a multi-turn guardrail attribution dataset with behavioral validation and counterfactual supervision containing 4,167 conversations. We also introduce MTAG-Probe, a hierarchical attribution model for turn- and span-level evidence localization with conversation-level safety detection. MTAG-Probe improves turn-level F1 by 28.1 and 24.1 points (79.0% and 61.0% relative) over self-attribution by the model that produced the unsafe response and the LLM safety-judge attribution, respectively. Removing MTAG-Probe's top-ranked evidence within budgets of 15% and 20% of user words per conversation changes 50.6% and 60.8% of Llama Guard decisions on Geometry from unsafe to safe, respectively. In full-trajectory replay, MTAG-Probe converts 84.3% of eligible unsafe final responses to safe. These results show that MTAG-Probe can provide evidence-level explanations as a practical complement to safety detection.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 18 of its 27 references that are in the map. First posted on arXiv 17 Aug 2026.

Builds on

18 of 27 references.

References · 18

  1. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  2. 2017Axiomatic Attribution for Deep Networkscited by 3,384
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2021DeBERTaV3: Improving DeBERTa using ELECTRA-Style Pre-Training with Gradient-Disentangled Embedding Sharingcited by 1,254
  7. 2019Attention is not Explanationcited by 929
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  9. 2019ERASER: A Benchmark to Evaluate Rationalized NLP Modelscited by 530
  10. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  11. 2018A Benchmark for Interpretability Methods in Deep Neural Networkscited by 476
  12. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
6 more
  1. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 243
  2. 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 231
  3. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 151
  4. 2025JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulationcited by 54
  5. 2023Goodhart's Law Applies to NLP's Explanation Benchmarkscited by 10
  6. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safetycited by 8

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models
  2. 2026Stateful Guardrails for Multi-Turn LLM Systems: A Conversational Risk Accumulation Framework
  3. 2026TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation
  4. 2025SGuard-v1: Safety Guardrail for Large Language Models
  5. 2026Evaluating Language Model Safety Across Long Adversarial Conversations
  6. 2026LongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails
  7. 2026The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails
  8. 2026One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent