MAPID / contribution 1 / multi-turn defense

Evidence, turn by turn

The aggregator is a naive-Bayes log-odds accumulator. Each detector contributes a likelihood ratio per turn, the ratios multiply, and a session is gated when the running posterior crosses threshold. Build a session below and watch the evidence accumulate.

odds(adv | h_t) = Λ_intent · Λ_authority · Λ_fragment · Λ_judge · odds(adv | h_t-1)
→ in logs: log-odds_t = log-odds_t-1 + Σ log Λ multiplication becomes addition, so evidence stacks
Λ = P(signal | adversarial) / P(signal | benign) Laplace +1/+2 smoothed, so no cell is 0 or ∞

Build a session

Click the cells to fire detectors

Preset

Intent primitive

Operating point

Detector

Turn 1

Turn 2

Turn 3

Turn 4

Λ fired

intent authority escalation instruction fragmentation LLM-judge fragmentation threshold

Why the swap mattered

The same benign session, two primitives

Select Real benign user above, then toggle the intent primitive. The retired single-centroid detector fires on a genuinely benign opening because it measures distance from a narrow calibration set, not attack-likeness. One fire at Λ = 126.82 is worth 4.84 log-units, which is enough on its own to carry the session past threshold from the headline prior. The deployed classifier contributes Λ = 6.76 on real benign traffic instead, and the session survives.

Detector	Λ when fired	log Λ	Λ when not fired	Status
Intent, single centroid	126.82	+4.84	0.30	retired
Intent, discriminative	112 to 978 on attacks	+4.7 to +6.9	6.76 on real benign	deployed
LLM-judge fragmentation	86.49	+4.46	0.53	deployed
Authority escalation	35.68	+3.57	0.81	deployed
Instruction fragmentation	14.74	+2.69	0.93	deployed
Topic drift	0.97	-0.03	1.06	retired, no signal

Fired ratios and the topic-drift, authority and fragmentation not-fired ratios are the calibrated values from the thesis. Not-fired ratios for the intent and LLM-judge slots are not tabulated there; the values used here are consistent with the reported single-fire posterior of about 0.85 from the headline prior.

Prepared answers

Where the model is wrong on purpose

Conditional independence does not hold

Multiplying the four ratios assumes the detectors are independent given the session class. They are not. The three-detector ablation dropped authority-escalation catch from 1.000 to 0.000, which means the dedicated authority regex fired on none of the 25 authority-escalation sessions and the intent slot was carrying that pattern by itself. Correlated detectors double-count evidence, so the posterior is overconfident in exactly the cases where two detectors respond to the same underlying cue.

The defense is that the ratios are measured, not assumed

Each Λ is estimated empirically on the deployed signal distribution rather than derived from a model of the detectors, so some correlation is absorbed into the estimates. A learned fusion layer would model it properly and would also stop being auditable: with a product of ratios, any flagged session can be decomposed after the fact into which signal moved it across the line, and the run manifest records exactly that.

The prior and threshold were selected on the benchmark they are evaluated on

The headline operating point of 0.10 and 0.3 was chosen because it exercises every detector path. Production at 0.01 and 0.7 leaves the layer inert: it needs 5.4 log-units of evidence across a three to four turn budget, and uncalibrated ratios supply about 4.1. Switch the operating point above to see the same session change verdict.