CRA-Bench и CRA-Net: как ловить вред, который копится по ходу диалога с LLM

CRA-Bench and CRA-Net:

How to Catch Harm That Builds Up Over an LLM Conversation

In July 2026, a team of researchers posted a paper to arXiv titled "Stateful Guardrails for Multi-Turn LLM Systems" — a framework called CRA that tracks risk accumulation across an entire conversation with a language model, rather than in a single message, and released the CRA-Bench benchmark of 1200 labeled sessions.

Why ordinary guardrails miss the harm

Most LLM safety systems evaluate each "prompt-response" pair in isolation — and miss attacks that build up gradually, turn by turn. The authors call this Conversational Risk Accumulation (CRA) and identify three forms of risk accumulation: the conversation gradually drifts away from an innocuous topic, a prohibited instruction is assembled piece by piece from separate messages, and sensitive data accumulates through repeated disclosures.

"Individually benign turns compose into harm," is how the authors

frame the core of the problem in the arXiv abstract.

What the CRA Framework tracks

The CRA Framework operates at the session level and monitors three signals of the conversation's trajectory. The first is semantic drift from the session's "anchor": how far the conversation has moved from its original topic. The second is an information-accumulation graph over extracted entities, weighted by their sensitivity. The third is a "compliance gradient": a signal of the model's growing willingness to carry out increasingly risky requests.

Key facts of the paper:

• The term — Conversational Risk Accumulation (CRA): intent drift, piecewise assembly of prohibited instructions, sensitivity accumulation
• Three signals — semantic drift, information-accumulation graph, compliance gradient
• Two scoring methods — unsupervised convex fusion and a trainable model, CRA-Net DA, with family-adversarial objectives
• CRA-Bench v0.1 — 1200 sessions of 8 turns each, three threat families, each with a topic-matched "benign twin"
• Extended set — 2000 sessions, five families (persona priming and context stuffing added)

For scoring, the authors propose two approaches: unsupervised convex fusion — a linear combination of signals with no training required, convenient for breaking down each signal's contribution — and CRA-Net DA, a compact trainable trajectory model trained with family-adversarial objectives, so that conversation length and topic diversity don't get mistaken for a signal of genuine threat.

How effectiveness was measured

The authors released three benchmark versions at once. CRA-Bench v0.1 contains 1200 eight-turn sessions across three threat families, with each harmful session paired with a benign "twin" on the same topic. CRA-Bench v0.2 uses the same scenarios but paraphrased by a different LLM to remove templated artifacts. The extended set brings the total to 2000 sessions and five families.

For evaluation, the authors propose a "trajectory-level" protocol with session-level splits: Trajectory AUROC, a turns-to-detection metric (how many turns it takes the system to notice an attack), calibrated false-positive rates, bootstrap confidence intervals, and a leave-one-family-out stress test — where one entire threat family is excluded from training to test generalization.

What this means

LLM safety is shifting from checking single messages to analyzing the entire conversation trajectory. Multi-turn attacks, where harm is assembled from seemingly innocuous pieces, are becoming a distinct, measurable class of threats — with a benchmark of 2000+ sessions and metrics to catch them.

Frequently asked questions

What is Conversational Risk Accumulation?

It's the accumulation of risk over the course of a conversation with an LLM, where individually benign messages gradually combine into harm: intent drifts, a prohibited instruction is assembled piece by piece, and sensitive data accumulates through repeated disclosures.

What does the CRA-Bench benchmark include?

CRA-Bench v0.1 is 1200 sessions of eight turns each, across three threat families, with topic-matched benign "twins." Version v0.2 adds variants paraphrased by another model, while the extended set adds up to 2000 sessions and five threat families.

How does CRA-Net differ from a simple filter?

CRA-Net DA is a compact trainable model that analyzes the entire session trajectory rather than a single message, and is trained with family-adversarial objectives so that conversation length and topic coverage aren't confused with a genuine threat.