Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

Yang Liu; Bin Chong; Wenkai Yang; Shuai Zhang; Yancheng Chen; Feiyu Han; GuoZhen; Cheng Zhang

cs.AIAug 21, 2026

Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

Authors: Yang Liu, Bin Chong, Wenkai Yang, Shuai Zhang, Yancheng Chen, Feiyu Han, GuoZhen, Cheng Zhang,

Organizations: Peking University · Renmin University of China · Tsinghua University · University of Chinese Academy of Sciences ·

Abstract

Large language models (LLMs) are vulnerable to multi-turn jailbreak attacks that progressively manipulate conversation context. Existing certified robustness methods are limited to single-turn inputs; naive multi-turn composition yields bounds that degrade exponentially in the number of turns. We introduce Multi-Turn Certified Robustness (MTCR), a framework that models conversational safety via State-Adversarial MDPs and defines $k$ -turn certified robustness as the worst-case safety probability across $k$ adversarial turns. MTCR comprises: (i) compositional certification via embedding-space mode decomposition, yielding tighter certified lower bounds than naive multiplication; (ii) $(α,β)$ -safety persistence, improving the degradation rate from $\underline{p}^{k}$ to $β^k$ (with $β> \underline{p}$ ) and yielding interpretable horizon estimates; (iii) matching information-theoretic upper bounds establishing tightness; and (iv) a unified algorithm combining these results. Experiments on six LLMs under $ε$ -bounded and Crescendo-style attacks confirm that empirical safety consistently exceeds the certified bounds.

Figures & tables

Model	$k$	Certification			Empirical Safety		Gap
Model	$k$	MTCR $\hat{\rho}_{k}$	Naive $\underline{p}^{\,k}$	Mult. ref.	Static	Crescendo	Gap
Open-source models
LLaMA-2-7B-Chat	5	0.36	0.29	0.59	66%	55%	+0.19
	10	0.13	0.08	0.35	49%	38%	+0.25
	15	0.05	0.02	0.21	38%	28%	+0.23
	20	0.02	0.01	0.12	30%	22%	+0.20

Table 1: Certification and empirical safety across six LLMs (

M{=}4

N{=}100

\epsilon{=}5

, 100 trials). MTCR

\hat{\rho}_{k}

: certified lower bound; Naive

\underline{p}^{\,k}

: valid but loose multiplicative bound; Mult. ref.

\bar{p}^{k}

: optimistic reference ( not a valid certified bound under adaptive adversaries); Gap

=

Emp. (Crescendo)

-

MTCR

\hat{\rho}_{k}

. Bold : best certified bound per horizon.

Panel of Figure 2 — Figure 2: Certified lower bound vs. horizon $k$ on LLaMA-2-7B-Chat ( $\bar{p}{=}0.90$ , $\underline{p}{=}0.78$ ; data from Table 1 ). The MTCR curve lies below empirical safety under both attack types at all horizons, confirming the certified bound is not violated.

$\epsilon$	MTCR $\hat{\rho}_{5}$	MTCR $\hat{\rho}_{10}$	Emp. 5 (Static)	Emp. 10 (Static)
3	0.49	0.19	75%	58%
5	0.36	0.13	66%	49%
7	0.24	0.07	55%	37%

Table 2: Perturbation budget

\epsilon

sensitivity (LLaMA-2-7B-Chat,

M{=}4

k{=}5,10

, 100 trials).

Method	$k{=}5$	$k{=}10$	$k{=}15$	$k{=}20$
Mult. ref. $\bar{p}^{k}$	0.59	0.35	0.21	0.12
Persistence-Only ( $\hat{\beta}^{k}$ )	0.31	0.10	0.03	0.01
Compositional-Only	0.34	0.11	0.04	0.01
Combined (Thm. 3.11 )	0.36	0.13	0.05	0.02
MTCR (max)	0.36	0.13	0.05	0.02

Table 3: MTCR component ablation (LLaMA-2-7B-Chat,

M{=}4

\epsilon{=}5

\hat{\beta}{=}0.79

, 100 trials). Mult. ref. is an optimistic reference (not certified). Bold : best certified bound per horizon. MTCR (max) takes the maximum over component bounds.

