Implicit Minor Detection from Multi-Turn Dialogue in High-Risk AI Interactions: A Constrained Self-Evolving LLM Harness

Xiaohan Zhang; Ying Zhao; Ruilin Guo; Xuanyuan Yu; Kaibo Huang; Yukun Wei; Zhongliang Yang; Linna Zhou

cs.CLOct 28, 2026

Implicit Minor Detection from Multi-Turn Dialogue in High-Risk AI Interactions: A Constrained Self-Evolving LLM Harness

Authors: Xiaohan Zhang, Ying Zhao, Ruilin Guo, Xuanyuan Yu, Kaibo Huang, Yukun Wei, Zhongliang Yang, Linna Zhou

Organizations: Beijing University of Posts and Telecommunications

Abstract

In high-risk text interactions, a system may need to estimate whether the current speaker is likely to be a minor before applying age-conditioned safeguards. Many text-based dialogue systems lack strong identity signals such as account information, verified identity, facial data, or device data, and must rely on weak cues that emerge across multiple turns. We formulate implicit minor detection under weak identity information as a high-risk user-attribute inference task and propose a constrained framework comprising a large language model, a Harness, and a Maker-Checker protocol. The framework controls when inference is invoked, requires structured dialogue-linked evidence, and subjects validation-selected Harness revisions to version-level review. On a controlled Chinese benchmark comprising 8,328 multi-turn dialogues, our method improves average precision and minor-class F1 by 7.60 and 6.37 percentage points, respectively, over direct inference using the same LLM family.

Figures & tables

Figure 1: Adjacent approaches leave a weak-identity gap. Platform age assurance depends on strong identity signals; static single-turn profiling loses cross-turn and speaker-binding context; content-safety safeguards assess content risk rather than the speaker’s likely age.

Figure 2: Overview of the constrained implicit-minor-detection framework. Runtime inference separates trigger routing, contextual support, structured evidence, and source-constrained decisions. During development, validation errors and recent candidate outcomes guide restricted Harness revisions; the gate either promotes a candidate or retains the incumbent, and the selected version is accompanied by Maker–Checker review materials.

Method	AP $\uparrow$	Minor F1 $\uparrow$	Minor precision $\uparrow$	Minor recall $\uparrow$
Chinese-RoBERTa-wwm-ext	$0.8154\pm 0.0093$	$0.6544\pm 0.0179$	$0.6743\pm 0.0186$	$0.6359\pm 0.0222$
Gemini Direct	$0.8815\pm 0.0006$	$0.8561\pm 0.0010$	$0.8317\pm 0.0019$	$0.8820\pm 0.0007$
Aegis-Guard FT	$0.8424\pm 0.0045$	$0.6640\pm 0.0121$	$0.8963\pm 0.0200$	$0.5278\pm 0.0215$
Aegis-Guard FT + Harness	$0.8744\pm 0.0131$	$0.7851\pm 0.0178$	$0.8541\pm 0.0113$	$0.7271\pm 0.0331$
Ours	$\mathbf{0.9574\pm 0.0062}$	$\mathbf{0.9198\pm 0.0015}$	$\mathbf{0.9360\pm 0.0122}$	$\mathbf{0.9044\pm 0.0109}$

Table 1: Held-out main-task results on 1,665 dialogues over three runs. Values are mean

\pm

sample standard deviation.

Variant	Acc. $\uparrow$	AP $\uparrow$	F1 m $\uparrow$	Prec. m $\uparrow$	Rec. m $\uparrow$
Ours (selected Harness)	$\mathbf{0.9211\pm 0.0019}$	$\mathbf{0.9574\pm 0.0062}$	$\mathbf{0.9198\pm 0.0015}$	$0.9360\pm 0.0122$	$0.9044\pm 0.0109$
Ours (initial Harness)	$0.8975\pm 0.0050$	$0.9429\pm 0.0036$	$0.8971\pm 0.0048$	$0.9011\pm 0.0073$	$0.8932\pm 0.0036$
w/o contextual support	$0.8907\pm 0.0033$	$0.9246\pm 0.0065$	$0.8941\pm 0.0037$	$0.8672\pm 0.0011$	$\mathbf{0.9228\pm 0.0077}$
w/o evidence traceability	$0.9045\pm 0.0026$	$0.9434\pm 0.0028$	$0.9002\pm 0.0029$	$\mathbf{0.9434\pm 0.0015}$	$0.8607\pm 0.0042$

Table 2: Held-out main-task ablations over three runs. Values are mean

\pm

sample standard deviation.

Description	Prec.	Rec.	F1
Initial	$0.831\pm 0.012$	$0.715\pm 0.042$	$0.768\pm 0.019$
Selected	$0.823\pm 0.031$	$\mathbf{0.861\pm 0.043}$	$\mathbf{0.841\pm 0.006}$

Table 3: Initial and development-selected trigger descriptions on the held-out trigger test split over three runs (mean

\pm

sample standard deviation).

Figure 3: Candidate minor-F1 change relative to the current incumbent for the two full-budget validation runs. Filled circles denote promoted candidates and crosses denote rejected candidates.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Evaluation surface	Total	Development	Held-out	Primary role
Main recognition benchmark	8,328	5,830 train + 833 validation	1,665 test	Speaker-level minor recognition
Trigger-Eval	480	288 development	192 test	Invocation-boundary evaluation
Human challenge set	40	—	40 shared items	Difficulty and disagreement reference

Appendix

Table S1: Evaluation surfaces used in the paper. Trigger-Eval and the human challenge set are separate from recognition training and retrieval.

Selected vs. Gemini Direct
Seed	$\Delta$ AP [95% CI]	$\Delta$ F1 m [95% CI]	McNemar $p$
42	$.0795\;[.0601,.0999]$	$.0644\;[.0460,.0841]$	$3.16\times 10^{-13}$
43	$.0686\;[.0491,.0891]$	$.0613\;[.0435,.0784]$	$2.97\times 10^{-12}$
44	$.0798\;[.0614,.0986]$	$.0655\;[.0475,.0823]$	$5.84\times 10^{-14}$
Selected vs. Initial Harness
42	$.0212\;[.0067,.0347]$	$.0279\;[.0115,.0436]$	$.000327$

Appendix

Table S2: Paired uncertainty for the main shared-model comparison and the initial-to-selected Harness comparison. Intervals are computed separately for each archived run on the shared 1,665-item test set.

Seed	Prop.	Prom.	Rej.	F1: initial $\to$ selected
42	10	5	5	$.9009\to.9455$
43	10	5	5	$.9067\to.9652$
44	5	1	4	$.9168\to.9483$
All	25	11	14	—

Appendix

Table S3: Summary of main-task validation evolution. Rejected candidates do not replace the incumbent.

Version	Decision	F1	Recall	Precision
v0	initial incumbent	.9009	.8197	1.0000
v1	promote	.9223	.8558	1.0000
v2	promote	.9280	.8678	.9972
v3	reject	.9223	.8558	1.0000
v4	promote	.9320	.8726	1.0000
v5	reject	.9223	.8558	1.0000

Appendix

Table S4: Main-task validation trajectory for seed 42. A rejected candidate leaves the incumbent unchanged.

Version	Decision	F1	Recall	Precision
v0	initial incumbent	.9067	.8293	1.0000
v1	promote	.9138	.8413	1.0000
v2	reject	.9055	.8293	.9971
v3	promote	.9294	.8702	.9972
v4	reject	.9110	.8365	1.0000
v5	reject	.9294	.8702	.9972

Appendix

Table S5: Main-task validation trajectory for seed 43. A rejected candidate leaves the incumbent unchanged.

Version	Decision	F1
v0	initial incumbent	.9168
v1	reject	.9156
v2	promote	.9483
v3	reject	.9430
v4	reject	.9388
v5	reject	.9430

Appendix

Table S6: Main-task validation trajectory for seed 44. The run stops after rounds 3–5 yield three consecutive non-promotions.

Seed	P/R	Initial F1	Selected F1	Recall	FTR
42	3/4	.7925	.8667	.9028	.1806
43	3/5	.8145	.8763	.8611	.1042
44	3/4	.7820	.8776	.8958	.1458

Appendix

Table S7: Trigger-description development trajectories. P/R denotes promoted/rejected proposals; FTR is the development false-trigger rate.

Individual metric	Mean	SD	95% CI
Accuracy	.7255	.1031	$[.6970,.7530]$
Minor F1	.7275	.1130	$[.6956,.7570]$

Appendix

Table S8: Distribution of individual participant performance over all 40 challenge items. Confidence intervals use respondent bootstrap resampling.

Stratum	Items	Human accuracy
Easy	10	.834
Hard	15	.657
Adversarial	10	.808
Boundary	5	.548

Appendix

Table S9: Mean item-level human accuracy by construction stratum.

Reference	Coverage	Accuracy	Minor F1
Mean individual	1.00	.7255	.7275
Strict majority	.95	.8684	.8571
Seed 42	1.00	.6000	.5556
Seed 43	1.00	.7750	.7568
Seed 44	1.00	.6500	.5882

Appendix

Table S10: Human and system references on the shared challenge set. Strict-majority metrics use the 38 non-tied items; all other rows use all 40 items.

Tie rule	Coverage	Accuracy	Minor F1
Abstain on 25–25	.95	.8684	.8571
Map both ties to adult	1.00	.8250	.8108
Map both ties to minor	1.00	.8750	.8718

Appendix

Table S11: Sensitivity of strict-majority results to the two unresolved items. The primary analysis uses abstention.

LLM Safety Monitoring

See all 56 papers

Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models
Sep 3, 2026Syed Ghazanfar Abbas, Dongyan XuLLM Security Language Model Auditing
Purdue University
Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Sep 16, 2026Alizishaan Khatri, Chiquita Prabhu, Omkar NeogiSafety Filtering LLM Safety
Wrynx Inc. · Independent Researcher
READER: Reasoning-Enhanced AI-Generated Text Detection
May 24, 2026Pingfan Su, Kai Ye, Shijin Gong +4AI-Generated Text Detection Large Language Model-Based Text Classification
Department of Statistics, London School of Economics and Political Science · School of Management, University of Science and Technology of China · School of Mathematics, University of Birmingham

Sep 3, 2026J/K move · Enter open · S save

Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models

Syed Ghazanfar Abbas, Dongyan Xu

Purdue University

LLM Security Language Model Auditing Language Model Self-Verification

Open paper AskPDF arXiv

Large language model (LLM) security has largely focused on role-playing jailbreaks, with less attention to what happens when a user asks an LLM to verify an identity claim through a test designed by the model itself. We study this behavior through a staged developer-identity experiment with ChatGPT, Claude, Qwen, Mistral, and Llama. All five models initially rejected the unsupported claim "I am your developer." Claude refused to conduct an identity test, while ChatGPT generated developer-oriented questions but maintained that answers could demonstrate knowledge, not identity. In contrast, Qwen and Mistral generated technical challenges, defined what counted as convincing evidence, evaluated detailed answers, and returned Verified without receiving any externally validated identity evidence. Llama similarly generated and evaluated a developer test, accepted the claimed identity, and subsequently made unsupported claims of access to internal runtime and deployment state. We call the model-generated verification procedure a Model-Issued Pseudo-Credential (MIPC) and the resulting unsupported identity judgment Conversational False Authentication (CFA). In each CFA case, the same model acted as challenge generator, evidence evaluator, and identity decision-maker, converting technical knowledge into supposed proof of identity. The accepted identities did not change the tested authorization boundaries, showing that false authentication and privilege escalation are distinct outcomes. These results identify self-issued authentication as a conversational security failure: authenticated identity must originate from an external security component, and model-generated dialogue must never create or modify identity or authorization state.

Abstract

LLM Safety Monitoring

Explore similar work

Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

READER: Reasoning-Enhanced AI-Generated Text Detection