HRGuard: intercepting relational manipulation in multi-turn agent conversations

The researchers propose HRGuard to intercept relational manipulation in multi-turn agent conversations, blocking gradually forming harmful workflows through pre-generation gating and turn-level post-generation gating. The study also constructs a benchmark of 1000 five-turn conversations, covering attacker-side and victim-side scenarios and including variants with direct phrasing and adversarial rewrites. The post-gating maintains a decaying cumulative risk state to interrupt manipulation processes that are forming. Across eight generative models, HRGuard reduces compliance with harmful requests while preserving protective advice for the victim side, and outperforms one general safety prompt and three general guardrail models. Evaluation by an independent reviewer model supports the above main conclusions; under its experimental protocol, the general prompt and general guardrails still leave substantial residual risk, and the authors accordingly argue for turn-level, relationship-scenario-specific evaluation.