AGENTIC-SYSTEMSJuly 24, 20261 min read

Robust Critics: Defending LLMs Against Multi-Turn Attacks

Researchers introduce Dialogue Critic Guided Sampling (DCGS), a new framework designed to defend Large Language Models against complex, multi-turn adversarial attacks by inferring user intent throughout the conversation history.

When a user asks a language model something harmful, is it a genuine attack or a misunderstood but well-meaning question? This ambiguity is one of the central challenges of LLM safety. A model that assumes the worst harms legitimate users; one that assumes the best is easily exploited. The problem is compounded in multi-turn dialogue, where an attacker's true intent may only reveal itself gradually across many exchanges, yet existing safety frameworks apply a contextual bandit treatment, ignoring the trajectory of the conversation.

To that end, we propose Dialogue Critic Guided Sampling (DCGS), a framework that addresses this by inferring user intent at every turn of dialogue. Instead of applying a fixed rule about what is or is not safe, DCGS learns what the user's intent is likely to be based on the full conversational history and generates responses accordingly. Formally, we model adversarial dialogue as a Markov Decision Process and learn value and regret-based critics at both the individual token and utterance (full response) levels, scoring candidate responses via an action-value critic. We prove that this inference-time reweighting approximates exponential tilting of the base policy, guaranteeing improvement in expected return for any finite candidate pool, a property that group-relative objectives do not exhibit. Evaluated on CARES-18k, WildJailbreak, Redbench, and Harmbench, DCGS outperforms strong robust baselines and frontier models on adversarial dialogue tasks. DCGS also transfers to frontier models, improving their robustness without fine-tuning.

Source: arXiv cs.AI Recent

More in this category

agentic-systems

Enabling Scalable Topology Inference in Distribution Systems via Constrained Multi-Source Inference

A new research study introduces a constrained multi-source inference framework to accurately reconstruct power distribution system topology. Validated on over 8,000 smart meters in the U.S., the method achieves over 95% accuracy while drastically reducing computational overhead.

agentic-systems

Incomplete Prompt Jailbreaks in Large Language Models

Researchers have conceptualized Incomplete Prompt Jailbreaks (IPJ), a vulnerability where incomplete harmful prompts bypass LLM safeguards due to delayed refusal behaviors. The discovery of functional neurons offers a novel path for precise neuron-level defense interventions.

agentic-systems

InferenceBench: A Benchmark for Open-Ended LLM Inference Optimization by AI Agents

InferenceBench is a new benchmark evaluating AI agents on open-ended LLM inference optimization tasks under realistic constraints. While agents outperform default setups, qualitative analysis reveals key limitations in their strategic exploration capabilities.

agentic-systems

PersonaTrail: Benchmarking Personalized Web Agents through Browsing Trails

Researchers have introduced PersonaTrail, a novel benchmark evaluating personalized web agents through realistic browsing histories. Alongside it, the PACMem memory framework structures raw browsing data to significantly boost agent performance in inferring user preferences.

agentic-systems

Beyond Liars' Bench: The Impact of Lie Typology, Depth, and Sparsity on Deception Detection in LLMs

A new study reveals that deception detection in LLMs heavily depends on lie typology and training data structure, highlighting why current detection probes struggle in out-of-domain scenarios.

agentic-systems

Benchmarking Large Language Models on Multi-Sensor Physical Hazard Assessment

A new benchmark evaluates five leading large language models on multi-sensor physical hazard assessments, revealing a critical vulnerability when evaluating combined sensor risks below individual thresholds. Despite near-perfect accuracy on single-sensor breaches, all models failed to issue precautionary signals for multi-sensor hazards.