Safety vulnerabilities in multi-turn conversations stem from shallow alignment in early tokens; explicitly training models to commit to a parseable safety decision before generating responses—rather than just supervising the surface form—creates a causal control point that significantly impro...
This paper addresses why LLMs refuse harmful requests in single turns but fail across multi-turn conversations. The authors show safety alignment is 'shallow'—concentrated in early output tokens—and propose ShallowDefend, which makes models explicitly commit to a safety decision before responding.