Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models: State, cost, reliability, security, and governance Independent researcher Aridio Silva published a critical narrative review examining how multi-turn LLM interactions differ from single-turn ones across state, cost, reliability, security, and governance. The review argues that models hold no intrinsic conversational memory across independent inferences, so continuity is reconstructed by clients or provider-managed state services, and that fully replaying a growing history makes logical input tokens grow quadratically with call count, though caching, truncation, compaction, and external memory alter billed cost and latency. Silva also reports that benchmark evidence shows no single "multi-turn" condition, with requirement fragmentation, cross-turn dependencies, intent shifts, and reliance on prior model outputs producing distinct failure modes, and that accumulated history in agentic systems widens gradual attacks, persistence of malicious content, and error propagation. SGAEIA Research Series — Article 25 Aridio Silva — Independent Researcher, Brazil ORCID: 0009-0008-2411-6995 DOI: 10.5281/zenodo.23867630 License: CC BY 4.0 This article examines how moving from a single-turn interaction to a multi-turn trajectory changes the state, cost, reliability, security, and governance of systems built on large language models. The analysis is a critical narrative review supported by scientific papers, official provider documentation, standards, security taxonomies, and explicitly identified original calculations. A model has no intrinsic conversational memory across independent inferences; continuity is reconstructed by the client or through provider-managed state services. When an application fully replays a history that grows at an approximately constant rate, the logical sum of input tokens grows quadratically with the number of calls, although caching, truncation, compaction, and external memory change billed cost, latency, and effective computation. Benchmark evidence shows that requirement fragmentation, cross-turn dependencies, intent shifts, information retrieval, and reliance on previous model outputs create different failure modes; there is no single “multi-turn” condition. Evidence on explicit reasoning and memory techniques is mixed and task- and protocol-dependent. In agentic systems, accumulated history also expands gradual attacks, persistence of malicious content, error propagation, and unbounded consumption. The article relates these findings to governed routing and SGAEIA, arguing for a separation between transcript, operational state, and assurance evidence. This relationship is an architectural interpretation and validation agenda, not empirical proof of the framework. Keywords: LLM; single-turn; multi-turn; conversational state; LLM routing; prompt caching; reliability; security; runtime governance; SGAEIA. Definitions. A message is a unit attributed to a role such as user, assistant, system, or tool. An inference call is one execution of the model that receives a representation of state and produces an output. An interaction round is, in this article, the cycle formed by a new user input and the corresponding system response, possibly including internal tool calls. In the cost equations, T denotes the number of principal calls or rounds as stated; when a benchmark uses a different convention, it is declared explicitly. Research question. How does the choice between single-turn and multi-turn affect a state mechanics, b token and credit cost, c performance and reliability, and d security and governance in frontier LLMs? Method and source policy. Primary sources are preferred: papers arXiv, proceedings , official provider documentation and blogs, standards and legislation. Secondary sources are used only when flagged. Every reference was checked for authorship, date, identifier and venue; the audit result is in Section 12 Bibliography , with unverified items marked as such. Prices and reasoning levels are a snapshot of Oct./Nov. 2026 taken from official pages, and change often. Limitations. No provider publishes performance for each model and each reasoning level separately for single-turn and multi-turn. The cost tables use explicit assumptions and are own calculations , not provider data. How to read. Each section ends with an analysis box. Equations are numbered images; figures carry text descriptions. A language model does not, by itself, preserve conversational memory across independent inferences. Continuity may be reconstructed by the client, which replays messages or derived state, or by a provider service that maintains items, identifiers, or server-side compaction. In either case, the current response depends on a selected representation of the past. That representation should be treated as manipulable input subject to truncation, summarization, error, access control, and audit, rather than as an automatically trustworthy record. Three practical consequences: Figure 1. Single turn one call, no state and multiple turns history resent and growing . Author's diagram. In single-turn use the interaction is limited to one request and one answer, and the model has no inherent memory of earlier interactions. Architectural limits: no iterative refinement any adjustment means rewriting the prompt and unfitness for tasks needing step-by-step planning, iterative debugging or design-space exploration. In multi-turn use, the accumulated history user, assistant and optionally tool calls is reprocessed or managed at each interaction. In long sessions, three strategies avoid saturating the window and degrading attention: A related line of research treats the context window as an operating system's main memory. MemGPT 6 proposes virtual context management : the main context instructions, working context and a FIFO queue is complemented by external storage, with paging driven by function calls. In Transformers 1 , attention costs O n²·d per layer Equation 1 . Quadratic growth is polynomial, not exponential. Two layers must be distinguished: Equation 1. Scaled dot-product attention and complexity per layer, after Vaswani et al. 1 . Equation 2. Input at turn t, where S is the system prompt, u the user tokens per turn, a the visible assistant tokens, r the reasoning tokens and κ = 1 if reasoning is kept in the history κ = 0 otherwise . Equation 3. Cumulative input over T turns: quadratic in T. Table 1 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Table 2 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Recent LLM evolution can be read along seven dimensions that influence each other. Figure 2 shows only milestones whose date was checked against a primary source Section 12 ; unverified milestones were left out on purpose. Figure 2. Multidimensional timeline architecture and context; alignment and dialogue; inference-time reasoning; memory and agents; cost and infrastructure; multi-turn evaluation; security and governance . Author's work based on sources 1 – 22 . The Transformer 1 , published in June 2017, replaced recurrence with attention and made training parallelizable. Models were trained with small windows, between 512 and 2,048 tokens 5 , and used through prompting : a text or a few examples were given and the model completed it 2 . This is, in essence, a single-turn regime. InstructGPT 2 //Mar.