CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks

KrishnaSaiReddy Patil

cs.CRMar 30, 2026

CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks

Authors: KrishnaSaiReddy Patil

Abstract

LLM-based chatbots in government services face critical security gaps. Multi-turn adversarial attacks achieve over 90% success against current defenses, and single-layer guardrails are bypassed with similar rates. We present CivicShield, a cross-domain defense-in-depth framework for government-facing AI chatbots. Drawing on network security, formal verification, biological immune systems, aviation safety, and zero-trust cryptography, CivicShield introduces seven defense layers: (1) zero-trust foundation with capability-based access control, (2) perimeter input validation, (3) semantic firewall with intent classification, (4) conversation state machine with safety invariants, (5) behavioral anomaly detection, (6) multi-model consensus verification, and (7) graduated human-in-the-loop escalation. We present a formal threat model covering 8 multi-turn attack families, map the framework to NIST SP 800-53 controls across 14 families, and evaluate using ablation analysis. Theoretical analysis shows layered defenses reduce attack probability by 1-2 orders of magnitude versus single-layer approaches. Simulation against 1,436 scenarios including HarmBench (416), JailbreakBench (200), and XSTest (450) achieves 72.9% combined detection [69.5-76.0% CI] with 2.9% effective false positive rate after graduated response, while maintaining 100% detection of multi-turn crescendo and slow-drift attacks. The honest drop on real benchmarks versus author-generated scenarios (71.2% vs 76.7% on HarmBench, 47.0% vs 70.0% on JailbreakBench) validates independent evaluation importance. CivicShield addresses an open gap at the intersection of AI safety, government compliance, and practical deployment.

Figures & tables

Attack Framework	ASR	Target
HarmNet [ 3 ]	99.4%	Mistral-7B
HarmNet [ 3 ]	94.8%	GPT-4o
X-Teaming [ 4 ]	98.1%	Multiple
AutoAdv [ 14 ]	95.0%	Llama-3.1-8B
Crescendo [ 13 ]	29–61% $\uparrow$	GPT-4
Siren [ 15 ]	90.0%	Gemini-1.5-Pro

TABLE I: Multi-Turn Attack Success Rates (2024–2026)

Defense	Claimed ASR	Adaptive ASR
12 diverse defenses [ 2 ]	Near-zero	$>$ 90%
Constitutional Classifiers [ 20 ]	N/A	4.4%
6 popular guardrails [ 22 ]	Varies	Up to 100%
8 agent defenses [ 49 ]	Varies	$>$ 50%
TRYLOCK (layered) [ 26 ]	46.5%	5.6%

TABLE II: Defense Mechanisms and Documented Bypass Rates

Dimension	CivicShield	Bedrock Guardrails	Azure AI + Prompt Shields	NeMo Guardrails	LlamaFirewall	Rebuff	Lakera Guard	TRYLOCK
Multi-turn attack detection	◆	Partial a ★	Partial b ★	Partial c ★	Partial d ★	No	No	No
Cross-turn state tracking	◆	No	No	Yes e ★	No	No	No	No
Formal safety invariants	◆	Partial f ★	No	No	No	No	No	No
Behavioral anomaly detection	❍	No	No	No	Partial g ★	Partial h ★	Yes i ★	Partial j ★
Multi-model consensus	❍	No	No	No	No	No	No	No
Human escalation integration	❍	No	No	No	No	No	No	No

TABLE III: Structured Comparison of LLM Security Platforms Across Key Defense Dimensions

Panel of Figure 4 — Fig. 1: CivicShield seven-layer defense-in-depth architecture. Each layer draws from a distinct field (shown in italics), ensuring cross-domain diversity.

