New Guardrails Detect Conversational Risk in Multi-Turn LLMs.

Current safety guardrails for large language models (LLMs) typically evaluate each prompt-response pair in isolation, failing to detect risks that emerge over an entire conversation. This limitation allows seemingly benign turns to cumulatively lead to harmful outcomes, a phenomenon termed Conversational Risk Accumulation (CRA). This research proposes a novel session-layer CRA Framework to address this critical gap. The CRA Framework tracks three key trajectory signals throughout a dialogue: semantic drift from an initial session anchor, a sensitivity-weighted information accumulation graph over extracted entities, and a compliance-gradient signal indicating increasing willingness to comply with potentially harmful requests. For scoring, it offers both an unsupervised convex fusion method and CRA-Net DA, a compact learned trajectory model trained with adversarial objectives. To benchmark this framework, the researchers released CRA-Bench v0.1 and v0.2, comprehensive datasets of multi-turn sessions designed to expose CRA across various threat families. The framework introduces a trajectory-native evaluation protocol, including session-level splits and metrics like Trajectory AUROC, demonstrating its effectiveness in detecting subtle, cumulative risks that traditional methods miss.