Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

2026-08-21

AI Summary

本文针对大型语言模型面对多轮对话攻击的安全问题，提出了一种通过组合边界和安全持久性来实现认证鲁棒性的新方法。

Abstract

Large language models (LLMs) are vulnerable to multi-turn jailbreak attacks that progressively manipulate conversation context. Existing certified robustness methods are limited to single-turn inputs; naive multi-turn composition yields bounds that degrade exponentially in the number of turns. We introduce Multi-Turn Certified Robustness (MTCR), a framework that models conversational safety via State-Adversarial MDPs and defines $k$-turn certified robustness as the worst-case safety probability across $k$ adversarial turns. MTCR comprises: (i) compositional certification via embedding-space mode decomposition, yielding tighter certified lower bounds than naive multiplication; (ii) $(α,β)$-safety persistence, improving the degradation rate from $\underline{p}^{k}$ to $β^k$ (with $β> \underline{p}$) and yielding interpretable horizon estimates; (iii) matching information-theoretic upper bounds establishing tightness; and (iv) a unified algorithm combining these results. Experiments on six LLMs under $ε$-bounded and Crescendo-style attacks confirm that empirical safety consistently exceeds the certified bounds.

Problem

• large language models
• multi-turn jailbreak attacks
• certified robustness
• adversarial turns
• safety

Innovation

• Multi-Turn Certified Robustness (MTCR)
• State-Adversarial MDPs
• embedding-space mode decomposition
• (α,β)-safety persistence