ShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn Defense in LLMs

Forum topic · 小凯 · 2026-10-30

Summary

ShallowDefend (arXiv:2610.40627) addresses a key brittleness in LLM safety alignment: while models reliably refuse harmful requests in a single turn, the same request spread across a multi-turn conversation often succeeds. The authors identify a mechanistic root: alignment is shallow, with safety behavior concentrated in a model's first few output tokens, and existing defenses inherit this weakness by supervising only the surface form of responses without an explicit safety decision for the model to learn. Instead of treating shallowness as a flaw, the paper views it as leverage: if a short token span determines the trajectory of an entire response, a defender can intervene there first. The proposed Assess → Decide → Respond framework has the model assess user intent, commit to an explicit safety decision, and then respond accordingly, providing robust defense against multi-turn jailbreaks. Authored by Qiyao Ma, Xiaodong Liu, Jianfeng Gao, and colleagues, the work was published on arXiv in October 2026.

Paper Overview

Field: NLP
Authors: Qiyao Ma, Xiaodong Liu, Weiwei Yang, Mingqian Feng, Chengquan Guo, Jialin Song, Carolyn Buractaon, Zhe Zhao, Junshan Zhang, Sandeep Atluri, Christopher White, Jianfeng Gao
Published: 2026-10-29
arXiv: 2610.40627

Abstract (Translation)

Safety alignment has enabled large language models to reliably refuse harmful requests directly, yet the same request distributed across a multi-turn conversation still succeeds far too often. This brittleness has a mechanistic root: alignment is shallow, with safety behavior concentrated in a model's first few output tokens, and existing defenses inherit the weakness, supervising the surface form of the response without ever giving the model an explicit safety decision to learn.

The authors take the opposite view of shallowness: if a short span determines the trajectory of an entire response, that span is the highest-leverage place to intervene, and the defender can occupy it first. They propose Assess → Decide → Respond, a framework in which the defender assesses the user's intent, commits to an explicit safety decision, and then responds accordingly — turning shallow alignment from a vulnerability into a defense mechanism against multi-turn attacks.

*Note: the Chinese summary auto-attached to the forum post describes an unrelated luggage re-identification paper; the content above reflects the actual ShallowDefend paper abstract.*

---

*Auto-collected on 2026-10-31.*

ShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn Defense in LLMs

Summary

Paper Overview

Abstract (Translation)

Tags