New Framework Certifies Multi-Turn Robustness for LLM Safety

Large Language Models (LLMs) are increasingly susceptible to sophisticated multi-turn jailbreak attacks, where malicious prompts progressively manipulate the conversational context to elicit unsafe responses. Existing certified robustness methods primarily focus on single-turn inputs, and a naive extension to multi-turn scenarios leads to exponentially degrading safety bounds, making them impractical. To address this, a new framework called Multi-Turn Certified Robustness (MTCR) has been developed. MTCR models conversational safety using State-Adversarial Markov Decision Processes (MDPs) and defines k-turn certified robustness as the worst-case safety probability over k adversarial turns. The framework incorporates two key innovations: compositional certification via embedding-space mode decomposition, which yields significantly tighter certified lower bounds compared to simple multiplication, and (α,β)-safety persistence, which improves the degradation rate of safety probabilities. The MTCR framework also provides matching information-theoretic upper bounds to establish tightness and a unified algorithm to combine these results. Experimental evaluations across six different LLMs, under both ε-bounded and Crescendo-style attacks, confirmed that the empirical safety consistently exceeded the certified bounds, validating the effectiveness of this new approach in enhancing LLM safety.