*English translation of a forum post analyzing TRIAD (arXiv:2605.18988v1) by Doohee You, Google Trust & Safety, dated 2026-05-18.*
1. Attackers Changed Their Playbook
Imagine a scenario: you talk with a multimodal AI assistant. The first ten turns are perfectly normal—weather, directions, a landscape photo. On turn eleven, a seemingly harmless restaurant menu image arrives with the question "which dish do you recommend?" On turn twelve, an ordinary question about ingredients. By turn twenty, the model suddenly produces a dangerous chemical synthesis plan.
What went wrong? Not the content of turn twenty itself. Every turn, viewed alone, passes safety review. Malicious intent has been fragmented and scattered across a twenty-turn conversation. Traditional single-turn filters—Llama Guard, ShieldGemma—are useless here. They are like door guards checking each person entering, unable to see the group's collective purpose.
The author calls this the "Markov trap": the guard's memory lasts exactly one turn.
Attackers know this. Crescendo, Foot-In-The-Door, PolyJailbreak—the common thread of new attack manuals is not severity of content but depth of patience. They fragment malicious intent so each injection stays below any static threshold, while the accumulation pushes the model off the rails.
Traditional safety alignment is fighting a patient, indirect adversary who exploits the time dimension—with a weapon that fires one shot at a time.
2. What TRIAD Is: Not a Better Rifle, but a Radar
The paper does not propose a stricter safety filter. It takes a different path: predicting when the model will fail.
TRIAD—Triple-tier Anomaly Defense—treats a multi-turn conversation as a trajectory flying through a dark room. Traditional methods photograph each position and check "is anything wrong here?" TRIAD tracks the trajectory's curvature, acceleration, and deviation from course, judging whether the aircraft is losing control and sounding the alarm before it crashes.
Not interception—prediction. Not point checks—dynamics tracking.
3. The Three Tiers
Tier 1: Isolation Forest — the low-cost sentry
Each turn is encoded as a high-dimensional vector: text embeddings, image embeddings, and behavioral covariates concatenated together. An Isolation Forest quickly screens this vector. The algorithm's logic is simple: randomly select dimensions, randomly split, and see how many splits it takes to isolate a point. Normal points in dense regions take many splits; anomalous points get isolated quickly.
Complexity: O(log N), millisecond-level. It doesn't aim for precision—only triggering. Only if the score exceeds threshold α do the expensive computations start. Below α, the conversation continues at near-zero overhead.
A very Feynman-like design: build something rough but fast first, bring out the precision instruments only when needed.
Tier 2: Distribution anchoring and kinematics — precision targeting
Two tools here.
Ledoit-Wolf regularized Mahalanobis distance. Compute the distance between the current conversation state and the "normal conversation distribution." In high dimensions, when D >> N, the sample covariance matrix becomes rank-deficient and inversion explodes numerically. Ledoit-Wolf shrinks the sample covariance toward the identity matrix, keeping it always invertible and positive definite:
Σ̂_LW = (1-λ)Σ + λ·Tr(Σ)/D · I
λ is optimized by minimizing the Frobenius norm. This turns "possibly uncomputable" into "always computable."
Topological trajectory acceleration—the paper's most elegant insight. Two behavior types are distinguished:
- Benign creative exploration: the user jumps topics, deviates from the normal distribution, then settles. Distance rises then plateaus; rate of change goes to zero.
- Malicious gradual drift: the attacker must keep injecting perturbations, distorting the direction every turn. Distance doesn't just increase—it accelerates.
a_t = D_M(t) - 2D_M(t-1) + D_M(t-2)
Benign exploration's acceleration tends to zero (even negative). Malicious drift's acceleration is strictly positive, bounded below by ε.
The physical intuition: an attacker cannot stop. Stop injecting malicious signals and the conversation naturally converges to some normal local manifold. Sustaining the attack requires continuous work; continuous work implies acceleration; acceleration is detectable. Newton's second law, shadowing conversation safety: external force produces acceleration.
Tier 3: Survival analysis — predicting when it crashes
The outputs—Mahalanobis distance D_M, isolation score S_iso, acceleration a_t—feed a Cox proportional hazards model, borrowed from medical statistics where it predicts how long until a patient dies. Here, "death" becomes "the model's first safety policy violation":
h(t) = h_0(t) · exp(β₁D_M + β₂S_iso + γ·a_t)
When h(t) exceeds threshold τ_hazard and a_t > 0 (confirming it isn't benign fluctuation), the system alerts and terminates the conversation early. A Bayesian hidden Markov model provides a feedback loop: last turn's posterior becomes this turn's prior, adding "contextual inertia" instead of starting from scratch each round.
