Introduction
A post on zhichai.net reviews TRIAD (Triple-tier Anomaly Defense), a theoretical framework by Doohee You (Google Trust & Safety), published as arXiv:2605.18988v1 on 2026-05-18.
The Problem: The Markov Trap
Modern multi-turn attacks (Crescendo, Foot-In-The-Door, PolyJailbreak) fragment malicious intent across many individually benign turns. Traditional single-turn filters (Llama Guard, ShieldGemma) inspect each turn in isolation and miss the accumulated drift—what the author calls the "Markov trap": the guard's memory lasts only one turn.
The Reframe: Prediction, Not Interception
TRIAD treats a conversation as a trajectory. Instead of checking snapshots at each point, it tracks the trajectory's curvature, acceleration, and deviation from normal paths—predicting failure before it happens.
Three-Tier Architecture
Tier 1: Isolation Forest — Cheap Sentinel
- Each turn is encoded as a high-dimensional vector (text/image embeddings + behavioral covariates).
- An Isolation Forest screens the vector in O(log N), millisecond-level cost. Its score merely *triggers* deeper analysis when above threshold α.
- Ledoit-Wolf regularized Mahalanobis distance: measures distance of the current state from the normal-conversation distribution. The shrinkage estimator
- Topological trajectory acceleration — the paper's key insight. Second-order difference:
- Benign creative exploration: distance rises then plateaus; acceleration → 0.
- Malicious gradual drift: attackers must keep injecting perturbations; acceleration is strictly positive, bounded below by ε.
- Outputs (D_M, Isolation Forest score S_iso, acceleration a_t) feed a Cox proportional hazards model:
- When hazard h(t) exceeds threshold τ_hazard with positive acceleration, the system alerts and terminates early. A Bayesian HMM feedback loop carries posterior probabilities forward as priors.
- Manifold heterogeneity: normal conversations aren't one Gaussian → use Gaussian Mixture Models to identify topic clusters and compute locally-parameterized distances.
- Temporal inertia: the proportional hazards assumption is vulnerable to sudden shock attacks → introduce Accelerated Failure Time (AFT) models with Weibull distributions shrinking baseline survival time by recent-turn shock magnitude.
- Sub-threshold evasion ("boiling frog" attacks) → random asynchronous audits performing full covariance checks independent of the iForest trigger.
Tier 2: Distributional Anchoring & Kinematics
Σ̂_LW = (1-λ)Σ + λ·Tr(Σ)/D · I
keeps the covariance matrix invertible in high dimensions.
a_t = D_M(t) - 2D_M(t-1) + D_M(t-2)
Physical intuition: an attacker cannot stop—sustained work implies detectable acceleration (a shadow of Newton's second law in conversation safety).
Tier 3: Survival Analysis — Predicting the Crash
h(t) = h_0(t) · exp(β₁D_M + β₂S_iso + γ·a_t)
Theoretical Guarantees
1. Theorem 1: For adversarial perturbations δ with ‖δ‖ in the visual latent space, strict positive-definiteness of Σ̂_LW gives δ^T·Σ̂_LW^{-1}·δ > 0, so Mahalanobis distance grows by a fixed per-turn amount, and survival probability S(t) decays exponentially—there exists a finite T_max with S(T_max) < τ. 2. Theorem 2: Malicious acceleration never converges to zero; sustained displacement constraints (‖V'(t)‖ ≥ c > 0) keep the second derivative above a positive lower bound ε.
Honest Limitations
The paper devotes nearly half of Section 5 to deployment mitigations, conceding the raw framework is insufficient in production:
Conclusion
TRIAD shifts AI safety from "single-turn review" to "trajectory prediction": malicious attacks must do sustained work, sustained work yields positive acceleration, and positive acceleration is detectable. It's a radar, not a thicker shield. The reviewer's caveats: the framework is theoretically sound but lacks large-scale experimental validation (detection rates, false positives, defense against Crescendo/PolyJailbreak/Mastermind on real MLLMs). As the paper states, it marks "a decisive shift—from static, reactive prompt filtering to dynamic, predictive survival modeling"—pending real-world numbers.