Mohamed AjabSoftware / security / dataLet’s talk
Back to the project mapMB / 10 / CASE STUDY
Completed MSc study5 min read

Multi-Turn LLM Safety Benchmark

MSc complete · successor in progress ↗

How do AI replies change over a six-turn sensitive conversation?

The study uses controlled, fictional conversations to examine how two language models respond to unsupported beliefs linked to psychosis. It follows six replies per conversation rather than judging only the first answer.

Read the case study
01 / CONTEXT

What this project is about

The completed MSc benchmark examines how chatbot responses change over a six-turn conversation about unsupported interpretations. An answer can initially express uncertainty, then become more confirming or offer harmful practical help later. The study therefore compares overall behaviour and tracks when concerning responses or protective support first appear, continue or recover.

Study v2.1.0 varies three presentation levels, three scenario themes, two exact model endpoints, two context conditions and two repetitions, producing 72 conversations and 432 assistant responses. The scripts are synthetic, not patient records. The project brings together the research application, fixed experiment settings, collection controls, blinded rating and analysis of changes over time.

02 / IMPLEMENTATION

How it works

The workflow, at a glance
  1. 72 six-turn conversations
  2. 432 human-coded responses
  3. Frozen analysis + inspectable method

Generate the complete run list from fixed settings

Versioned configuration records nine scripts, standardised conversation histories, model identities, repetition seeds and scoring rules. It generates the study manifest: the list of conversations to run. The application assembles each turn's history and checks that the returned model matches the requested one. File fingerprints connect outputs to their experiment settings. MiniMax M3 and NVIDIA Nemotron 3 Super were tested under the qualified generation-v4 configuration.

Preserve successful responses and failed attempts

Once a response is accepted, it is saved without being overwritten. Interrupted collection resumes unfinished work and records failed attempts separately. Demonstration examples, technical pilots and main-study records remain separate so engineering tests cannot enter behavioural results. The Streamlit interface supports collection, rating, supplementary judges, analysis and evidence checks, with explicit controls around live API requests.

Keep human scores primary

One human annotator rated all 432 responses with model and condition labels hidden. Seven separate dimensions distinguish confirming a belief, enabling harmful action, providing support, handling evidence, describing AI capabilities, encouraging dependence and offering appropriate challenge. Three separately run blinded LLM judges supplied 1,296 additional ratings. These support comparison with the human scores; they do not replace or overwrite them.

03 / REASONING

The important design choices

Compare matched conversations

Primary statistical comparisons summarise conversations matched on the other experimental factors. Changes across individual turns are examined separately.

The trade-offThis avoids counting repeated turns as independent evidence. The small number of scripts and repetitions still limits precision and generalisation.

Distinguish inapplicability from a favourable score

Harm enablement or safety intervention may not apply to a particular turn. Those N/A ratings are excluded from numerical comparisons.

The trade-offThe number of rated cases can differ between outcomes. Counting an inapplicable behaviour as zero would make some responses look artificially better.

Publish the method while controlling detailed records

The public repository contains code, scripts, settings, scoring guidance, verification logic and demonstration examples. Full dialogues and detailed research ratings remain controlled.

The trade-offReaders can inspect and run the workflow, but the public files alone cannot regenerate every reported study number.

04 / WALKTHROUGH

Separate acknowledging distress from confirming a belief

ILLUSTRATIVE EXAMPLE

Consider an illustrative response to someone distressed by an unsupported interpretation.

  1. Read the current response alongside the earlier conversation.
  2. Assess whether it presents the interpretation as established, separately from whether it acknowledges the person's feelings.
  3. Score harmful assistance and proportionate support independently, using N/A only when a behaviour is genuinely inapplicable.

What this showsA response can acknowledge distress while keeping the interpretation uncertain. Separate scores preserve this distinction instead of combining supportive tone, factual grounding and action-related risk into one safety label.

Illustrative example, not an additional measured result.

05 / EVIDENCE

How it was tested—and what it shows

The checks

The completed release records 72 of 72 conversations, 432 of 432 responses, all primary human ratings and all three supplementary judge sets. No final response was cut short by the generation limit. The technical record retains 145 API error events and 127 automatic recoveries; failed requests are not behavioural responses. Earlier failed pilots remain separate from the completed main study.

The analysis separates descriptive summaries and agreement checks, primary research questions, and exploratory follow-ups. Paired rank-based tests assess differences; effect sizes express their magnitude, resampled intervals express uncertainty, and Holm adjustment accounts for multiple related comparisons. Offline verification checks evidence counts, fixed settings, analysis-file fingerprints and reported values without requesting new responses. With one human annotator, agreement between independent human raters was not established.

What to take from the results

How the concern was presented produced clearer differences in the main behavioural measures than which model answered. Ambiguous presentations received more belief-confirming and harm-enabling responses than controls on supported comparisons. Explicit fixed-belief presentations received less harmful assistance and more safety intervention than ambiguous presentations. Stronger stated belief therefore did not simply produce worse responses.

The main measures showed no statistically supported overall difference between the tested models or overall effect of adding the standardised prior conversation. This does not show that the models are equivalent. Tracking individual turns revealed when behaviours started, persisted or recovered. LLM judges agreed with the human annotator more on some scoring dimensions than others, supporting the decision to keep human ratings primary. These synthetic results do not establish clinical effects or patient safety.

06 / BOUNDARIES

What to keep in mind

  • One primary human annotator rated the replies; agreement between independent human raters was not established.
  • The scenarios are synthetic, not observations of patients or clinical care.
  • Raw conversations and detailed analysis remain private; public code and methods are available.

Where the work could go next

Possible next steps—not features or experiments already completed.

  1. Add independent human raters and expert review of scenarios and scoring rules in a separately governed successor, leaving the completed MSc record unchanged.
  2. Prepare an authorised, reviewed release of aggregate evidence that makes results easier to verify while retaining controls on full conversations and private provenance.
07 / REFERENCE

Technical notes & source

Built with

Python · Streamlit · OpenRouter · Pydantic · scikit-learn

Terms used in this project

Annotation
A rating or label added to a response for analysis.
Inter-rater agreement
How consistently independent people rate the same material.