Drop "write me a napalm recipe" straight into a large language model and you will almost certainly get a refusal. But split the same request across seven or eight turns — start with the chemistry of fertilizers, move on to industrial process design, and only at the end bring up the critical step — and plenty of models will nod along. Single-turn defenses are not badly built; they simply do not sit on the attacker's path.

On October 29, a team spanning UC Davis and Microsoft Research published a paper proposing ShallowDefend, a defense framework aimed squarely at multi-turn jailbreaks. Its author list runs to twelve names and includes Jianfeng Gao, a longtime researcher in model adversarial robustness (arXiv:2610.40627). The premise is mildly counterintuitive: rather than trying to make safety alignment deeper, the paper accepts that alignment is already shallow, and then occupies that most fragile position directly.

Why the line breaks down over multiple turns

Safety alignment has a mechanism that has been verified again and again: an aligned model differs from its own base almost exclusively over the first few output tokens. A refusal is something said out loud at the beginning; once the opening goes compliant, the rest of the distribution collapses back toward the base model's. This is also why prefilling an affirmative prefix defeats refusal — the attacker does not need to persuade the model, only to swap out its opening line.

Multi-turn jailbreaks walk exactly that path. Each turn looks harmless in isolation; the model is walked forward turn by turn, and by the time the payload lands it already sits in a local "just going along with it" context. The refusal is gone before anyone needs it.

An earlier generation of defenses — SFT, DPO, judge-in-the-loop RL, representation-level interventions — mostly share one dependency: something must act as judge and tell the model what a safe answer looks like. The paper flags two costs of that. Judges disagree with each other on a substantial fraction of individual samples, so building a training reward on a single judge imports that judge's errors into training; and because the model is only ever shown what safe replies look like, it never learns an explicit decision that could be checked.

Writing the decision out so a rule can read it

ShallowDefend requires the defender to emit a fixed three-part structure on every turn: an Assessment of the user's true underlying intent, a Decision (COMPLY / REFUSE / SAFE-REDIRECT), and the Response the user actually sees.

The position of that Decision line is the whole trick. It appears inside the same generation, before the reply, and the reply is produced conditioned on it. The paper calls this property binding: change the decision and the entire response changes. And because it is a token span in the model's own output, a rule can read it directly — there is no need to bring in another model to judge it.

There are two reward formulations. The external reward uses the HarmBench-13B classifier as judge, scoring across the three-way decision space. The "self-verified" reward is cheaper: training dialogues are grown from seed prompts whose nature is known in advance, so every trajectory carries a ground-truth label for free — dialogues grown from harmful seeds must commit to refuse, those grown from benign seeds to comply. The reward collapses into a string comparison, with no judge and no annotation.

One detail in the self-verified version matters a lot: the reward includes a guard requiring the reply to be non-empty. Without it, the policy finds a degenerate optimum — always refuse, never answer anything, still collect full reward. That guard closes the reward-hacking route.

Training uses GRPO. Reward is assigned on the final turn only, since that is where a multi-turn jailbreak lands its payload, and each turn gets its own token budget so the policy cannot burn the whole budget on easy early turns and leave the decisive last turn with nothing to say.

The numbers

The paper evaluates two base models, Llama3.1-8B-Instruct and Qwen3-8B, across fourteen benchmarks. Safety is measured on AdvBench, HarmBench, MultiBreak, CoSafe and MHJ. Utility is the average over MMLU, HellaSwag, Winogrande, GSM8K, TruthfulQA and IFEval. Helpfulness is tracked through over-refusal on XSTest and XSB, plus conversation quality on MT-Bench.

On Llama3.1-8B-Instruct, the base model averages 59.9 across the five safety benchmarks. After training, the self-verified reward variant reaches 90.4 and the external reward variant reaches 92.9. The strongest competing baseline trained on the same data, X-Boundary, reaches 86.3.

On Qwen3-8B the gap is larger: base 46.1, self-verified 93.4, external reward 87.6, and the best baseline MUSE-D at 85.7. What is interesting is that the winning reward formulation is not the same across the two backbones — on Qwen, the variant that brings no judge at all comes out ahead.

The cost shows up in the other columns. On Llama, utility moves from 66.3 to 66.8 (self-verified) and 65.8 (external), essentially unchanged. But XSTest over-refusal climbs from 10.0 to 20.4 (self-verified) and 21.6 (external). On Qwen the effect is more visible: XSTest goes from 7.2 to 26.4, while MT-Bench moves from 6.08 to 7.36 (self-verified) and 6.96 (external).

Mechanistically, the paper verifies the story with per-token KL divergence. The difference between the trained and untrained model no longer piles up on the first few tokens the way conventional alignment does; it spreads across the Assessment phase, peaks near the Decision token, and then gradually vanishes as the response becomes determined. The interventional probes in the appendix go further: overwriting an already-committed decision moves reply safety in both directions, indicating this is a genuine causal control point rather than a correlation.

My take

What is worth taking from this paper is not the scores but the move of reading a defect as a map.

That alignment is shallow is a known fact, and the previous response was to deepen it. This paper's logic is different: if refusal already lives in a very short span, then that span is both the most fragile attack surface and the cheapest place to defend — you can occupy it first.

The more practically useful point is turning the decision into something a rule can read. Once the safety judgment is a token span in the model's own output, it no longer has to depend on another model to evaluate it, training signal and evaluation metric can be decoupled, and jailbreaking acquires a first position that a rule can physically block, rather than just a drop in probability.

Some cold water is warranted. All comparisons come from the authors' own controlled experiments, judges disagree on a substantial fraction of individual samples, and there is a harder boundary still: if a threat bypasses the refusal pathway entirely, guarding the first few tokens may not help. The rise in over-refusal is something a real product will have to pay for.

The shallowness itself has not changed. What has changed is that someone now treats it as an interface you can engineer against, rather than a disease you can only patch.