Large language models (LLMs) are prone to multi‑turn jailbreak attacks that gradually manipulate the conversation context. Existing certified robustness methods only handle single‑turn inputs; naïvely composing them across turns yields bounds that decay exponentially with the number of turns. We propose the Multi‑Turn Certified Robustness (MTCR) framework, which models conversational safety as a State‑Adversarial Markov Decision Process and defines $k$‑turn certified robustness as the worst‑case safety probability over $k$ adversarial turns.
MTCR’s main contributions are:
- Compositional certification via embedding‑space mode decomposition, producing certified lower bounds that are substantially tighter than the naïve product.
- Introduction of $(\alpha,\beta)$‑safety persistence, improving the degradation rate from $\underline{p}^{k}$ to $\beta^{k}$ (with $\beta \underline{p}$) and offering interpretable horizon estimates.
- Matching information‑theoretic upper bounds that demonstrate the tightness of the lower bounds.
- A unified algorithm that efficiently integrates the above components.
Experiments on six popular LLMs under $\epsilon$‑bounded and Crescendo‑style attacks show that empirical safety consistently exceeds the certified bounds, confirming the practicality of MTCR.
Blogger's Review: This paper delivers a rigorous, compositional approach to multi‑turn LLM safety, and the safety‑persistence notion bridges theory and real‑world deployment by providing quantifiable guarantees.