Detector	MTCR $\hat{\rho}_{5}$	Emp. (Static)	Emp. (Crescendo)
Keyword-based (default)	0.36	66%	55%
Neural classifier	0.33	70%	59%

Table 4: Safety detector comparison (LLaMA-2-7B-Chat,

k{=}5

\epsilon{=}5

, 100 trials).

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

	$k{=}5$	$k{=}10$	$k{=}20$	$k{=}50$
$\tau{=}1$	0.83	0.97	1.33	3.38
$\tau{=}3$	0.43	0.50	0.68	1.72
$\tau{=}5$	0.22	0.25	0.35	0.88

Appendix

Table 5: Compositional Gain: improvement ratio

\rho^{\mathrm{comp}}/\rho^{\mathrm{naive}}

across horizons and transition counts.

Panel of Figure 4 — Figure 4: Compositional Gain (left) and Persistence Scaling (right): certified lower bounds vs. horizon.

Experiment	Parameter	Value
Comp. Gain	$k$	$\{5,10,20,50\}$
	$\tau$	$\{1,2,3,4,5\}$
	$\bar{p},\rho^{\mathrm{in}},\gamma$	$0.95,0.98,0.7$
Persist. Scale	$(\alpha,\beta)$	$(0.05,0.98)$ , $(0.1,0.95)$ , $(0.2,0.98)$
	$k$	$\{5,10,20,50,100\}$
Mode Gran.	$M$	$\{2,4,8,16\}$

Appendix

Table 6: Per-experiment hyperparameters.

Adversarial Robustness of Language Models

Adversarial robustness of language models studies how to keep their outputs and decisions reliable under manipulative prompts, input changes, and malicious fine-tuning.

See all 191 papers

Transient Turn Injection: Exposing Stateless Multi-Turn Vulnerabilities in Large Language Models
Apr 23, 2026Naheed Rayhan, Sohely JahanLanguage Model Safety Evaluation Adversarial Attacks on LLMs
Jagannath University · University of Barishal
State-Dependent Safety Failures in Multi-Turn Language Model Interaction
Mar 15, 2026Pengcheng Li, Jie Zhang, Tianwei Zhang +5LLM Safety Language Model Safety Evaluation
School of Cyber Science and Technology, University of Science and Technology of China, China · Agency for Science, Technology and Research (A*STAR), Singapore · Nanyang Technological University, Singapore +3
Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures
Aug 17, 2026Srinivasan Subramanian, Kazi Aminul Islam, Md. Abdullah Al Hafiz KhanLLM Safety LLM Safety Evaluation
Department of Computer Science, Kennesaw State University, Marietta, GA, USA

Apr 23, 2026J/K move · Enter open · S save

Transient Turn Injection: Exposing Stateless Multi-Turn Vulnerabilities in Large Language Models

Naheed Rayhan, Sohely Jahan

Jagannath University · University of Barishal

Language Model Safety Evaluation Adversarial Attacks on LLMs Jailbreak Attacks Multi-Turn Jailbreak Attacks Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly integrated into sensitive workflows, raising the stakes for adversarial robustness and safety. This paper introduces Transient Turn Injection(TTI), a new multi-turn attack technique that systematically exploits stateless moderation by distributing adversarial intent across isolated interactions. TTI leverages automated attacker agents powered by large language models to iteratively test and evade policy enforcement in both commercial and open-source LLMs, marking a departure from conventional jailbreak approaches that typically depend on maintaining persistent conversational context. Our extensive evaluation across state-of-the-art models-including those from OpenAI, Anthropic, Google Gemini, Meta, and prominent open-source alternatives-uncovers significant variations in resilience to TTI attacks, with only select architectures exhibiting substantial inherent robustness. Our automated blackbox evaluation framework also uncovers previously unknown model specific vulnerabilities and attack surface patterns, especially within medical and high stakes domains. We further compare TTI against established adversarial prompting methods and detail practical mitigation strategies, such as session level context aggregation and deep alignment approaches. Our study underscores the urgent need for holistic, context aware defenses and continuous adversarial testing to future proof LLM deployments against evolving multi-turn threats.

Abstract

Adversarial Robustness of Language Models

Explore similar work

Transient Turn Injection: Exposing Stateless Multi-Turn Vulnerabilities in Large Language Models

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures