ShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn Defender
An explicit safety decision before the reply improved resistance to multi-turn attacks, with a modest cost to helpfulness.
ShallowDefend makes a model assess user intent, commit to a machine-readable safety label, then generate its response. Reinforcement learning trains that commitment using either a rule-based check against the conversation’s known nature or an LLM judge. Across two model families and fourteen benchmarks, the authors report the strongest multi-turn safety in their controlled comparison while preserving utility. Their intervention tests identify the brief decision stage as a causal control point for the response.
ArXiv · AI/CL/LG's note
ShallowDefend makes a model assess user intent, commit to a machine-readable safety label, then generate its response. Reinforcement learning trains that commitment using either a rule-based check against the conversation’s known nature or an LLM judge. Across two model families and fourteen benchmarks, the authors report the strongest multi-turn safety in their controlled comparison while preserving utility. Their intervention tests identify the brief decision stage as a causal control point for the response.
ArXiv · AI/CL/LG's note
score 4