Problem: In multi-turn conversations, attackers hide harmful intent across innocent-looking messages, bypassing safety training that only works on single turns. Safety behavior is shallow, confined to the first few tokens, so once a reply starts harmlessly, the model becomes unsafe.
What was done: The authors propose Assess→Decide→Respond. Before replying, the model commits to an explicit safety label (refuse/comply) then generates a response conditioned on that label. They train this with reinforcement learning using a self-verified reward: compare the committed label to the conversation's known nature, no judge needed.
Main finding: Across two model families and fourteen benchmarks, this method achieved the strongest multi-turn safety while preserving utility and only slightly reducing helpfulness. It turns shallowness from a weakness into a defense, offering a scalable, annotation-free approach to conversation safety.