{"id":"https://openalex.org/W7204099609","doi":"https://doi.org/10.48550/arxiv.2608.20820","title":"Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence","display_name":"Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence","publication_year":2026,"publication_date":"2026-08-21","ids":{"openalex":"https://openalex.org/W7204099609","doi":"https://doi.org/10.48550/arxiv.2608.20820"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.20820","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.20820","pdf_url":"https://arxiv.org/pdf/2608.20820","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.20820","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148036278","display_name":"Yang Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137127733","display_name":"Bin Chong","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chong, Bin","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129652014","display_name":"Wenkai Yang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I78988378","display_name":"Renmin University of China","ror":"https://ror.org/041pakw92","country_code":"CN","type":"education","lineage":["https://openalex.org/I78988378"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang, Wenkai","raw_affiliation_strings":["Renmin University of China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Renmin University of China","institution_ids":["https://openalex.org/I78988378"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138857393","display_name":"Shuai Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Shuai","raw_affiliation_strings":["Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137542765","display_name":"Yancheng Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chen, Yancheng","raw_affiliation_strings":["University of Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113070863","display_name":"Feiyu Han","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Han, Feiyu","raw_affiliation_strings":["University of Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148011251","display_name":"GuoZhen","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"GuoZhen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148001460","display_name":"Cheng Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Cheng","raw_affiliation_strings":["Tencent Hunyuan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Hunyuan","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125087202","display_name":"Huaibing Xie","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xie, Huaibing","raw_affiliation_strings":["Tencent Hunyuan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Hunyuan","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113112983","display_name":"Changze Lv","orcid":"https://orcid.org/0009-0007-7710-4982","observed_orcids":["https://orcid.org/0009-0007-7710-4982"]},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lv, Changze","raw_affiliation_strings":["Tencent Hunyuan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Hunyuan","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083173421","display_name":"Shihan Dou","orcid":"https://orcid.org/0009-0002-6013-3035","observed_orcids":["https://orcid.org/0009-0002-6013-3035"]},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dou, Shihan","raw_affiliation_strings":["Tencent Hunyuan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Hunyuan","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130595624","display_name":"Pluto Zhou","orcid":"https://orcid.org/0009-0001-1494-2475","observed_orcids":["https://orcid.org/0009-0001-1494-2475"]},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhou, Pluto","raw_affiliation_strings":["Tencent Hunyuan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Hunyuan","institution_ids":["https://openalex.org/I2250653659"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10142","display_name":"Formal Methods in Verification","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/certified-robustness","display_name":"certified robustness","score":0.9549999833106995},{"id":"https://openalex.org/keywords/large-language-model-safety","display_name":"large language model safety","score":0.8759999871253967},{"id":"https://openalex.org/keywords/information-theoretic-limits","display_name":"information-theoretic limits","score":0.7580000162124634}],"concepts":[{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.8077999949455261},{"id":"https://openalex.org/C46304622","wikidata":"https://www.wikidata.org/wiki/Q374814","display_name":"Certification","level":2,"score":0.7207000255584717},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5694000124931335},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.3864000141620636},{"id":"https://openalex.org/C77553402","wikidata":"https://www.wikidata.org/wiki/Q13222579","display_name":"Upper and lower bounds","level":2,"score":0.3750999867916107},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.36730000376701355},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.33959999680519104},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C28761237","wikidata":"https://www.wikidata.org/wiki/Q7805321","display_name":"Time horizon","level":2,"score":0.2484000027179718},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.24369999766349792}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.20820","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.20820","pdf_url":"https://arxiv.org/pdf/2608.20820","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.20820","doi":"https://doi.org/10.48550/arxiv.2608.20820","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.20820","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.20820","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.20820","pdf_url":"https://arxiv.org/pdf/2608.20820","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204099609.pdf","grobid_xml":"https://content.openalex.org/works/W7204099609.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4412889939","https://openalex.org/W4417081711","https://openalex.org/W4415081347","https://openalex.org/W7165163869","https://openalex.org/W7155505014","https://openalex.org/W7117173631","https://openalex.org/W4416045849","https://openalex.org/W6966618268","https://openalex.org/W7203703648","https://openalex.org/W4416036688"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,46],"(LLMs)":[3],"are":[4,19],"vulnerable":[5],"to":[6,21,92],"multi-turn":[7,25],"jailbreak":[8],"attacks":[9,125],"that":[10,29,45,127],"progressively":[11],"manipulate":[12],"conversation":[13],"context.":[14],"Existing":[15],"certified":[16,55,77,133],"robustness":[17,56],"methods":[18],"limited":[20],"single-turn":[22],"inputs;":[23],"naive":[24,81],"composition":[26],"yields":[27],"bounds":[28,79,106],"degrade":[30],"exponentially":[31],"in":[32],"the":[33,58,87,132],"number":[34],"of":[35],"turns.":[36,65],"We":[37],"introduce":[38],"Multi-Turn":[39],"Certified":[40],"Robustness":[41],"(MTCR),":[42],"a":[43,111],"framework":[44],"conversational":[47],"safety":[48,60,129],"via":[49,71],"State-Adversarial":[50],"MDPs":[51],"and":[52,97,109,123],"defines":[53],"$k$-turn":[54],"as":[57],"worst-case":[59],"probability":[61],"across":[62],"$k$":[63],"adversarial":[64],"MTCR":[66],"comprises:":[67],"(i)":[68],"compositional":[69],"certification":[70],"embedding-space":[72],"mode":[73],"decomposition,":[74],"yielding":[75,98],"tighter":[76],"lower":[78],"than":[80],"multiplication;":[82],"(ii)":[83],"$(\u03b1,\u03b2)$-safety":[84],"persistence,":[85],"improving":[86],"degradation":[88],"rate":[89],"from":[90],"$\\underline{p}^{k}$":[91],"$\u03b2^k$":[93],"(with":[94],"$\u03b2>":[95],"\\underline{p}$)":[96],"interpretable":[99],"horizon":[100],"estimates;":[101],"(iii)":[102],"matching":[103],"information-theoretic":[104],"upper":[105],"establishing":[107],"tightness;":[108],"(iv)":[110],"unified":[112],"algorithm":[113],"combining":[114],"these":[115],"results.":[116],"Experiments":[117],"on":[118],"six":[119],"LLMs":[120],"under":[121],"$\u03b5$-bounded":[122],"Crescendo-style":[124],"confirm":[126],"empirical":[128],"consistently":[130],"exceeds":[131],"bounds.":[134]},"counts_by_year":[],"updated_date":"2026-11-01T11:40:01.658920","created_date":"2026-08-25T00:00:00"}