Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

Jul 16, 2026

Large language models (LLMs) can be steered to produce harmful content through multi-turn strategies where no single user message is clearly unsafe. Existing runtime safeguards typically score prompts or responses in isolation, limiting recovery of accumulated intent, verification of claimed authority, and detection of harmful objectives decomposed across dialogue. The Cognitive Firewall introduces proactive runtime oversight with four categorical gates—intent, zero-trust context, consistency, and output risk—combined via escalation for auditable blocking. Experiments on jailbreak benchmarks show attack success drops to 2% or below on three sets and to 14% on a human-crafted set, while keeping an 8% refusal-rate.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages9

Reading Time23 min

Introduction

Motivation: Limits of per-message guardrails

Cognitive Firewall overview and approach

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety Michele Guida 1 , Ruslan Shikhhamzayev2 , Sindhuja Penchala2 , Stefano Iannucci 1 , Jiacheng Li2 , Shahram Rahimi2 , and Noorbakhsh Amiri Golilarz2 1Roma Tre University, Rome, Italy 2The University of Alabama, Tuscaloosa, AL, USA arXiv :2607 .0 1277v 1 [ cs .CR] 1 Jul 2026 Abstract—Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isolated messages, which limits their ability to recover accumulated intent, verify asserted authority, or detect harmful objectives decomposed across a dialogue. This paper presents the Cognitive Firewall, a proactive runtime oversight framework that interposes an independent oversight model between a user and a protected target model. The framework decomposes safety assessment into four categorical gates: an intent gate that identifies the operational objective of a request, a zero trust context gate that treats claimed roles and permissions as unverified evidence, a consistency gate that detects escalation and decomposition across turns, and an output risk gate that inspects candidate responses before release. Gate decisions are combined through escalation rather than score averaging, allowing any confident danger signal to block an interaction while preserving an auditable rationale. Experiments on four jailbreak benchmarks and a benign safety test set show that the Cognitive Firewall substantially reduces attack success across single turn, multi turn, authority based, and human crafted attacks. It lowers attack success to 2 percent or below on three attack sets and to 14 percent on the most difficult human crafted set, while maintaining an 8 percent over refusal rate. These results indicate that decomposed, conversation level oversight can improve proactive containment and auditability for LLM safety. Index Terms—AI safety, cognitive oversight, conversationlevel safety, intent recognition, jailbreak defense, large language models, multi-turn attacks, proactive moderation, zero-trust I. INTRODUCTION Contemporary LLM guardrails are predominantly formulated as harm classifiers [1]–[4] . They score each prompt and each response against a fixed catalogue of harms, then admit or refuse it in isolation. We argue that guarding a model is a comprehension problem, not a classification one, and that the classifier framing is why a patient adversary can still extract restricted content from a defended model. Harm need not appear in any single message. It can reside in the interaction as a whole, whether in the objective a user steers toward, inan authority the user asserts but does not hold, or in a goal assembled from individually innocuous parts. Deployed safety operates almost entirely at the level of the single message. Training-time alignment writes refusal into the weights [5], [6], yet adversarial prompting routinely circumvents it [7] . The runtime layer meant to compensate consists of moderation and guard models such as Llama Guard [1] and ShieldGemma [2], which score each prompt and response in isolation. Their central limitation is what they observe, not when they act, since input filters already run before generation. A per-message classifier carries no model of the user’s evolving objective, retains no memory of the conversational trajectory, and has no means of judging whether a claimed role or authority warrants belief. A mature class of attacks exploits this gap. Crescendo escalates from an innocuous opening and uses the model’sown replies as leverage [8], while ActorAttack splits a forbidden objective into a network of individually benign subquestions [9] . Human red-teamers routinely defeat defenses that withstand automated single-turn attacks [10], and harm that emerges only as a conversation unfolds has motivated

FAQs

为什么现有的运行时防护很难有效阻止多轮攻击？

因为多数防护把每条提示或每条回复当作独立单元进行评分，无法建模用户不断演化的目标、验证对方所宣称的权限，也难以识别对话中把危险目标分解后逐步拼装出来的情形。

Cognitive Firewall 的核心机制是什么？

它在用户与受保护目标模型之间插入一个独立的监督模型，并将安全评估拆分为四个门：意图门、零信任上下文门、一致性门与输出风险门；只要任一门判断交互存在危险，就通过升级策略阻断。

实验结果表明该框架能显著降低哪类攻击的成功率？

在四个越狱基准以及一个良性安全测试集上，框架能显著降低攻击成功率，特别是在单轮、多轮、基于权威以及人工构造的攻击中表现更好。

Jul 16, 2026

Upload by Lucas Martin