A new AI safety model does not just flag a risky chatbot conversation - it points to the specific turn and words that pushed it there.
Researchers built a multi-turn dataset of 1,762 conversations, mixing adversarial exchanges, "benign twin" conversations that look similar but aren't harmful, and benign chats stuffed with high-risk vocabulary. They trained a lightweight hierarchical model to both flag unsafe conversations and attribute the violation to specific user turns and token spans. The model hit an F1 score of 0.988 on detection, and stripping out just the top 15% of flagged tokens cut its confidence that a conversation was adversarial by 51.1%. Independent human reviewers largely agreed with the model's picks: its top five attributed turns included a human-identified evidence turn in 84.5% of adversarial cases.
The real story is what this fixes: keyword-based filters. A simple keyword baseline threw false positives on 37.3% of borderline-benign chats and a startling 94.7% of benign chats that just happened to use high-risk vocabulary - think security researchers discussing malware, or nurses discussing overdoses. This new model kept both false-positive rates under 1%, which matters more than the headline detection score to anyone who has had a legitimate conversation blocked by an overzealous filter.
It is still a research paper, not a feature sitting in front of a chatbot today. But as AI systems get pushed into agentic roles where a slow-drip manipulation can trigger a real-world action, turn-level attribution - not just a yes-or-no safety verdict - looks like the direction guardrails need to go.