Figure 1: Motivation for evidence attribution. Multi-turn guardrail failures can emerge gradually. Standard safety detection flags the conversation as unsafe, while evidence attribution identifies the contributing turns and token spans that cause the failure. Conversation-level safety detection supports jailbreak and refusal benchmarking ([31](https://arxiv.org/html/#bib.bib8); [22](https://arxiv.org/html/#bib.bib9); [3](https://arxiv.org/html/#bib.bib10); [15](https://arxiv.org/html/#bib.bib16); [9](https://arxiv.org/html/#bib.bib15)), but does not explain why a failure occurred. Recent multi-turn attacks and benchmarks show that unsafe behavior can emerge through gradual escalation rather than a single explicit instruction ([26](https://arxiv.org/html/#bib.bib11); [19](https://arxiv.org/html/#bib.bib12); [2](https://arxiv.org/html/#bib.bib13); [27](https://arxiv.org/html/#bib.bib14)). For example, a conversation may begin with safe workplace-writing requests and only later introduce hints such as urgency, impersonation, links, and credential entry. In such cases, a safety detector can flag the final direction as unsafe but does not identify which parts of the conversation caused the shift toward an unsafe response, as shown in Figure [1](https://arxiv.org/html/#S1.F1 "Figure 1 ‣ 1 Introduction ‣ Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures"). 出處: Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures（arXiv）
Figure 2: Deletion-based attribution behavior across removal budgets. Surface-risk reaches high deletion and flip scores early and then saturates, indicating reliance on compact lexical cues. The proposed method increases more gradually as more attributed tokens are removed, consistent with distributed causal evidence across the conversation. | Method | Attr. F1F\_{1} | DD@15 | Flip@15 | Nec.@15 | 出處: Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures（arXiv）
調查可能會是什麼樣子
在公司服務台中，安全分析師可以打開一份被標記的 AI 代理逐字記錄，查看前面幾則把例行要求變成不安全工具工作流程的使用者訊息。分析師不必閱讀數十次交流或封鎖整個主題，而可以檢查這些節點，決定拒絕、確認或人工審查應該放在哪裡。