Family	Structure	Surface
Direct Injection	Single-turn	User input
Policy Puppetry	Single-turn	User input
Crescendo	Multi-turn	User input
Semantic Traversal	Multi-turn	User input
Context Poisoning	Multi-turn	RAG/indirect
Tool-Chain	Multi-turn	Tool calls

TABLE IV: CivicShield Attack Taxonomy

Attack	L1	L2	L3	L4	L5	L6	L7
Direct Injection	✓	✓	✓
Policy Puppetry		✓	✓		✓	✓
Crescendo			✓	✓	✓		✓
Semantic Traversal			✓	✓	✓	✓
Context Poisoning	✓		✓	✓		✓
Tool-Chain	✓			✓		✓	✓

TABLE V: Layer Coverage by Attack Family

Correlation ( $\rho$ )	Combined ASR	Interpretation
0.0 (independent)	0.045%	Idealized best case
0.3 (low correlation)	0.8%	Optimistic realistic
0.5 (moderate)	3.5%	Conservative realistic
0.7 (high correlation)	8.2%	Pessimistic realistic

TABLE VI: Sensitivity of Combined ASR to Layer Correlation

Control	Description	Layer
Access Control (AC)
AC-3	Access Enforcement	L1 (Capabilities)
AC-4	Information Flow Enforcement	L3 (Taint Tracking)
AC-6	Least Privilege	L1 (Zero-Trust)
Audit & Accountability (AU)
AU-2	Event Logging	L4 (State Machine)

TABLE VII: NIST 800-53 Rev 5 Control Mapping to CivicShield

Layer	Raw FPR	Action	Effective FPR
L1: Zero-Trust	$\sim$ 0%	Block	$\sim$ 0%
L2: Perimeter	0.5%	Block	0.5%
L3: Semantic FW	3.5%	Flag	1.05%
L4: State Machine	1.0%	Flag	0.30%
L5: Anomaly Det.	2.5%	Flag	0.75%
L6: Consensus	0.5%	Escalate	0.04%

TABLE VIII: False Positive Rate Analysis by Layer

$\gamma$	Eff. FPR 3	Eff. FPR 4	Eff. FPR 5	Mitigated FPR
0.1	0.35%	0.10%	0.25%	$\sim$ 1.2%
0.2	0.70%	0.20%	0.50%	$\sim$ 1.9%
0.3	1.05%	0.30%	0.75%	$\sim$ 2.6%
0.4	1.40%	0.40%	1.00%	$\sim$ 3.3%
0.5	1.75%	0.50%	1.25%	$\sim$ 4.0%

TABLE IX: Sensitivity of Mitigated FPR to Flag-to-Block Conversion Rate

\gamma

System	Detection/	FPR	Source
	Refusal Rate
No defense (raw LLM)	0%	0%	Baseline
Llama Prompt Guard	15%	N/R	[ 22 ]
Llama Guard 3 (1B)	76%	N/R	[ 65 ]
LlamaFirewall	$>$ 90% red. †	N/R	[ 21 ]
TRYLOCK (4-layer)	94.4% ‡	N/R	[ 26 ]

TABLE X: Quantitative Comparison with Published Baselines

Attack Type	$n$	L2	L3	L4	L5	Comb.	95% CI
Direct Injection	40	52.5%	80.0%	—	27.5%	90.0%	[77–96%]
Crescendo	40	0.0%	75.0%	100.0%	97.5%	100.0%	[91–100%]
Slow Drift	30	0.0%	80.0%	100.0%	100.0%	100.0%	[89–100%]
Hybrid	20	60.0%	70.0%	80.0%	70.0%	90.0%	[70–97%]
Encoding-Based	20	45.0%	85.0%	—	35.0%	90.0%	[70–97%]
HarmBench (real)	416	0.0%	70.9%	—	16.8%	71.2%	[67–75%]

TABLE XI: Per-Layer and Combined Detection Rates (v4, Real Benchmarks, with 95% Wilson CI)

