Elamur Research⌕
☰
home / papers / 2026 / Cognitive Analysis Graph-Guided Multi-Turn Safety Enhancement for Large Language Models

Cognitive Analysis Graph-Guided Multi-Turn Safety Enhancement for Large Language Models

Paper · 2026 · Lanxue Zhang, Yuqiang Xie, Fang Fang et al.

Summary

Inference-time safety methods for LLMs often fail in multi-turn chats. They judge a question or answer on its own, apply the same defense instructions to every prompt, and ignore earlier turns. As a result, a request that looks harmless alone can become dangerous in context. The authors propose CogGSE, a training-free framework that guides generation with a structured "cognitive analysis graph." Its design draws on Cognitive Task Analysis and the Dual-Process Model of Moral Judgment. A strong LLM first produces a pool of candidate nodes of four kinds: semantic intent, sub-tasks, causal consequences with the emotions they evoke, and ethical checks. For each query, a tailored graph is retrieved from this pool and serves as a thinking draft. In later turns, graphs from earlier turns are retrieved by embedding similarity and pruned to their safety-relevant nodes. These are then merged with the current graph. Across several LLMs, safety improves by roughly 30% on average, including under jailbreak and multi-turn attacks, with no extra decoding cost. The approach makes safety reasoning more transparent and controllable without fine-tuning.

Key points

  • The graph has four node types, linked by directed edges and built step by step from a semantic root node: semantic parsing (S), task decomposition (D), causal inference (C, including emotion estimation) and ethical check (E).
  • The main variant is CogGSE RAG, chosen as a balance of effectiveness and efficiency. Code is released at github.com/Qlanxue/CogGSE.
  • Evaluation covers settings such as Strong Reject, Wild Jailbreak, Actor Attack (multi-turn) and MoralBench. The reported average safety gain is about 30% across LLMs.
  • Ablations show that semantic-intent nodes matter in every scenario and ethical nodes matter most against jailbreaks. Dropping emotion estimation causes only a small loss, while removing the history graph G_h hurts multi-turn safety the most.
  • On Qwen3-8B, CogGSE has the lowest latency, with a relative cost factor of x0.55 versus x0.60 for the NoThink setting. Limitations include dependence on retrieval and on the quality of the underlying LLM, and possible error propagation in precise-reasoning tasks such as math.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏛️Chinese Academy of SciencesBeijing · China246 works · 24,951 citations🎓University of Chinese Academy of SciencesBeijing · China188 works · 8,743 citations🔬Institute of Information EngineeringBeijing · China41 works · 1,485 citations

 Fields, topics and concepts

📚 Shelves 6The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 worksSocial Sciences · 1,954 worksSafety Research · 626 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksBias, fairness & safety · 587 works

Cite

Cite as Lanxue Zhang, Yuqiang Xie, Fang Fang, Yubing Ren, Xuebin Wang and Yanan Cao. 2026. Cognitive Analysis Graph-Guided Multi-Turn Safety Enhancement for Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1558

@inproceedings{zhang2026cognitive,
  title = {{Cognitive Analysis Graph-Guided Multi-Turn Safety Enhancement for Large Language Models}},
  author = {Lanxue Zhang, Yuqiang Xie, Fang Fang, Yubing Ren, Xuebin Wang and Yanan Cao},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1558},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1558}
}

References

43 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2025. Introducing claude sonnet 4.5. https://www.anthropic.com/news/ claude-sonnet-4-5. Online article. ↗
  2. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, Scott Johnston, Sh… find
  3. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, Jamie Kerr, Jared… — Constitutional AI: Harmlessness from AI Feedback
  4. Somnath Banerjee, Sayan Layek, Soham Tripathy, Shanu Kumar, Animesh Mukherjee, and Rima Hazra. 2025. Safeinfer: context adaptive decoding time safety alignment for large language models. In Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence and Thirty-Seventh Conference on In… find
  5. Richard E Clark, David F Feldon, Jeroen JG Van Merrienboer, Kenneth A Yates, and Sean Early. 2008. Cognitive task analysis. In Handbook of research on educational communications and technology, pages 577–593. Routledge. find
  6. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168.
  7. Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. 2024. Safe RLHF: Safe reinforcement learning from human feedback. In The Twelfth International Conference on Learning Representations.
  8. DeepSeek-AI. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.
  9. Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. Attacks, defenses and evaluations for LLM conversation safety: A survey. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: L… find
  10. Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. 2024. MART: Improving LLM safety with multi-round automatic red-teaming. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human L…
  11. Joshua D Greene, R Brian Sommerville, Leigh E Nystrom, John M Darley, and Jonathan D Cohen. 2001. An fmri investigation of emotional engagement in moral judgment. Science, 293(5537):2105–2108. find
  12. Weiyang Guo, Jing Li, Wenya Wang, Yu Li, Daojing He, Jun Yu, and Min Zhang. 2025. MTSA: Multi-turn safety alignment for LLMs through multi-round red-teaming. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 26424–26442, Vienna,…
  13. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations.
  14. Wonje Jeung, Sangyeon Yoon, Minsuk Kahng, and Albert No. 2025. SAFEPATH: Preventing harmful reasoning in chain-of-thought via early alignment. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. find
  15. Jianchao Ji, Yutong Chen, Mingyu Jin, Wujiang Xu, Wenyue Hua, and Yongfeng Zhang. 2025. Moralbench: Moral evaluation of llms. SIGKDD Explor. Newsl., 27(1):62–71. find
  16. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. 2024. Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models.
  17. Yuhui Li, Fangyun Wei, Jinjing Zhao, Chao Zhang, and Hongyang Zhang. 2024. RAIN: Your language models can align themselves without finetuning. In The Twelfth International Conference on Learning Representations. find
  18. Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. 2024. Let’s verify step by step. In The Twelfth International Conference on Learning Representations.
  19. Quan Liu, Zhenhong Zhou, Longzhu He, Yi Liu, Wei Zhang, and Sen Su. 2024. Alignment-enhanced decoding: Defending jailbreaks via token-level adaptive refining of probability distributions. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 2802–2816, Miam… find
  20. Yang Liu, Yuanshun Yao, Jean-François Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hanguang Li. 2023. Trustworthy llms: a survey and guideline for evaluating large language models’ alignment. ArXiv, abs/2308.05374.
  21. OpenAI. 2025. Introducing gpt-5. find
  22. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 3419–3448, Abu…
  23. Deng Qiyuan, Xuefeng Bai, Kehai Chen, Yaowei Wang, Liqiang Nie, and Min Zhang. 2025. Efficient safety alignment of large language models via preference reranking and representation-based reward modeling. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volu… find
  24. Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence embeddings using Siamese BERT-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 3982–3992,…
  25. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2025. LLMs know their vulnerabilities: Uncover safety gaps through natural distribution shifts. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics…
  26. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational L…
  27. Feifan Song, Yuxuan Fan, Xin Zhang, Peiyi Wang, and Houfeng Wang. 2025. Instantly learning preference alignment via in-context DPO. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Lo… find
  28. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A strongreject for empty jailbreaks. find
  29. Gemini Team. 2025a. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities.
  30. Qwen Team. 2025b. Qwen3-max: Just scale it. find
  31. Qwen Team. 2025c. Qwen3 technical report. find
  32. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller,… — Llama 2: Open Foundation and Fine-Tuned Chat Models
  33. Haoyu Wang, Zeyu Qin, Li Shen, Xueqian Wang, Dacheng Tao, and Minhao Cheng. 2025a. Safety reasoning with guidelines. In Forty-second International Conference on Machine Learning. find
  34. Peiran Wang, Xiaogeng Liu, and Chaowei Xiao. 2025b. RePD: Defending jailbreak attack through a retrieval-based prompt decomposition process. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 283–294, Albuquerque, New Mexico. Association for Computational Linguistics. find
  35. Zijun Wang, Haoqin Tu, Yuhan Wang, Juncheng Wu, Yanqing Liu, Jieru Mei, Brian R. Bartoldson, Bhavya Kailkhura, and Cihang Xie. 2025c. Star-1: Safer alignment of reasoning llms with 1k data. find
  36. Zeming Wei, Yifei Wang, and Yisen Wang. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387.
  37. Shitao Xiao, Zheng Liu, Peitian Zhang, Niklas Muennighoff, Defu Lian, and Jian-Yun Nie. 2024. C-pack: Packed resources for general chinese embeddings. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR ’24, page 641–649, New York…
  38. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. SafeDecoding: Defending against jailbreak attacks via safety-aware decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 55…
  39. Lanxue Zhang, Yanan Cao, Yuqiang Xie, Fang Fang, and Yangxi Li. 2025a. Dynamic evaluation with cognitive reasoning for multi-turn safety of large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 19588– 19608, V… find
  40. Lanxue Zhang, Yuqiang Xie, Fang Fang, Fanglong Dong, Rui Liu, and Yanan Cao. 2025b. Metagdpo: Alleviating catastrophic forgetting with metacognitive knowledge through group direct preference optimization. find
  41. Yichi Zhang, Siyuan Zhang, Yao Huang, Zeyu Xia, Zhengwei Fang, Xiao Yang, Ranjie Duan, Dong Yan, Yinpeng Dong, and Jun Zhu. 2025c. STAIR: Improving safety alignment with introspective reasoning. In Forty-second International Conference on Machine Learning. find
  42. Zhehao Zhang, Weijie Xu, Fanyou Wu, and Chandan K. Reddy. 2025d. Falsereject: A resource for improving contextual safety and mitigating over-refusals in LLMs via structured reasoning. In Second Conference on Language Modeling. find
  43. Zhengyue Zhao, Xiaoyun Zhang, Kaidi Xu, Xing Hu, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. 2024. Adversarial contrastive decoding: Boosting safety alignment of large language models via opposite prompt optimization. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhang-2026-cognitive-analysis-graph-guided-multi/