One Turn Too Late: Learning When to Intervene on Malicious Intent in Multi-Turn Conversations

Researchers propose a defense against hidden malicious intent in multi-turn large language model conversations, modeling the defense as the problem of judging when intervention is needed and defining the earliest harmful turn (i.e., the first turn at which the cumulative interaction is sufficient to enable harmful behavior) as the intervention boundary. To construct supervision signals at scale, the authors build the Multi-Turn Intent Dataset (MTID), containing adaptive attack rollouts, matched benign hard negatives, and boundary annotations, and use it to train the response-aware monitor TurnGate, whose intervention policy is then optimized via multi-turn reinforcement learning. The authors' experiments show that turn-level boundary supervision improves intervention localization, and that reinforcement learning further improves the safety-utility trade-off; TurnGate outperforms existing guardrail and multi-turn monitoring baselines across risk domains, attack procedures, and target models. Code is open-sourced at https://github.com/Graph-COM/TurnGate。