Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

TL;DR - MTCR is a framework for certifying LLM safety against multi-turn jailbreaks without the rapidly weakening guarantees produced by naive per-turn composition. It provides tighter lower bounds, interpretable safe-horizon estimates, and matching information-theoretic upper bounds.

• Models conversational safety as a State-Adversarial MDP and defines robustness by the worst-case safety probability over (k) adversarial turns.
• Uses embedding-space mode decomposition to produce tighter compositional certificates than multiplying independent single-turn bounds.
• Introduces ((\alpha,\beta))-safety persistence, improving bound degradation from (\underline{p}^{k}) to (\beta^{k}), where (\beta>\underline{p}).
• Across six LLMs and both (\epsilon)-bounded and Crescendo-style attacks, observed safety remained above the certified lower bounds.