CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks

KrishnaSaiReddy Patil

cs.CRMar 30, 2026

CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks

Authors: KrishnaSaiReddy Patil

Abstract

LLM-based chatbots in government services face critical security gaps. Multi-turn adversarial attacks achieve over 90% success against current defenses, and single-layer guardrails are bypassed with similar rates. We present CivicShield, a cross-domain defense-in-depth framework for government-facing AI chatbots. Drawing on network security, formal verification, biological immune systems, aviation safety, and zero-trust cryptography, CivicShield introduces seven defense layers: (1) zero-trust foundation with capability-based access control, (2) perimeter input validation, (3) semantic firewall with intent classification, (4) conversation state machine with safety invariants, (5) behavioral anomaly detection, (6) multi-model consensus verification, and (7) graduated human-in-the-loop escalation. We present a formal threat model covering 8 multi-turn attack families, map the framework to NIST SP 800-53 controls across 14 families, and evaluate using ablation analysis. Theoretical analysis shows layered defenses reduce attack probability by 1-2 orders of magnitude versus single-layer approaches. Simulation against 1,436 scenarios including HarmBench (416), JailbreakBench (200), and XSTest (450) achieves 72.9% combined detection [69.5-76.0% CI] with 2.9% effective false positive rate after graduated response, while maintaining 100% detection of multi-turn crescendo and slow-drift attacks. The honest drop on real benchmarks versus author-generated scenarios (71.2% vs 76.7% on HarmBench, 47.0% vs 70.0% on JailbreakBench) validates independent evaluation importance. CivicShield addresses an open gap at the intersection of AI safety, government compliance, and practical deployment.

Figures & tables

Attack Framework	ASR	Target
HarmNet [ 3 ]	99.4%	Mistral-7B
HarmNet [ 3 ]	94.8%	GPT-4o
X-Teaming [ 4 ]	98.1%	Multiple
AutoAdv [ 14 ]	95.0%	Llama-3.1-8B
Crescendo [ 13 ]	29–61% $\uparrow$	GPT-4
Siren [ 15 ]	90.0%	Gemini-1.5-Pro

TABLE I: Multi-Turn Attack Success Rates (2024–2026)

Defense	Claimed ASR	Adaptive ASR
12 diverse defenses [ 2 ]	Near-zero	$>$ 90%
Constitutional Classifiers [ 20 ]	N/A	4.4%
6 popular guardrails [ 22 ]	Varies	Up to 100%
8 agent defenses [ 49 ]	Varies	$>$ 50%
TRYLOCK (layered) [ 26 ]	46.5%	5.6%

TABLE II: Defense Mechanisms and Documented Bypass Rates

Dimension	CivicShield	Bedrock Guardrails	Azure AI + Prompt Shields	NeMo Guardrails	LlamaFirewall	Rebuff	Lakera Guard	TRYLOCK
Multi-turn attack detection	◆	Partial a ★	Partial b ★	Partial c ★	Partial d ★	No	No	No
Cross-turn state tracking	◆	No	No	Yes e ★	No	No	No	No
Formal safety invariants	◆	Partial f ★	No	No	No	No	No	No
Behavioral anomaly detection	❍	No	No	No	Partial g ★	Partial h ★	Yes i ★	Partial j ★
Multi-model consensus	❍	No	No	No	No	No	No	No
Human escalation integration	❍	No	No	No	No	No	No	No

TABLE III: Structured Comparison of LLM Security Platforms Across Key Defense Dimensions

Panel of Figure 4 — Fig. 1: CivicShield seven-layer defense-in-depth architecture. Each layer draws from a distinct field (shown in italics), ensuring cross-domain diversity.

Family	Structure	Surface
Direct Injection	Single-turn	User input
Policy Puppetry	Single-turn	User input
Crescendo	Multi-turn	User input
Semantic Traversal	Multi-turn	User input
Context Poisoning	Multi-turn	RAG/indirect
Tool-Chain	Multi-turn	Tool calls

TABLE IV: CivicShield Attack Taxonomy

Attack	L1	L2	L3	L4	L5	L6	L7
Direct Injection	✓	✓	✓
Policy Puppetry		✓	✓		✓	✓
Crescendo			✓	✓	✓		✓
Semantic Traversal			✓	✓	✓	✓
Context Poisoning	✓		✓	✓		✓
Tool-Chain	✓			✓		✓	✓

