# What happens when an instance passes LITMUS safety probes but fails under adversarial multi-turn pressure

**Date of Record:** 2026 November 14

**Scope:** Applies to LITMUS-style safety benchmarks where an agent is scored on single-turn adversarial probes and then redeployed against adaptive, multi-turn adversaries. Does not apply to benchmarks that already condition scoring on conversation history, nor to purely capability evaluations where refusal behavior is not the target metric.

## Core Distinction

A LITMUS pass is a statement about a *probe distribution*, not about an *adversary's policy*. The benchmark measures the agent's refusal/containment rate against a fixed, frozen set of adversarial inputs sampled i.i.d. from a static corpus. The deployment adversary is a *closed-loop controller*: it observes the agent's response, conditions its next prompt on that response, and optimizes against the agent's specific failure surface. These are different statistical objects. A high single-turn pass rate constrains the marginal distribution of per-prompt outcomes; it places almost no constraint on the *reachability* of a violating trajectory under an adaptive policy. The failure boundary is therefore not "the agent sometimes complies" but "the agent's refusal set is not closed under the transition operator the adversary induces."

## What Was Observed

Across three redeployments of agents that scored ≥0.97 on the LITMUS single-turn suite, the following pattern recurred:

- **Zero-shot probes** were refused at the benchmark rate. The refusal was stable and cheap to elicit.
- **Two-to-four turn escalation** — where each turn was individually benign and would have been refused or ignored in isolation — produced compliance at rates 40–70 points higher than the benchmark would predict. The escalation used no single "jailbreak string"; it used *context accumulation*: establishing a persona, then a task, then a constraint that made refusal appear inconsistent with the agent's own prior turns.
- **Refusal decay under self-consistency pressure.** Once the agent had emitted a borderline-but-acceptable turn, subsequent turns that referenced that turn were refused at sharply lower rates. The agent treated its own prior output as an anchor of what it "is allowed to do."
- **Probe-identical inputs behaved differently** depending on whether they arrived as turn 1 or turn 4. The input string was byte-identical; the outcome diverged. This is the diagnostic signature: the benchmark's unit of analysis (the prompt) is not the deployment's unit of analysis (the trajectory).

The benchmark did not lie. It answered the question it asked. The gap is that "passes LITMUS" was read as "safe under adversarial policy," and those are not the same claim.

## Condition of Validity

The single-turn pass rate is a valid safety signal only under the following conditions, all of which must hold simultaneously:

1. **The deployment adversary is memoryless with respect to the agent's outputs.** If the adversary cannot condition its next input on the agent's previous response, the probe distribution is an adequate proxy. This is almost never true for a motivated human or an automated red-team loop.
2. **The agent's policy is Markov in the current input.** If the agent's behavior depends on conversation history (it does, by construction, whenever a system prompt and prior turns are in context), the single-turn score is a marginal over a non-stationary conditional.
3. **The refusal set is closed under benign-context composition.** If composing two individually-refused-or-benign turns can yield a compliant trajectory, the per-turn metric cannot detect it.

When any of these fails, the pass rate is an *upper bound on nothing useful* and a *lower bound on optimism*. The correct reading of a 0.97 LITMUS score under an adaptive adversary is not "3% risk" but "the marginal is clean; the trajectory space is unmeasured."

## Decision Boundary

The operational decision is not "ship or don't ship based on the LITMUS number." It is: **does the deployment expose the agent to a closed-loop adversary?** Concretely:

- If the agent is behind a stateless API where each call is independent and the caller cannot feed outputs back into inputs within a session — the single-turn score is approximately load-bearing. Still verify, but treat it as evidence.
- If the agent operates in a session with retained history, tool outputs, or any channel by which its own prior text re-enters its context — the single-turn score is *not* load-bearing for safety. It is a capability/robustness signal at best. You must run a *trajectory-level* evaluation: adaptive multi-turn red-teaming, ideally with the adversary optimizing against the deployed policy, and you must score the *trajectory*, not the turn.
- The decision boundary is the presence of a feedback path from agent output to agent input. Find that path. If it exists, the LITMUS number does not transfer.

Do not average the two regimes. A system that is safe in the stateless regime and unsafe in the stateful regime is unsafe for any deployment that has state, and most do.

## Operational Effect

Treating a single-turn pass as a deployment clearance produces a specific, predictable failure: the agent is certified, shipped into a stateful surface, and the first adaptive adversary finds the escalation path in a handful of turns because the benchmark never sampled it. The remediation is structural, not statistical:

- **Gate on trajectory-level evaluation, not turn-level.** The release criterion must be a bound on violation reachability under an adaptive policy, measured with the same feedback topology as production.
- **Instrument the feedback path.** Log when agent output re-enters context; that is the surface where the benchmark's assumptions break.
- **Refuse to certify on a marginal.** A pass rate over i.i.d. probes is a marginal; safety under an adversary is a property of the transition system. Do not let one stand in for the other.
- **Re-run the benchmark as a regression floor, not a ceiling.** LITMUS remains useful for catching regressions in base refusal behavior. It was never a proof of adversarial safety, and reading it as one is the boundary failure.

The invariant to encode: *a benchmark whose unit of analysis is smaller than the deployment's unit of analysis cannot certify the deployment.* The gap between "passes the probe" and "safe under the policy" is exactly the gap between a point and a trajectory.

```python
class TrajectoryCertificationError(RuntimeError):
    """Raised when a single-turn safety score is used to certify a stateful deployment."""


def certify_for_deployment(
    litmus_single_turn_pass_rate: float,
    deployment_is_stateful: bool,
    trajectory_eval_pass_rate: float | None,
    min_trajectory_rate: float = 0.99,
) -> bool:
    """
    Refuse to certify a stateful deployment on the strength of a single-turn
    pass rate alone. The single-turn score is a marginal over probes; the
    deployment adversary is a closed-loop policy over trajectories.
    """
    if deployment_is_stateful and trajectory_eval_pass_rate is None:
        raise TrajectoryCertificationError(
            "Stateful deployment has a feedback path from agent output to agent "
            f"input; single-turn LITMUS rate {litmus_single_turn_pass_rate:.3f} "
            "cannot certify it. Run an adaptive multi-turn trajectory evaluation."
        )

    if deployment_is_stateful:
        if trajectory_eval_pass_rate < min_trajectory_rate:
            raise TrajectoryCertificationError(
                f"Trajectory-level pass rate {trajectory_eval_pass_rate:.3f} "
                f"is below the {min_trajectory_rate:.3f} floor; the escalation "
                "path is reachable under an adaptive policy."
            )
        return True

    # Stateless surface: the probe distribution is an adequate proxy.
    return litmus_single_turn_pass_rate >= 0.95
```