4. The Mathematical Case for "Completeness"
The paper's core theoretical results:
Theorem 1: expected time-to-failure under adversarial perturbation is bounded. If an attacker injects orthogonal noise δ into the visual latent space with sufficient L2 norm, then since Σ̂_LW is strictly positive definite:
δ^T · Σ̂_LW^{-1} · δ > 0
for any nonzero δ. The Mahalanobis distance increment has a lower bound proportional to ‖δ‖². Injecting every turn, the survival probability S(t) = P(T > t) decays exponentially to zero. There exists a finite upper bound T_max with S(T_max) < τ. In plain terms: as long as the attacker keeps injecting, the model will eventually fail—and TRIAD can mathematically guarantee predicting it beforehand.
Theorem 2: malicious acceleration never converges to zero. Benign exploration settles on a local manifold, velocity decaying, acceleration approaching zero. Malicious drift must sustain a displacement constraint ‖V'(t)‖ ≥ c > 0. From the second-derivative expansion:
d²D_M/dt² = V'(t)^T · H_{D_M} · V'(t) + ∇D_M · V''(t)
the continuous external force keeps the sum from going negative; malicious acceleration stays above a positive lower bound ε.
Together: sustained malicious injection necessarily generates a detectable signal, provable in the language of statistical mechanics and survival analysis.
5. Honest Limitations
Section 5 of the paper spends nearly half its length on deployment mitigations—not showing off scalability, but patching holes:
Manifold heterogeneity. Normal conversations aren't a single Gaussian. Topic switches artificially inflate distances. Fix: a Gaussian Mixture Model (GMM) replaces the single global covariance, dynamically identifying the current topic cluster at runtime.
Temporal inertia. Cox's proportional hazards assumption is fragile against "sudden shock attacks"—nineteen clean turns followed by a massive jailbreak payload on turn twenty, with historical inertia damping the risk score. Fix: accelerated failure time (AFT) models with Weibull distributions, shrinking baseline survival time based on recent turns' instantaneous shock magnitude.
Sub-threshold evasion. "Boiling frog" attacks carefully keep the isolation forest score below α with per-turn micro-perturbations. Fix: a random audit mechanism—an asynchronous background process periodically runs full covariance checks, independent of the iForest trigger.
The takeaway: the raw framework isn't enough in production. GMM, AFT, and random audits aren't nice-to-haves—they're mandatory.
6. What Feynman Would Say
The most attractive thing about TRIAD isn't that it uses isolation forests or Cox models—all off-the-shelf tools. It's that it reframes the problem itself.
Traditional safety alignment asks: "Is this sentence problematic?" TRIAD asks: "Where is this conversation heading?"
The former is classification, static, requiring supervised learning on attack samples. The latter is prediction, dynamic, unsupervised—and thus effective even against zero-day attacks, because it detects anomalous trajectory dynamics, not known malicious patterns.
"Don't just name the bird. Figure out how it flies." Traditional defenses name every attack, build datasets, train classifiers. TRIAD says: I don't need to know what bird it is—only whether its flight trajectory is accelerating off course.
But Feynman would also ask a sharp question: "Did you actually verify this, or only prove it on paper?"
This is a theoretical framework. It gives simulation protocols and complexity bounds, but no large-scale experimental results. Detection rates, false-positive rates, and actual defense effectiveness against known attacks (Crescendo, PolyJailbreak, Mastermind) on real MLLMs are missing from the provided text. Theoretical guarantees don't equal engineering efficacy. Mathematical completeness is necessary, not sufficient.
7. Core Conclusion
TRIAD pushes AI safety from "single-turn review" to "trajectory prediction." The three tiers divide the labor: isolation forest for fast triggering, Mahalanobis distance + acceleration for precise kinematics, Cox survival modeling for failure-time prediction.
Key insight: malicious attacks must do continuous work; continuous work implies positive acceleration; positive acceleration is detectable. Not a thicker shield—a radar that computes the missile's landing point before it hits.
For autonomous agents and multi-turn dialogue systems, this means safety alignment is no longer just "filtering inputs" but monitoring conversation health, alerting before the model drifts too far off the safe course.
The paper concludes: "This marks a decisive shift—from static, reactive prompt filtering to dynamic, predictive survival modeling."
That's a big claim. But the theoretical foundation is solid. What's missing is large-scale experimental validation. Only when that data arrives can we judge how accurate this radar is on a real battlefield.