← Back to Library

DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMs

Authors: Justin Albrethsen, Yash Datta, Kunal Kumar, Sharath Rajasekar

Published: 2026-02-18

arXiv ID: 2602.16935v1

Added to Library: 2026-02-20 03:01 UTC

Red Teaming

📄 Abstract

While Large Language Model (LLM) capabilities have scaled, safety guardrails remain largely stateless, treating multi-turn dialogues as a series of disconnected events. This lack of temporal awareness facilitates a "Safety Gap" where adversarial tactics, like Crescendo and ActorAttack, slowly bleed malicious intent across turn boundaries to bypass stateless filters. We introduce DeepContext, a stateful monitoring framework designed to map the temporal trajectory of user intent. DeepContext discards the isolated evaluation model in favor of a Recurrent Neural Network (RNN) architecture that ingests a sequence of fine-tuned turn-level embeddings. By propagating a hidden state across the conversation, DeepContext captures the incremental accumulation of risk that stateless models overlook. Our evaluation demonstrates that DeepContext significantly outperforms existing baselines in multi-turn jailbreak detection, achieving a state-of-the-art F1 score of 0.84, which represents a substantial improvement over both hyperscaler cloud-provider guardrails and leading open-weight models such as Llama-Prompt-Guard-2 (0.67) and Granite-Guardian (0.67). Furthermore, DeepContext maintains a sub-20ms inference overhead on a T4 GPU, ensuring viability for real-time applications. These results suggest that modeling the sequential evolution of intent is a more effective and computationally efficient alternative to deploying massive, stateless models.

🔍 Key Points

  • Introduction of DeepContext, a stateful monitoring framework for LLMs that effectively tracks user intent over multi-turn dialogues, addressing the stateless limitations of current defenses.
  • Implementation of a Recurrent Neural Network (RNN) architecture that maintains a hidden state to capture the cumulative risk of adversarial intent across conversational turns.
  • Achieved a state-of-the-art F1 score of 0.84 in detecting multi-turn adversarial attacks, significantly outperforming existing models such as Llama-Prompt-Guard-2 and Granite-Guardian, which scored 0.67.
  • Demonstrated a low inference latency of less than 20 milliseconds on a T4 GPU, making DeepContext suitable for real-time applications.
  • Contributed to the understanding of the 'Safety Gap' in LLM deployments by providing empirical evidence that a stateful approach is more effective than large, stateless models.

💡 Why This Paper Matters

The paper presents DeepContext as a transformative approach to enhancing LLM safety in adversarial contexts, emphasizing the importance of stateful monitoring. Its findings are crucial for deploying AI systems that operate safely in real-time applications, particularly those involving complex and adaptive user interactions. DeepContext bridges the 'Safety Gap' by modeling user intent as a temporal trajectory rather than isolated events, thus representing a significant advancement in the field.

🎯 Why It's Interesting for AI Security Researchers

This paper is of particular interest to AI security researchers because it tackles a critical challenge in the deployment of large language models: the ability to effectively detect and mitigate multi-turn adversarial attacks. As adversaries become increasingly sophisticated in their attempts to exploit AI systems, mechanisms like DeepContext that can dynamically assess risk and intent are crucial for developing robust defenses. Researchers focused on AI safety can utilize these insights to further enhance model robustness and explore new avenues for stateful monitoring.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF