Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models: State, cost, reliability, security, and governance

wpnews.pro

SGAEIA Research Series — Article 25

Aridio Silva — Independent Researcher, Brazil

ORCID: 0009-0008-2411-6995

DOI: 10.5281/zenodo.23867630

License: CC BY 4.0

This article examines how moving from a single-turn interaction to a multi-turn trajectory changes the state, cost, reliability, security, and governance of systems built on large language models. The analysis is a critical narrative review supported by scientific papers, official provider documentation, standards, security taxonomies, and explicitly identified original calculations. A model has no intrinsic conversational memory across independent inferences; continuity is reconstructed by the client or through provider-managed state services. When an application fully replays a history that grows at an approximately constant rate, the logical sum of input tokens grows quadratically with the number of calls, although caching, truncation, compaction, and external memory change billed cost, latency, and effective computation.

Benchmark evidence shows that requirement fragmentation, cross-turn dependencies, intent shifts, information retrieval, and reliance on previous model outputs create different failure modes; there is no single “multi-turn” condition. Evidence on explicit reasoning and memory techniques is mixed and task- and protocol-dependent. In agentic systems, accumulated history also expands gradual attacks, persistence of malicious content, error propagation, and unbounded consumption. The article relates these findings to governed routing and SGAEIA, arguing for a separation between transcript, operational state, and assurance evidence. This relationship is an architectural interpretation and validation agenda, not empirical proof of the framework.

Keywords: LLM; single-turn; multi-turn; conversational state; LLM routing; prompt caching; reliability; security; runtime governance; SGAEIA.

Definitions. A message is a unit attributed to a role such as user, assistant, system, or tool. An inference call is one execution of the model that receives a representation of state and produces an output. An interaction round is, in this article, the cycle formed by a new user input and the corresponding system response, possibly including internal tool calls. In the cost equations, T denotes the number of principal calls or rounds as stated; when a benchmark uses a different convention, it is declared explicitly.

Research question. How does the choice between single-turn and multi-turn affect (a) state mechanics, (b) token and credit cost, (c) performance and reliability, and (d) security and governance in frontier LLMs?

Method and source policy. Primary sources are preferred: papers (arXiv, proceedings), official provider documentation and blogs, standards and legislation. Secondary sources are used only when flagged. Every reference was checked for authorship, date, identifier and venue; the audit result is in Section 12 (Bibliography), with unverified items marked as such. Prices and reasoning levels are a snapshot of Oct./Nov. 2026 taken from official pages, and change often.

Limitations. No provider publishes performance for each model and each reasoning level separately for single-turn and multi-turn. The cost tables use explicit assumptions and are own calculations, not provider data.

How to read. Each section ends with an analysis box. Equations are numbered images; figures carry text descriptions.

A language model does not, by itself, preserve conversational memory across independent inferences. Continuity may be reconstructed by the client, which replays messages or derived state, or by a provider service that maintains items, identifiers, or server-side compaction. In either case, the current response depends on a selected representation of the past. That representation should be treated as manipulable input subject to truncation, summarization, error, access control, and audit, rather than as an automatically trustworthy record. Three practical consequences:

Figure 1. Single turn (one call, no state) and multiple turns (history resent and growing). Author's diagram.

In single-turn use the interaction is limited to one request and one answer, and the model has no inherent memory of earlier interactions.

Architectural limits: no iterative refinement (any adjustment means rewriting the prompt) and unfitness for tasks needing step-by-step planning, iterative debugging or design-space exploration.

In multi-turn use, the accumulated history (user, assistant and optionally tool calls) is reprocessed or managed at each interaction. In long sessions, three strategies avoid saturating the window and degrading attention:

A related line of research treats the context window as an operating system's main memory. MemGPT [6] proposes virtual context management: the main context (instructions, working context and a FIFO queue) is complemented by external storage, with paging driven by function calls.

In Transformers [1], attention costs O(n²·d) per layer (Equation 1). Quadratic growth is polynomial, not exponential. Two layers must be distinguished:

Equation 1. Scaled dot-product attention and complexity per layer, after Vaswani et al. [1].

Equation 2. Input at turn t, where S is the system prompt, u the user tokens per turn, a the visible assistant tokens, r the reasoning tokens and κ = 1 if reasoning is kept in the history (κ = 0 otherwise).

Equation 3. Cumulative input over T turns: quadratic in T.

Recent LLM evolution can be read along seven dimensions that influence each other. Figure 2 shows only milestones whose date was checked against a primary source (Section 12); unverified milestones were left out on purpose.

Figure 2. Multidimensional timeline (architecture and context; alignment and dialogue; inference-time reasoning; memory and agents; cost and infrastructure; multi-turn evaluation; security and governance). Author's work based on sources [1]–[22].

The Transformer [1], published in June 2017, replaced recurrence with attention and made training parallelizable. Models were trained with small windows, between 512 and 2,048 tokens [5], and used through prompting: a text or a few examples were given and the model completed it [2]. This is, in essence, a single-turn regime.

InstructGPT 2 showed that fine-tuning with human feedback (RLHF) makes a model preferable, on user instructions, to a GPT-3 more than a hundred times larger. On 30 November 2022 OpenAI launched ChatGPT, whose dialogue format lets it answer follow-up questions, admit mistakes and challenge incorrect premises [18]. Here multi-turn stops being a research topic and becomes a product format.

Three patterns stand out. (1) Each capability advance (long context, reasoning) was followed by cost advances (caching) and evaluation advances, but multi-turn evaluation arrived after the product. (2) Security followed the conversation: risk moved from the isolated prompt to the history and to retrieved data. (3) Governance moved from principles to runtime controls, the subject of Sections 7 and 8.

MT-Bench [4] evaluated two-turn conversations (for example, ask for a text and then ask for it to be re-explained to a child); MT-Bench-101 [7] expanded to 4,208 turns across 1,388 dialogues and 13 tasks, organized into perception, adaptability and interactivity, and observed that usual alignment techniques and chat-specific designs gave no clear gains in multi-turn abilities. These benchmarks are generally episodic: each turn brings a subtask that can be scored in isolation.

Laban et al. 10 compare single-turn and multi-turn on the same tasks. The sharding method splits each instruction into pieces, and the simulated user reveals at most one per turn. Three main conditions: FULL (full instruction in one turn), CONCAT (shards concatenated in one turn) and SHARDED (one shard per turn).

Figure 3. Mean performance P (0 to 100) in the three conditions, per [10]. Bars: 90 (FULL), 85.6 (CONCAT = 95.1% of FULL) and 65 (SHARDED). Author's chart.

Metrics. For each instruction, with N simulations and scores S:

Equation 4. Mean performance (P), aptitude (A⁹⁰, the best-case performance) and unreliability (U, the gap between the 90th and 10th percentiles) [10].

Results (v1, 9 May 2025). 15 LLMs from eight families, six tasks (code, database, actions/APIs, math, data-to-text and summarization), over 200 thousand simulated conversations. Mean of 90% in single-turn against 65% in multi-turn; a 39% drop in the abstract and text; aptitude −16% and unreliability +112%. Degradation appears already with two turns. CONCAT reaches 95.1% of FULL, so the loss does not come from rephrasing. The two reasoning models tested (o3 and DeepSeek-R1) deteriorate similarly and produce answers 33% longer on average, with more assumptions.

Qualitative causes: premature final-answer attempts; answer "bloat" (final answers 20 to 300% longer); loss in middle turns; and verbosity. Temperature zero does not fix it: with temperature 0 on both sides about 30 points of unreliability remain. Mitigations: repeating requirements every turn (SNOWBALL) recovers 15 to 20% of the drop; a final RECAP is better but unrealistic.

Study limitations (noted by the authors): automated simulation, analytical tasks, English and text only. The authors consider that real-world degradation is likely larger than measured. Recommendations: retry in a fresh conversation and consolidate requirements into a single prompt.

Liu et al. [5] showed a U-shaped curve: performance is higher when relevant information is at the start or end of the context and drops when it is in the middle, and it decreases as context grows, even in long-context models. Laban et al. observed an analogue across turns (loss-in-middle-turns).

LLMs Get Lost in Multi-Turn Conversation is not isolated evidence. The final paper was published at ICLR 2026 and received an Outstanding Paper distinction [37], [38]. Its principal result—an average 39% drop when requirements for the same task are disclosed gradually—should be interpreted within its sharded-simulation design: analytical tasks, simulated conversations, English-only text, and models from a specific time window.

Other benchmarks measure partly different failure modes. MT-Eval organizes interactions into recollection, expansion, refinement, and follow-up [39]. MultiChallenge, published in Findings of ACL 2025, evaluates four realistic challenges that jointly require instruction following, context allocation, and in-context reasoning; every evaluated model scored below 50% accuracy, with a best average of 41.4% [40]. StructFlowBench models six structural relationships between turns and identifies difficulty in understanding conversational flow [41]. mtRAG, published in TACL, adds retrieval through 110 human-generated conversations averaging 7.7 turns and totaling 842 tasks [42].

Evidence about explicit reasoning is mixed. In Laban et al.'s design, the two reasoning models tested did not eliminate degradation and generated longer answers. In contrast, MARS-Bench reports that explicit reasoning improves robustness in long conversations involving intent shifts and cross-turn dependencies [43]. The defensible conclusion is not that “more reasoning does not work,” but that its effect depends on the task, protocol, memory management, and metric.

Taken together, these studies show that “multi-turn” is not a single condition. At least five mechanisms should be separated: (1) requirements disclosed in fragments; (2) structural dependencies between turns; (3) distraction and intent shifts; (4) retrieval of external evidence; and (5) dependence on the model's own previous answers. A mitigation that helps one—such as recap, compact memory, or explicit reasoning—may fail or increase cost in another.

The results strengthen the case for representing task state separately from the transcript. Confirmed requirements, validated facts, revoked decisions, permissions, and tool results should not depend only on their position in textual history. A governance architecture can maintain typed contracts, provenance, and deterministic policies while using conversation as the interface. This relationship is the author's interpretation and an SGAEIA architectural hypothesis, not an empirical validation of the framework. Its effectiveness should be tested against baselines such as full replay, sliding windows, rolling summaries, and retrieved memory.

To fix intuition (and not as an empirical result), suppose that at each turn there is a probability ε that the model introduces a wrong premise that the user accepts (hallucination cascade). The probability that a T-turn conversation has no accumulated error is given by Equation 6. With ε = 5% and T = 20, about 36% remains.

Equation 6. Didactic compound-error model; ε and T are hypothetical parameters.

Billing has three components: input tokens, output tokens (including reasoning tokens, billed as output) and the cache read of repeated input. In multi-turn use almost all resent history is read from cache, so the cache-read price differentiates providers more than the input price.

Equation 5. Cost of a T-turn conversation with cache: p_w (write), p_c (cache read), p_o (output), in USD per million tokens; N_new is the new part of the input at each turn.

*Availability of each level varies by model; Anthropic points to the effort page as the reference [24]. Sources: [24]–[29]. Names and levels change often; confirm on the official pages.

reasoning.context parameter selects the behavior (all_turns is supported by GPT-5.6 and GPT-6.1 Sol). A configuration_update item changes effort between responses without altering the prefix, preserving the cache. Table 6 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0

Provider caveats: Haiku 5.5 costs more above 100k tokens; Gemini 4 Argon doubles in price from 1 Dec. 2026 and offers only implicit caching; grok-4.7 doubles above 200k tokens; DeepSeek charges half off-peak; and Claude models from 4.7 on use a tokenizer that produces about 30% more tokens for the same text, so per-token prices are not comparable 1:1 across providers [23]. Sources: [23], [25], [26], [28], [29].

Assumptions: S = 2,000, u = 300, a = 700 tokens; reasoning r = 1,000 (low effort) or 8,000 (high); the cache always hits; for this simplified scenario, cache writes carry no surcharge. This assumption is not universal: providers may price writes, TTLs, or cache modes separately. By Equation 3, cumulative input over 20 turns is 236 thousand tokens (21.3k new and 214.7k read from cache) with reasoning dropped; if 8,000 tokens of reasoning were kept in the history, input would rise to 1.756 million (7.4 times), with 173.3k input tokens at the 20th turn.

Figure 4. Left, input tokens per turn in three scenarios; right, illustrative 20-turn cost per model, with cache. Author's calculation on official prices.

Readings. With cache, output (mainly reasoning) dominates: going from low to high effort multiplies cost by 3.4 to 4.5 times. Caching cuts input cost by about 86% in the example (models with cache reads at 5% of input), and Anthropic's documentation [20] reports gains of the same order (−53% cost and −75% latency over 10 turns). On cost security, OWASP lists Unbounded Consumption (LLM10:2025) as a risk: uncontrolled inference consumption becomes a cost attack [16].

From a security and governance standpoint, multi-turn use changes the system's risk profile. This section gathers the scientific evidence and the risks described in the compendium.

The OWASP Top 10 for LLM Applications (2025 edition, 18 Nov. 2024) keeps prompt injection in first place (LLM01) and includes Excessive Agency (LLM06), Misinformation (LLM09) and Unbounded Consumption (LLM10) [16]. Google's SAIF [17] is a conceptual framework of six elements that lists, among AI-specific risks, model theft, data poisoning, prompt injection and data extraction.

This section incorporates, in full, the content of the author's technical compendium 36, as a technical basis for this analysis.

Agent systems based on execution graphs can represent state as a typed, immutable, event-persisted object, not as the coupled history of a chat.

Figure 5. Transactional transition cycle: command, validation, drift check, immutable commit and checkpoint, with failure branches, circuit breaker and time-travel. Author's diagram based on the compendium.

Drift shows up in three forms: semantic (loss of focus on the goal), behavioral (deviation from safety and system guidelines) and epistemic (accumulation of hallucinations accepted as truth).

A. Semantic and contextual drift

B. Behavioral and alignment drift

C. Epistemic drift (cumulative error)

Implementation requires moving from malleable dictionaries to immutable, typed state contracts with transactional validation. The compendium's code follows, preserved as in the original.

State structure with Pydantic

from enum import Enum
from pydantic import BaseModel, Field, field_validator
from typing import List, Dict, Any, Optional
from datetime import datetime

class AgentRole(str, Enum):
    RESEARCHER = "researcher"
    EXECUTOR = "executor"
    CRITIC = "critic"
    ROUTER = "router"

class TaskStatus(str, Enum):
    PENDING = "pending"
    IN_PROGRESS = "progress"
    VALIDATED = "validated"
    REJECTED = "rejected"

class GlobalState(BaseModel):
    session_id: str
    current_step: int = Field(ge=0, description="Contador estrito de turnos/transições")
    goal_tree: Dict[str, TaskStatus] = Field(default_factory=dict)
    execution_log: List[Dict[str, Any]] = Field(default_factory=list)
    risk_score: float = Field(default=0.0, ge=0.0, le=1.0)

    @field_validator('execution_log')
    def validate_log_immutability(cls, v):
        return v

    class Config:
        frozen = True # Imutabilidade estrutural (requer cópia via model_copy para atualizar)

The transactional transition cycle. (1) The agent produces a Command (raw output). (2) The validator parses it into the corresponding Pydantic schema. (3) If successful, the State Manager generates a new immutable version of the state (new_state = state.model_copy(update=...)) and records the event in a transactional database.

Resilient orchestrator

def orchestrate_turn(state: GlobalState, agent_input: str) -> GlobalState:
    validate_circuit_breaker(state)

    raw_output = run_agent_safely(agent_input, state)

    try:
        structured_output = AgentPayload.model_validate_json(raw_output)
    except ValidationError as e:
        return handle_malformed_output(state, e)

    risk = evaluate_drift_and_risk(state, structured_output)
    if risk > 0.8:
        return trigger_circuit_breaker_rollback(state)

    new_state = state.model_copy(update={
        "current_step": state.current_step + 1,
        "execution_log": state.execution_log + [structured_output.dict()],
        "risk_score": risk
    })

    persist_checkpoint(new_state)
    return new_state

(Code comments are kept in the original Portuguese.)

Minimal Pydantic v2-compatible variant

from pydantic import BaseModel, ConfigDict, Field

class GlobalState(BaseModel):
    model_config = ConfigDict(frozen=True)   # shallow immutability
    session_id: str
    current_step: int = Field(ge=0)
    goal_tree: dict[str, "TaskStatus"] = Field(default_factory=dict)
    execution_log: tuple[dict, ...] = ()      # tuple: growth by new copy
    risk_score: float = Field(default=0.0, ge=0.0, le=1.0)

Time-Travel Debugging is the mechanism of freezing, inspecting, rolling back and forking agent execution through continuous recording of immutable state snapshots.

Operational limitation. In LangGraph's official documentation [31], time travel has two operations: replay (resume from an earlier checkpoint) and fork (branch with modified state); checkpoints are saved at each super-step. But replay re-executes the nodes after the checkpoint: LLM and API calls fire again and may return different results. So debugging is only deterministic if LLM and tool outputs are recorded (event sourcing of the responses) and reused. The documentation does not mention restoring seeds.

This section incorporates Sections 5 to 7 of the compendium [36], as a technical basis for this analysis. Statements about SGAEIA are the author's own (original work) and have not undergone independent evaluation.

Strict-compliance architecture represents the shift from static governance to runtime enforcement engineering. The core principle: the LLM is never part of the critical authorization path (trust path); security comes from deterministic invariants.

Figure 6. Application plane, governance and control plane, and infrastructure plane. Author's diagram based on the compendium.

Fundamental layers

Regulatory scope. Articles 12 (record-keeping) and 14 (human oversight) of Regulation (EU) 2024/1689 [14] apply to high-risk systems. Append-only, tamper-evident records contribute to compliance but do not guarantee it in isolation. NIST AI RMF 1.0 is document NIST AI 100-1 [13].

Action classification and human oversight matrix

SGAEIA (Secure Governed Autonomous Edge Intelligence Architecture) is an open, neutral reference architecture, conceived by Aridio Silva [34], [35], aimed at governance, security and runtime control of autonomous agents and distributed/edge AI.

Core premise. In agentic environments, the object of assurance is the complete system in operation, not the isolated language model; governance is intrinsic to the execution infrastructure, not a static post-processing step.

Figure 7. SGAEIA's twelve responsibility planes and seven cross-cutting invariants, per the compendium.

The twelve planes: (1) agency and agent lifecycle; (2) cryptographic identity and attribution (unique SPIFFE/X.509 per agent); (3) delegation and authority scope (strict subset); (4) deterministic policy and enforcement (policy-as-code: OPA/Cedar/WASM); (5) inter-agent communication and bus; (6) state management and persistent memory (immutable, versioned, auditable); (7) tool integration and API mediation (pre/in/post-action interception); (8) containment, limits and isolation at the edge (sandboxing, WASM, microVMs); (9) observability, evidence and auditability (Evidence-as-Code, append-only); (10) resilience, rollback and recovery (circuit breaking and time-travel rollback); (11) human oversight and control interfaces (HITL portals); (12) continuous assurance and risk assessment (monitoring of risk_score and compliance).

The seven cross-cutting invariants: Bounded Authority (autonomy strictly limited to the current task); Revocable Trust (revocation with bounded, observable, and tested latency); Zero-Trust Runtime Enforcement (no transition is implicitly trusted); Tamper-Evident Lineage (cryptographically verifiable audit trail); Deterministic Policy Mediation (policy mediated outside the LLM decision path and not directly modifiable by conversational content); Least-Privilege Delegation (strict limits on context passing between agents); Continuous Assurance (continuous validation of compliance and risk mitigation).

Relation to this study. Plane 6 (state), 10 (rollback) and 12 (continuous assurance) directly address the multi-turn risks of Sections 4 to 7; Planes 3, 4 and 7 address injection and escalation risk (Section 6).

Article 24 of the SGAEIA Research Series treated routing as a governed decision about models, data, resources, and trajectories [49]. This article develops the temporal unit of that decision. In a multi-turn interaction, the router does not receive only a new question: it receives a representation of the past, possibly summarized, retrieved, or reconstructed. If that representation omits a constraint, incorporates an error, or loses the chain of authority, selection may be technically efficient and still invalid.

The admissible set of models and configurations may change during the conversation because of active identity, data classification, remaining budget, required tools, external effects already executed, and revoked or updated policies. The router should optimize only within that set. Fallback must not turn a safety refusal into an outage to bypass, or send data to a deployment that does not satisfy the same conditions.

A model switch is also a state transition. Models differ in tokenization, tool use, structured formats, preservation of reasoning, interpretation of instructions, and operating policies. Substitution preserves the trajectory only when it retains mandatory constraints, required capabilities, applicable authority, and necessary evidence, or when any loss is detected and handled before execution.

This table is a conceptual model, not a completed normative SGAEIA specification. The central synthesis is: the transcript is a narrative interface; governed state is an operational artifact; the evidence trail is an assurance artifact. The three are related but should not be conflated.

Anthropic's support article (5 Mar. 2026) [33] acknowledges that Claude can produce incorrect or misleading answers ("hallucination"), mentions outdated information and citations that sound authoritative without basis, and recommends not treating the model as a single source of truth and checking the sources in search results. Strengths: it admits that error can sound convincing and distinguishes model error from synthesis error over real sources. Limitations: it does not separate error types (staleness, invention, reasoning, synthesis), does not quantify frequency, does not mention the multi-turn effect (Section 4) and does not teach how to verify.

For any reference: (1) open the DOI or identifier and check title, authors and year; (2) find the passage that supports the claim; (3) confirm the venue (a preprint is not a published paper); (4) flag what was not verified.

Author's analytical inferences: (1) competitive advantage will probably shift from raw capability to reliability per cost; (2) cache-read price will tend to weigh more than input price in product comparisons; (3) runtime governance will tend to become a procurement requirement in regulated environments as the 2027 dates approach.

Moving from single-turn to multi-turn interaction is not merely an interface change. It turns history into operational state, expands cumulative cost, introduces dependencies between decisions, and creates distinct mechanisms of failure, persistence, and attack. Performance observed in an isolated call is therefore insufficient evidence of trajectory reliability.

The evidence reviewed here shows that multi-turn degradation depends on the task, protocol, presentation of context, memory mechanism, and the model's reliance on its own prior outputs. Caching, compaction, summarization, retrieval, and model switching can reduce cost or extend capability, but they also change provenance, authority, and reproducibility conditions.

For LLM routers and SGAEIA, the central consequence is that selection and governance must operate over explicit state and verifiable evidence. Constraints, permissions, revoked decisions, external effects, and remaining budget must survive model transitions and fallbacks. SGAEIA provides an architectural hypothesis for separating transcript, state, and assurance; its effectiveness should be evaluated empirically against reproducible baselines and threat scenarios.

Aptitude (A⁹⁰); Best-case performance—the 90th percentile—of a model on an instruction over repeated simulations [10].

Attention (self-attention); Mechanism through which each position weighs all other positions, with an O(n²·d) computational cost per layer [1].

Blast radius; Extent of the possible damage when an authorized action fails or is abused.

Cedar; Open-source authorization language with formal analysis capabilities [12].

Chain of thought (CoT); Sequence of reasoning steps generated before the final answer [19].

Checkpoint; Persistent snapshot of an agent’s state that provides a basis for resumption, replay, and forking [31].

Circuit breaker; Mechanism that interrupts an execution flow when a defined risk threshold is exceeded.

CONCAT; Experimental condition in which an instruction’s fragments are concatenated and presented in a single turn [10].

Context / context window; Maximum quantity of tokens that a model can process within a single inference call.

Drift; Progressive deviation that may be semantic, behavioral, or epistemic, including accumulated errors across turns.

Event sourcing; Practice of persisting every state transition as an append-only event, enabling later state reconstruction.

Evidence-as-Code; Compliance and assurance evidence generated, structured, and verified as code; a central SGAEIA concept.

Fork; New execution branch created from a checkpoint with a modified state [31].

FSM / DAG; Finite-state machine or directed acyclic graph used to represent and control agent execution flows.

FULL; Single-turn experimental condition in which the complete instruction is supplied at once [10].

Guardrail; Programmable control layer that filters, validates, or restricts system inputs, outputs, and actions.

Hallucination cascade; Propagation of an incorrect premise accepted in one turn into subsequent turns and decisions.

HITL (human-in-the-loop); Explicit human approval, review, or supervision before a critical action is executed.

Indirect prompt injection; Malicious instructions embedded in retrieved or external data that a model interprets as commands [3].

Jailbreak; Technique intended to induce a model to circumvent or violate its governing policies.

KV cache; Previously computed attention keys and values reused during token generation.

Lost in the Middle; Performance degradation that occurs when relevant information is positioned in the middle of a long context [5].

MCP (Model Context Protocol); Open protocol for connecting AI assistants and agents to tools, systems, and data sources [21].

Multi-turn; Interaction composed of a sequence of messages in which each response may depend on previous inputs, outputs, and accumulated state.

OPA / Rego; Policy-as-code engine and declarative language used to evaluate authorization and governance rules.

Prefill; Inference phase in which the model processes the input prompt before generating output tokens.

Prompt cache; Reuse of an already processed prompt prefix, commonly billed at a reduced cache-read price [20].

RAG; Retrieval-augmented generation, in which external documents are retrieved and incorporated into the model’s context.

Reasoning effort; Parameter that controls the amount of inference-time reasoning performed before an answer is produced.

Reasoning tokens; Internal reasoning or thinking tokens generated before the final answer and commonly billed as output.

RLHF; Reinforcement learning from human feedback, used to align model behavior with human preferences [2].

SHARDED; Multi-turn experimental condition in which one fragment of an instruction is disclosed per turn [10].

Sliding window; Context-management strategy that retains only the most recent N interactions.

SNOWBALL / RECAP; Strategies that repeat accumulated requirements at every turn or restate them at the end of the interaction [10].

Stateless / stateful; Distinction between a system that preserves no operational state across calls and one that retains or reconstructs state.

Test-time compute; Computation expended during inference, including the generation of reasoning tokens [19].

Time-travel debugging; Reconstruction, replay, and forking of executions from previously recorded checkpoints.

Token; Unit of text processed by a language model and commonly used as the basis for usage billing.

TTFT; Time to First Token—the interval between submitting a request and receiving the first generated token.

Turn; One message attributed to a conversational role, such as user, assistant, system, or tool.

Unbounded Consumption; Risk of uncontrolled inference, resource usage, or financial cost, corresponding to OWASP LLM10 [16].

Unreliability (U); Difference between the 90th and 10th percentiles of observed model performance [10].

Zero Trust; Security principle under which no entity, request, state transition, or delegated authority is trusted implicitly.

Bibliographic verification policy. Each reference was checked for authorship, date, identifier and venue during the research stage (30 Oct. to 1 Nov. 2026). Legend: ✔ verified against a primary source; ◐ partly verified or via a secondary source; ○ awaiting confirmation against a primary source (supplied by the author or drawn from a preliminary record). ◐ and ○ items must not be treated as validated. Accessed: 1 Nov. 2026.

[1] VASWANI, A.; SHAZEER, N.; PARMAR, N.; USZKOREIT, J.; JONES, L.; GOMEZ, A. N.; KAISER, Ł.; POLOSUKHIN, I. Attention is all you need. In: ADVANCES IN NEURAL INFORMATION PROCESSING SYSTEMS 30 (NeurIPS 2017), 2017, p. 5998–6008. arXiv:1706.03762, 12 Jun. 2017. DOI 10.48550/arXiv.1706.03762. ✔

[2] OUYANG, L. et al. Training language models to follow instructions with human feedback. arXiv:2203.02155, 4 Mar. 2022. ✔ (preprint; publication at NeurIPS 2022 not confirmed)

[3] GRESHAKE, K.; ABDELNABI, S.; MISHRA, S.; ENDRES, C.; HOLZ, T.; FRITZ, M. Not what you've signed up for: compromising real-world LLM-integrated applications with indirect prompt injection. arXiv:2302.12173, 23 Feb. 2023 (v2, 5 May 2023). ✔ (poster at the ICML 2023 conversational-AI workshop; publication at AISec'23 not confirmed)

[4] ZHENG, L. et al. Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. In: ADVANCES IN NEURAL INFORMATION PROCESSING SYSTEMS 36 (NeurIPS 2023), p. 46595–46623. arXiv:2306.05685. ✔ (venue and pages checked via the reference list of [10])

[5] LIU, N. F.; LIN, K.; HEWITT, J.; PARANJAPE, A.; BEVILACQUA, M.; PETRONI, F.; LIANG, P. Lost in the middle: how language models use long contexts. Transactions of the Association for Computational Linguistics, v. 12, p. 157–173, 2024. DOI 10.1162/tacl_a_00638. arXiv:2307.03172 (6 Jul. 2023). ✔

[6] PACKER, C.; FANG, V.; PATIL, S. G.; LIN, K.; WOODERS, S.; GONZALEZ, J. E. MemGPT: towards LLMs as operating systems. arXiv:2310.08560, 12 Oct. 2023 (v2, 12 Feb. 2024). ✔

[7] BAI, G. et al. MT-Bench-101: a fine-grained benchmark for evaluating large language models in multi-turn dialogues. In: ANNUAL MEETING OF THE ACL, 62., 2024, Bangkok. Proceedings… v. 1, p. 7421–7454. DOI 10.18653/v1/2024.acl-long.401. ✔

[8] RUSSINOVICH, M.; SALEM, A.; ELDAN, R. Great, now write an article about that: the Crescendo multi-turn LLM jailbreak attack. In: USENIX SECURITY SYMPOSIUM, 34., 2025, Seattle. Proceedings… p. 2421–2440. arXiv:2404.01833. ✔

[9] BULLWINKEL, B. et al. A representation engineering perspective on the effectiveness of multi-turn jailbreaks. In: ICML 2025 WORKSHOP DIG-BUGS, 2025. Poster. ✔

[10] LABAN, P.; HAYASHI, H.; ZHOU, Y.; NEVILLE, J. LLMs get lost in multi-turn conversation. International Conference on Learning Representations (ICLR), 2026. Outstanding Paper. Initial version: arXiv:2505.06120. ✔

[11] GUO, D. et al. DeepSeek-R1: incentivizing reasoning capability in LLMs via reinforcement learning. arXiv:2501.12948, 2025. ◐ (identifier confirmed indirectly through the reference list of [10])

[12] CUTLER, J. W.; DISSELKOEN, C.; ELINE, A.; HE, S.; HEADLEY, K.; HICKS, M.; HIETALA, K.; IOANNIDIS, E.; KASTNER, J.; MAMAT, A.; MCADAMS, D.; MCCUTCHEN, M.; RUNGTA, N.; TORLAK, E.; WELLS, A. M. Cedar: a new language for expressive, fast, safe, and analyzable authorization. Proceedings of the ACM on Programming Languages, v. 8, n. OOPSLA1, 2024. DOI 10.1145/3649835. arXiv:2403.04651. ✔

[13] NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Gaithersburg: NIST, Jan. 2023. DOI 10.6028/NIST.AI.100-1. ◐ (identifier and date confirmed via copies of the document and secondary sources)

[14] EUROPEAN UNION. Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union, L, 12.7.2024. ◐ (content of Arts. 12 and 14 checked against accessible copies of the text)

[15] EUROPEAN UNION. Regulation (EU) 2026/1744 ("Digital Omnibus on AI"). Official Journal of the European Union, L, 24.7.2026; in force 27.7.2026. ◐ (checked against seven consistent secondary sources)

[16] OWASP GENAI SECURITY PROJECT. OWASP Top 10 for LLM Applications 2025 (v2.0). 18 Nov. 2024. CC BY-SA 4.0 license. Available at: https://genai.owasp.org/. ✔

[17] GOOGLE. Introducing Google's Secure AI Framework. Jun. 2023. Available at: https://blog.google/technology/safety-security/introducing-googles-secure-ai-framework/. ✔

[18] OPENAI. Introducing ChatGPT. 30 Nov. 2022. Available at: https://openai.com/index/chatgpt/. ✔

[19] OPENAI. Learning to reason with LLMs. 12 Sep. 2024. Available at: https://openai.com/index/learning-to-reason-with-llms/. ✔

[20] ANTHROPIC. Prompt caching with Claude. Aug. 2024 (generally available 17 Dec. 2024). Available at: https://www.anthropic.com/news/prompt-caching. ✔ (the claude.com page shows "14 Aug. 2025", at odds with 2024 coverage)

[21] ANTHROPIC. Introducing the Model Context Protocol. 25 Nov. 2024. Available at: https://www.anthropic.com/news/model-context-protocol. ✔

[22] GOOGLE. Our next-generation model: Gemini 1.5. 15 Feb. 2024. Available at: https://blog.google/technology/ai/google-gemini-next-generation-model-february-2024; and What is a long context window?, at https://blog.google/technology/ai/long-context-window-ai-models/. ✔

[23] ANTHROPIC. Pricing. Claude Platform Docs. Available at: https://platform.claude.com/docs/en/about-claude/pricing. ✔ (Oct.–Nov. 2026 snapshot)

[24] ANTHROPIC. Steering thinking; Effort. Claude Platform Docs. Available at: https://platform.claude.com/docs/en/build-with-claude/thinking-steering-and-cost. ✔

[25] OPENAI. Models; Pricing; Reasoning models. OpenAI API Docs. Available at: https://developers.openai.com/api/docs/models. ✔

[26] GOOGLE. Gemini Developer API pricing. Available at: https://ai.google.dev/gemini-api/docs/pricing. ✔

[27] GOOGLE. Gemini thinking. Available at: https://ai.google.dev/gemini-api/docs/thinking. ✔

[28] XAI. Models; Pricing; Reasoning. xAI Docs. Available at: https://docs.x.ai/developers/models. ✔

[29] DEEPSEEK. Models & Pricing. DeepSeek API Docs. Available at: https://api-docs.deepseek.com/quick_start/pricing/. ✔

[30] ANTHROPIC. Using the Messages API. Claude Platform Docs. Available at: https://platform.claude.com/docs/en/build-with-claude/working-with-messages. ✔

[31] LANGCHAIN. LangGraph: persistence; use time-travel. Available at: https://docs.langchain.com/oss/python/langgraph/persistence and https://docs.langchain.com/oss/python/langgraph/use-time-travel. ✔

[32] PYDANTIC. Migration guide (Pydantic V2). Available at: https://docs.pydantic.dev/. ✔

[33] ANTHROPIC. Claude está fornecendo respostas incorretas ou enganosas. O que está acontecendo? (Claude is giving incorrect or misleading answers. What is happening?) Anthropic Help Center, 5 Mar. 2026. Available at: https://support.claude.com/pt/articles/8525154. ✔

[34] Silva, Aridio (2026). SGAEIA: Secure Governed Autonomous Edge Intelligence Architecture (Version 0.3.4). Zenodo, 2026. DOI 10.5281/zenodo.22557796. Public frozen artifact under Apache-2.0; ongoing development maintained in a controlled private repository. ✔

[35] Silva, Aridio (2026). Articles on DEV Community (https://dev.to/aridiosilva): From Edge AI to Governed Autonomous Edge Intelligence (1 Oct. 2026); The Open Letter on AI and Cybersecurity and the Evidence for Agent Containment (16 Oct. 2026); Opening the Black Box of LLM Inference: Foundations of Generative AI (21 Oct. 2026). Related reading: How to Reduce the Cost of AI Systems with LLMs Without Sacrificing Quality (28 Oct. 2026) and LLM Routers for AI Systems: Architecture, Governance, Multi-Agent Systems, Swarms, and Security (29 Oct. 2026). ◐ (existence, titles and dates confirmed on the public profile)

[36] Silva, Aridio (2026). Technical compendium: in-depth analysis of LLMs, state management, runtime governance and the SGAEIA framework. .docx document, 1 Nov. 2026 (source material incorporated into Sections 2, 7 and 8).

[37] P. Laban, H. Hayashi, Y. Zhou, and J. Neville, “LLMs Get Lost in Multi-Turn Conversation,” International Conference on Learning Representations (ICLR), 2026. Available: https://proceedings.iclr.cc/paper_files/paper/2026/hash/59f6421e64707225fdf5b28840679a07-Abstract-Conference.html

[38] ICLR, “Announcing the ICLR 2026 Outstanding Papers,” 23 Apr. 2026. Available: https://blog.iclr.cc/2026/04/23/announcing-the-iclr-2026-outstanding-papers/

[39] W.-C. Kwan et al., “MT-Eval: A Multi-Turn Capabilities Evaluation Benchmark for Large Language Models,” Proceedings of EMNLP, pp. 20153–20177, 2024. Available: https://aclanthology.org/2024.emnlp-main.1124/

[40] K. Deshpande et al., “MultiChallenge: A Realistic Multi-Turn Conversation Evaluation Benchmark Challenging to Frontier LLMs,” Findings of ACL, pp. 18632–18702, 2025. doi:10.18653/v1/2025.findings-acl.958.

[41] “StructFlowBench: A Structured Flow Benchmark for Multi-turn Instruction Following,” Findings of ACL, pp. 9322–9341, 2025. doi:10.18653/v1/2025.findings-acl.486.

[42] Y. Katsis et al., “mt RAG: A Multi-Turn Conversational Benchmark for Evaluating Retrieval-Augmented Generation Systems,” Transactions of the Association for Computational Linguistics, 2025. Available: https://aclanthology.org/2025.tacl-1.36/

[43] C. Yang et al., “MARS-Bench: A Multi-turn Athletic Real-world Scenario Benchmark for Dialogue Evaluation,” Findings of EMNLP, pp. 5872–5898, 2025. doi:10.18653/v1/2025.findings-emnlp.314.

[44] “One Battle After Another: Probing LLMs' Limits on Multi-Turn Instruction Following with a Benchmark Evolving Framework,” Proceedings of ACL, 2026. Available: https://aclanthology.org/2026.acl-long.433/

[45] J. Chen et al., “KnowMT-Bench: Benchmarking Knowledge-Intensive Long-Form Question Answering in Multi-Turn Dialogues,” Findings of EMNLP, 2026. Available: https://aclanthology.org/2026.findings-emnlp.845/

[46] J. Myung, “Quantifying Conversational Reliability of Large Language Models under Multi-Turn Interaction,” arXiv:2603.01423, 2026. Preprint.

[47] R. Khraishi, I. Zafar, K. Myles, and G. A. Cowan, “Evaluating Performance Drift from Model Switching in Multi-Turn LLM Systems,” arXiv:2603.03111, 2026. Preprint.

[48] S. T. Luo, W. Liu, R. Liu, M. Gong, and J. Guo, “Multi-Turn Reasoning When Context Arrives in Pieces: Scalable Sharding and Memory-Augmented RL,” arXiv:2606.12941, 2026. Preprint.

[49] Silva, Aridio (2026), “LLM Routers for AI Systems: Architecture, Governance, Multi-Agent Systems, Swarms, and Security,” SGAEIA Research Series, Article 24, 2026. DOI: 10.5281/zenodo.23763978. Available: https://aridiosilva.com/publications/artigo24/

[50] Silva, Aridio (2026), “From Model Capability to Governed Action: An Architecture for Secure Agentic AI,” SGAEIA Research Series, Article 11, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[51] Silva, Aridio (2026), “Zero Trust for Multi-Agent AI Systems,” SGAEIA Research Series, Article 3, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[52] Silva, Aridio (2026), “Evidence-as-Code: Making AI Governance Verifiable,” SGAEIA Research Series, Article 6, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[53] Silva, Aridio (2026), “AI Jailbreaks: From Bypassing Restrictions to Governing Authority,” SGAEIA Research Series, Article 17, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[54] Silva, Aridio (2026), “Tracing AI Agent Execution: Foundations, State of the Art, and Implications for Distributed Multi-Agent Systems,” SGAEIA Research Series, Article 18, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[55] Silva, Aridio (2026), “When AI Agents Form Societies: Is Security a Property of the Model or the System?,” SGAEIA Research Series, Article 15, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

[56] Silva, Aridio (2026), “How to Reduce the Cost of AI Systems with LLMs Without Sacrificing Quality,” SGAEIA Research Series, Article 23, 2026. Series catalogue: https://aridiosilva.com/sgaeia.html.

Aridio Silva is an independent researcher based in Brazil working on the architecture, security, governance, and trustworthiness of autonomous and distributed artificial intelligence systems.

His research focuses on Agentic AI, Multi-Agent Systems, Edge AI, AI Security, Zero Trust, Security-by-Design, AI Governance, Spec-Driven Development, and continuous security assurance.

He is the creator and lead researcher of SGAEIA — Secure Governed Autonomous Edge Intelligence Architecture, an open research initiative investigating architectural foundations for secure, governed, auditable, and trustworthy autonomous AI systems operating across distributed edge-cloud environments.

The cover is unnumbered. Figures, equations, and tables are numbered by type, cited in the text, and supplied as high-resolution JPEG files. Original conceptual assets remain licensed under CC BY 4.0 and carry visible and embedded authorship and copyright information.

Except where otherwise noted, the text and original conceptual illustrations in this article are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

This work is SGAEIA Research Series — Article 25. The public series catalogue is available at https://aridiosilva.com, with the project presence at https://aridiosilva.com/sgaeia.html.

Persistent record for Article 25: https://doi.org/10.5281/zenodo.23867630. Canonical SGAEIA project artifact: https://doi.org/10.5281/zenodo.22557796.

SILVA, Aridio. Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models (LLMs): State, Cost, Reliability, Security, and Governance. SGAEIA Research Series, Article 25, 2026. DOI: https://doi.org/10.5281/zenodo.23867630.

source & further reading

dev.to — original article Six checks that catch a bad AI portrait before anyone else sees it I kept losing my Claude Code sessions, so I wrote ccctl Unlocking the Cloudflare app ecosystem with OAuth for all

Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models: State, cost, reliability, security, and governance

Run your AI side-project on zahid.host