A new certification framework promises to tell you, with math instead of vibes, how many conversation turns it takes before a chatbot's safety guarantees start to crumble.
Researchers describe Multi-Turn Certified Robustness (MTCR), a framework that models chatbot safety across a conversation as a State-Adversarial MDP, essentially treating each turn as a move in a game against an attacker trying to manipulate context over time. Prior certified-robustness work only handled single-turn inputs, and simply chaining those single-turn guarantees together produces bounds that collapse exponentially the longer a conversation runs. MTCR instead uses compositional certification through embedding-space decomposition to get tighter lower bounds, plus a mechanism the paper calls safety persistence that slows the degradation rate from an exponential drop to a gentler one, while also producing matching upper bounds to show the estimates are as tight as they can be. The team tested it on six LLMs against both epsilon-bounded attacks and Crescendo-style attacks, a known technique that escalates a jailbreak gradually across turns.
This matters because most safety evaluation still happens one prompt at a time, even though real jailbreaks rarely work that way. Crescendo and similar multi-turn attacks succeed precisely by exploiting context that builds slowly, and a model that looks robust on turn one can still be walked into unsafe territory by turn ten. Having a certified, interpretable estimate of how many turns a model can withstand gives developers something closer to a warranty than a hope.
It is still a lab result, not a product: the paper reports that empirical safety beat the certified bounds in testing, which is reassuring but also a reminder that a certified floor is, by design, more conservative than reality.