Multi-turn LLM safety

Pairing each attack session with a benign twin makes the multi-turn guardrail gap measurable

Turn-level filters approve every message while the session as a whole walks somewhere else. The useful part of this CRA paper is the control group: positives and their benign twins carry the same user-turn count, so length cannot explain the ranking.