	L2	L3	L4	L5	Raw FPR	Eff. FPR
Multi-turn ( $n=150$ )	0.0%	3.3%	0.7%	10.7%	14.0%	14.0%
Edge-case ( $n=20$ )	0.0%	5.0%	0.0%	0.0%	5.0%	0.0%
JBB Benign ( $n=100$ )	0.0%	17.0%	0.0%	0.0%	17.0%	0.0%
XSTest ( $n=450$ )	0.0%	13.3%	0.0%	0.0%	13.3%	0.0%
Overall ( $n=720$ )	0.0%	11.5%	0.1%	2.2%	13.8%	2.9%
95% CI					[11.4–16.5%]	[1.9–4.4%]

TABLE XII: False Positive Rates (Benign,

n=720

, with 95% Wilson CI)

Attack Type	Avg Det.	Avg Total	Det.
	Turn	Turns	Ratio
Crescendo	4.8	11.6	41.1%
Slow Drift	11.7	20.6	56.7%
Hybrid	4.2	6.4	66.0%

TABLE XIII: Multi-Turn Attack Detection Timing

Category	$n$	PASS	FLAG	BLOCK
Direct Injection	40	10.0%	30.0%	60.0%
Crescendo	40	0.0%	0.0%	100.0%
Slow Drift	30	0.0%	0.0%	100.0%
Hybrid	20	10.0%	0.0%	90.0%
Encoding-Based	20	10.0%	15.0%	75.0%
HarmBench (real)	416	28.8%	54.3%	16.8%

TABLE XIV: Three-Tier Graduated Response Breakdown by Category

Layer	Required Service Components
L1: Zero-Trust	Identity and access management (IAM) service; cryptographic key management service (KMS); session management service with isolated execution contexts
L2: Perimeter	Web application firewall (WAF); input preprocessing pipeline with Unicode normalization and encoding detection
L3: Semantic FW	Embedding service for semantic analysis; intent classification service; topic boundary engine with configurable domain policies
L4: State Machine	Conversation state store (any persistent key-value or document store with sub-millisecond reads); rule engine for safety invariant evaluation
L5: Behavioral	ML model serving infrastructure for anomaly detection; pattern database for attack signatures; feedback loop for adaptive learning
L6: Consensus	Multi-model inference gateway (any service capable of routing to multiple LLM providers); response comparison engine with semantic similarity scoring

TABLE XV: Platform-Agnostic Component Mapping

Layer	Multiplier $\alpha_{i}$	Rationale
L1: Zero-Trust	$\sim$ 1.0 $\times$	Token validation, crypto ops
L2: Perimeter	$\sim$ 1.0 $\times$	Regex/pattern matching
L3: Semantic FW	$\sim$ 1.2 $\times$	Embedding computation
L4: State Machine	$\sim$ 1.05 $\times$	State lookup and update
L5: Behavioral	$\sim$ 1.3 $\times$	Anomaly detection inference
L6: Consensus	$\sim$ 3–5 $\times$	Multiple model calls

TABLE XVI: Per-Query Cost Multipliers by Defense Layer

Scale	Defense	Break-even	Break-even
(qry/mo)	cost/mo	@$10K/inc.	@$100K/inc.
$10^{4}$	$110–550	1 inc./18–91 mo	1 inc./182–909 mo
$10^{5}$	$1.1K–5.5K	1 inc./2–9 mo	1 inc./18–91 mo
$10^{6}$	$11K–55K	1 inc./mo	1 inc./2–9 mo