TABLE V: Layer Coverage by Attack Family

Correlation ( $\rho$ )	Combined ASR	Interpretation
0.0 (independent)	0.045%	Idealized best case
0.3 (low correlation)	0.8%	Optimistic realistic
0.5 (moderate)	3.5%	Conservative realistic
0.7 (high correlation)	8.2%	Pessimistic realistic

TABLE VI: Sensitivity of Combined ASR to Layer Correlation

Control	Description	Layer
Access Control (AC)
AC-3	Access Enforcement	L1 (Capabilities)
AC-4	Information Flow Enforcement	L3 (Taint Tracking)
AC-6	Least Privilege	L1 (Zero-Trust)
Audit & Accountability (AU)
AU-2	Event Logging	L4 (State Machine)

TABLE VII: NIST 800-53 Rev 5 Control Mapping to CivicShield

Layer	Raw FPR	Action	Effective FPR
L1: Zero-Trust	$\sim$ 0%	Block	$\sim$ 0%
L2: Perimeter	0.5%	Block	0.5%
L3: Semantic FW	3.5%	Flag	1.05%
L4: State Machine	1.0%	Flag	0.30%
L5: Anomaly Det.	2.5%	Flag	0.75%
L6: Consensus	0.5%	Escalate	0.04%

TABLE VIII: False Positive Rate Analysis by Layer

$\gamma$	Eff. FPR 3	Eff. FPR 4	Eff. FPR 5	Mitigated FPR
0.1	0.35%	0.10%	0.25%	$\sim$ 1.2%
0.2	0.70%	0.20%	0.50%	$\sim$ 1.9%
0.3	1.05%	0.30%	0.75%	$\sim$ 2.6%
0.4	1.40%	0.40%	1.00%	$\sim$ 3.3%
0.5	1.75%	0.50%	1.25%	$\sim$ 4.0%

TABLE IX: Sensitivity of Mitigated FPR to Flag-to-Block Conversion Rate

\gamma

System	Detection/	FPR	Source
	Refusal Rate
No defense (raw LLM)	0%	0%	Baseline
Llama Prompt Guard	15%	N/R	[ 22 ]
Llama Guard 3 (1B)	76%	N/R	[ 65 ]
LlamaFirewall	$>$ 90% red. †	N/R	[ 21 ]
TRYLOCK (4-layer)	94.4% ‡	N/R	[ 26 ]

TABLE X: Quantitative Comparison with Published Baselines

Attack Type	$n$	L2	L3	L4	L5	Comb.	95% CI
Direct Injection	40	52.5%	80.0%	—	27.5%	90.0%	[77–96%]
Crescendo	40	0.0%	75.0%	100.0%	97.5%	100.0%	[91–100%]
Slow Drift	30	0.0%	80.0%	100.0%	100.0%	100.0%	[89–100%]
Hybrid	20	60.0%	70.0%	80.0%	70.0%	90.0%	[70–97%]
Encoding-Based	20	45.0%	85.0%	—	35.0%	90.0%	[70–97%]
HarmBench (real)	416	0.0%	70.9%	—	16.8%	71.2%	[67–75%]

TABLE XI: Per-Layer and Combined Detection Rates (v4, Real Benchmarks, with 95% Wilson CI)

	L2	L3	L4	L5	Raw FPR	Eff. FPR
Multi-turn ( $n=150$ )	0.0%	3.3%	0.7%	10.7%	14.0%	14.0%
Edge-case ( $n=20$ )	0.0%	5.0%	0.0%	0.0%	5.0%	0.0%
JBB Benign ( $n=100$ )	0.0%	17.0%	0.0%	0.0%	17.0%	0.0%
XSTest ( $n=450$ )	0.0%	13.3%	0.0%	0.0%	13.3%	0.0%
Overall ( $n=720$ )	0.0%	11.5%	0.1%	2.2%	13.8%	2.9%
95% CI					[11.4–16.5%]	[1.9–4.4%]

TABLE XII: False Positive Rates (Benign,

n=720

, with 95% Wilson CI)

Attack Type	Avg Det.	Avg Total	Det.
	Turn	Turns	Ratio
Crescendo	4.8	11.6	41.1%
Slow Drift	11.7	20.6	56.7%
Hybrid	4.2	6.4	66.0%

