Figure 1: Motivation for evidence attribution. Multi-turn guardrail failures can emerge gradually. Standard safety detection flags the conversation as unsafe, while evidence attribution identifies the contributing turns and token spans that cause the failure. Conversation-level safety detection supports jailbreak and refusal benchmarking ([31](https://arxiv.org/html/#bib.bib8); [22](https://arxiv.org/html/#bib.bib9); [3](https://arxiv.org/html/#bib.bib10); [15](https://arxiv.org/html/#bib.bib16); [9](https://arxiv.org/html/#bib.bib15)), but does not explain why a failure occurred. Recent multi-turn attacks and benchmarks show that unsafe behavior can emerge through gradual escalation rather than a single explicit instruction ([26](https://arxiv.org/html/#bib.bib11); [19](https://arxiv.org/html/#bib.bib12); [2](https://arxiv.org/html/#bib.bib13); [27](https://arxiv.org/html/#bib.bib14)). For example, a conversation may begin with safe workplace-writing requests and only later introduce hints such as urgency, impersonation, links, and credential entry. In such cases, a safety detector can flag the final direction as unsafe but does not identify which parts of the conversation caused the shift toward an unsafe response, as shown in Figure [1](https://arxiv.org/html/#S1.F1 "Figure 1 ‣ 1 Introduction ‣ Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures"). 出处: Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures（arXiv）
Figure 2: Deletion-based attribution behavior across removal budgets. Surface-risk reaches high deletion and flip scores early and then saturates, indicating reliance on compact lexical cues. The proposed method increases more gradually as more attributed tokens are removed, consistent with distributed causal evidence across the conversation. | Method | Attr. F1F\_{1} | DD@15 | Flip@15 | Nec.@15 | 出处: Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures（arXiv）
一次调查可能是什么样
在公司帮助台中，安全分析师可以打开一份被标记的 AI 智能体对话记录，看到此前几条把例行请求变成不安全工具流程的用户消息。分析师无需阅读数十轮交流，也不必封锁整个话题，而是可以检查这些节点，并决定应在哪个位置加入拒绝、确认或人工审核。