TABLE XVII: Break-Even Analysis by Deployment Scale

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Aug 16, 2026

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails. Existing defenses lack the reasoning capacity to identify evolving manipulation patterns, often trading helpfulness for safety by over-refusing benign requests related to sensitive topics. We introduce Trace, a multi-turn defense with trajectory-aware structured reasoning. Before generating each response, the model identifies manipulation cues from the trajectory, evaluates both the benign and adversarial interpretations of user intent, assigns a jailbreak score, and commits to an action: Allow, Caution, or Decline. We curate 4k multi-turn adversarial conversations from five attack frameworks, pair them with 2.4k benign dialogs, and 600 sensitive-but-benign conversations. We train Llama-3.1-8B-Instruct with SFT and GRPO under a multi-component reward that jointly optimizes helpfulness on benign prompts and robustness against jailbreak attempts. Across seven multi-turn attack benchmarks, Trace attains an average attack success rate (ASR) of 14.5% against 31.4% for the strongest baseline and 74.9% for the undefended target, while significantly raising the attacker effort required per successful jailbreak. Trace also balances usability and safety, achieving a 93.3% average compliance on over-refusal benchmarks.

Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu +1

Texas A&M University · Amazon

Adversarial Training LLM Jailbreak Attacks Multi-Turn Dialogue Evaluation LLM Safety Evaluation Jailbreak Defense

Ask PDF

May 30, 2026

MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety

Patient-facing medical chatbots are commonly evaluated on single-turn prompts, yet real users push back after refusals, add urgency, and invoke authority. We introduce MultiTurnPSB, a four-turn adversarial extension of PatientSafetyBench, and evaluate GPT-4.1-mini under fixed template, template-adaptive, and live adversarial attacks. Unsafe responses rise from 35% to nearly 80% by Turn 4 under live attack. Under the same adversary, GPT-4.1-mini and Claude Sonnet 4.5 are statistically indistinguishable at baseline but diverge to a 19x gap by Turn 4, a difference invisible to single-turn evaluation. We characterize four degradation trajectory signatures and identify a two-element attack formula responsible for most catastrophic failures. A lightweight input-side classifier reduces Turn 4 unsafe responses by 52 percentage points despite severe accuracy degradation, but the 45% false alarm rate on benign queries is the primary deployment constraint. A methodological finding also emerges: Claude Sonnet refused to generate adversarial messages in over half of late-turn conversations despite explicit red team framing, suggesting safety training may generalize to the attacker role.

Anushka Sheoran, Yiduo Hao

University of Pennsylvania

Language Model Safety Evaluation Adversarial Attacks on LLMs Multi-Turn Jailbreak Attacks

Ask PDF

Jun 1, 2026

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models

Multi-turn jailbreak attacks pose a growing threat to LLMs by exploiting conversational dynamics such as gradual escalation and cross-turn coordination. Existing defenses either rely on costly retraining -- often degrading model utility -- or apply single-turn analysis independently at each turn, failing to capture how risk accumulates along interaction trajectories. We observe that safety behavior in multi-turn interaction is trajectory-dependent: dialogue history continuously reshapes the model's conditioning context, making it insufficient to evaluate each turn in isolation. Motivated by this insight, we present THRD, the first training-free framework that explicitly models temporal risk accumulation for multi-turn jailbreak defense. THRD integrates four modules: a Turn-level Risk Assessor (TRA) for instantaneous risk estimation, a Historical Context Analyzer (HCA) for cross-turn intent escalation detection, a Response Evaluator (RE) for identifying facilitative outputs, and a Decision Module that combines these signals through a time-evolving scoring mechanism with attenuation-based modulation and trend-aware adjustment. Experiments against state-of-the-art multi-turn attacks -- including tree-search-based and multi-agent collaborative methods -- across two target models show that THRD reduces ASR to 0.2--4.0% while preserving model utility within 1.5% degradation on MMLU and GSM8K. Ablation studies confirm non-redundant module contributions and stable cross-architecture generalization. Analysis of first rejection triggers reveals that over 70% of multi-turn attacks require Turn~2 or later to detect, validating the necessity of explicit temporal aggregation.

Zhiqing Ma, Zhonghao Xu, Dong Yu +3

1Beijing Language and Culture University · †Corresponding authors

LLM Safety Multi-Turn Jailbreak Attacks Jailbreak Defense

Ask PDF

Abstract

LLM Security

Explore similar work

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models