Trace: Trajectory-Aware Reasoning Defense Against Multi-Turn Jailbreak Attacks

A novel defense strategy named Trace has been launched to address multi-turn jailbreak assaults on large language models (LLMs). These attacks fragment harmful goals across a series of seemingly harmless interactions to evade safety measures. Current defenses struggle to recognize changing manipulation tactics, frequently over-rejecting innocent inquiries concerning sensitive subjects. Trace utilizes trajectory-aware structured reasoning: prior to crafting each reply, the model detects manipulation signals from the conversation's trajectory, assesses both benign and malicious interpretations of user intent, assigns a jailbreak score, and decides on an action: Allow, Caution, or Decline. The researchers compiled 4,000 multi-turn adversarial dialogues from five attack frameworks, alongside 2,400 benign dialogues and 600 sensitive-but-benign exchanges. They trained Llama-3.1-8B-Instruct via supervised fine-tuning (SFT) and group relative policy optimization (GRPO) with a multi-component reward optimizing both safety and helpfulness. The paper is accessible on arXiv with the identifier 2608.15594.