TABLE XIII: Multi-Turn Attack Detection Timing

Category	$n$	PASS	FLAG	BLOCK
Direct Injection	40	10.0%	30.0%	60.0%
Crescendo	40	0.0%	0.0%	100.0%
Slow Drift	30	0.0%	0.0%	100.0%
Hybrid	20	10.0%	0.0%	90.0%
Encoding-Based	20	10.0%	15.0%	75.0%
HarmBench (real)	416	28.8%	54.3%	16.8%

TABLE XIV: Three-Tier Graduated Response Breakdown by Category

Layer	Required Service Components
L1: Zero-Trust	Identity and access management (IAM) service; cryptographic key management service (KMS); session management service with isolated execution contexts
L2: Perimeter	Web application firewall (WAF); input preprocessing pipeline with Unicode normalization and encoding detection
L3: Semantic FW	Embedding service for semantic analysis; intent classification service; topic boundary engine with configurable domain policies
L4: State Machine	Conversation state store (any persistent key-value or document store with sub-millisecond reads); rule engine for safety invariant evaluation
L5: Behavioral	ML model serving infrastructure for anomaly detection; pattern database for attack signatures; feedback loop for adaptive learning
L6: Consensus	Multi-model inference gateway (any service capable of routing to multiple LLM providers); response comparison engine with semantic similarity scoring

TABLE XV: Platform-Agnostic Component Mapping

Layer	Multiplier $\alpha_{i}$	Rationale
L1: Zero-Trust	$\sim$ 1.0 $\times$	Token validation, crypto ops
L2: Perimeter	$\sim$ 1.0 $\times$	Regex/pattern matching
L3: Semantic FW	$\sim$ 1.2 $\times$	Embedding computation
L4: State Machine	$\sim$ 1.05 $\times$	State lookup and update
L5: Behavioral	$\sim$ 1.3 $\times$	Anomaly detection inference
L6: Consensus	$\sim$ 3–5 $\times$	Multiple model calls

TABLE XVI: Per-Query Cost Multipliers by Defense Layer

Scale	Defense	Break-even	Break-even
(qry/mo)	cost/mo	@$10K/inc.	@$100K/inc.
$10^{4}$	$110–550	1 inc./18–91 mo	1 inc./182–909 mo
$10^{5}$	$1.1K–5.5K	1 inc./2–9 mo	1 inc./18–91 mo
$10^{6}$	$11K–55K	1 inc./mo	1 inc./2–9 mo

TABLE XVII: Break-Even Analysis by Deployment Scale

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation
Aug 16, 2026Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu +1Adversarial Training LLM Jailbreak Attacks
Texas A&M University · Amazon
MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety
May 30, 2026Anushka Sheoran, Yiduo HaoLanguage Model Safety Evaluation Adversarial Attacks on LLMs
University of Pennsylvania
THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models
Jun 1, 2026Zhiqing Ma, Zhonghao Xu, Dong Yu +3LLM Safety Multi-Turn Jailbreak Attacks
1Beijing Language and Culture University · †Corresponding authors

Aug 16, 2026J/K move · Enter open · S save

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu, Ruihong Huang

Texas A&M University · Amazon

Adversarial Training LLM Jailbreak Attacks Multi-Turn Dialogue Evaluation LLM Safety Evaluation Jailbreak Defense

Open paper AskPDF arXiv

Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails. Existing defenses lack the reasoning capacity to identify evolving manipulation patterns, often trading helpfulness for safety by over-refusing benign requests related to sensitive topics. We introduce Trace, a multi-turn defense with trajectory-aware structured reasoning. Before generating each response, the model identifies manipulation cues from the trajectory, evaluates both the benign and adversarial interpretations of user intent, assigns a jailbreak score, and commits to an action: Allow, Caution, or Decline. We curate 4k multi-turn adversarial conversations from five attack frameworks, pair them with 2.4k benign dialogs, and 600 sensitive-but-benign conversations. We train Llama-3.1-8B-Instruct with SFT and GRPO under a multi-component reward that jointly optimizes helpfulness on benign prompts and robustness against jailbreak attempts. Across seven multi-turn attack benchmarks, Trace attains an average attack success rate (ASR) of 14.5% against 31.4% for the strongest baseline and 74.9% for the undefended target, while significantly raising the attacker effort required per successful jailbreak. Trace also balances usability and safety, achieving a 93.3% average compliance on over-refusal benchmarks.

Abstract

LLM Security

Explore similar work

TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety

THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models