%202022 showed that fine-tuning with human feedback RLHF makes a model preferable, on user instructions, to a GPT-3 more than a hundred times larger. On 30 November 2022 OpenAI launched ChatGPT, whose dialogue format lets it answer follow-up questions, admit mistakes and challenge incorrect premises 18 . Here multi-turn stops being a research topic and becomes a product format . Three patterns stand out. 1 Each capability advance long context, reasoning was followed by cost advances caching and evaluation advances, but multi-turn evaluation arrived after the product. 2 Security followed the conversation: risk moved from the isolated prompt to the history and to retrieved data. 3 Governance moved from principles to runtime controls, the subject of Sections 7 and 8. Table 3 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 MT-Bench 4 evaluated two-turn conversations for example, ask for a text and then ask for it to be re-explained to a child ; MT-Bench-101 7 expanded to 4,208 turns across 1,388 dialogues and 13 tasks, organized into perception, adaptability and interactivity, and observed that usual alignment techniques and chat-specific designs gave no clear gains in multi-turn abilities. These benchmarks are generally episodic : each turn brings a subtask that can be scored in isolation. Laban et al. 10 https://dev.toMicrosoft%20Research%20and%20Salesforce%20Research compare single-turn and multi-turn on the same tasks . The sharding method splits each instruction into pieces, and the simulated user reveals at most one per turn. Three main conditions: FULL full instruction in one turn , CONCAT shards concatenated in one turn and SHARDED one shard per turn . Figure 3. Mean performance P 0 to 100 in the three conditions, per 10 . Bars: 90 FULL , 85.6 CONCAT = 95.1% of FULL and 65 SHARDED . Author's chart. Metrics. For each instruction, with N simulations and scores S: Equation 4. Mean performance P , aptitude A⁹⁰, the best-case performance and unreliability U, the gap between the 90th and 10th percentiles 10 . Results v1, 9 May 2025 . 15 LLMs from eight families, six tasks code, database, actions/APIs, math, data-to-text and summarization , over 200 thousand simulated conversations. Mean of 90% in single-turn against 65% in multi-turn; a 39% drop in the abstract and text; aptitude −16% and unreliability +112%. Degradation appears already with two turns. CONCAT reaches 95.1% of FULL, so the loss does not come from rephrasing. The two reasoning models tested o3 and DeepSeek-R1 deteriorate similarly and produce answers 33% longer on average, with more assumptions. Qualitative causes: premature final-answer attempts; answer "bloat" final answers 20 to 300% longer ; loss in middle turns ; and verbosity. Temperature zero does not fix it: with temperature 0 on both sides about 30 points of unreliability remain. Mitigations: repeating requirements every turn SNOWBALL recovers 15 to 20% of the drop; a final RECAP is better but unrealistic. Study limitations noted by the authors : automated simulation, analytical tasks, English and text only. The authors consider that real-world degradation is likely larger than measured. Recommendations: retry in a fresh conversation and consolidate requirements into a single prompt. Liu et al. 5 showed a U-shaped curve: performance is higher when relevant information is at the start or end of the context and drops when it is in the middle, and it decreases as context grows, even in long-context models. Laban et al. observed an analogue across turns loss-in-middle-turns . LLMs Get Lost in Multi-Turn Conversation is not isolated evidence. The final paper was published at ICLR 2026 and received an Outstanding Paper distinction 37 , 38 . Its principal result—an average 39% drop when requirements for the same task are disclosed gradually—should be interpreted within its sharded-simulation design: analytical tasks, simulated conversations, English-only text, and models from a specific time window. Other benchmarks measure partly different failure modes. MT-Eval organizes interactions into recollection, expansion, refinement, and follow-up 39 . MultiChallenge , published in Findings of ACL 2025 , evaluates four realistic challenges that jointly require instruction following, context allocation, and in-context reasoning; every evaluated model scored below 50% accuracy, with a best average of 41.4% 40 . StructFlowBench models six structural relationships between turns and identifies difficulty in understanding conversational flow 41 . mtRAG , published in TACL, adds retrieval through 110 human-generated conversations averaging 7.7 turns and totaling 842 tasks 42 . Evidence about explicit reasoning is mixed. In Laban et al.'s design, the two reasoning models tested did not eliminate degradation and generated longer answers. In contrast, MARS-Bench reports that explicit reasoning improves robustness in long conversations involving intent shifts and cross-turn dependencies 43 . The defensible conclusion is not that “more reasoning does not work,” but that its effect depends on the task, protocol, memory management, and metric. Taken together, these studies show that “multi-turn” is not a single condition. At least five mechanisms should be separated: 1 requirements disclosed in fragments; 2 structural dependencies between turns; 3 distraction and intent shifts; 4 retrieval of external evidence; and 5 dependence on the model's own previous answers. A mitigation that helps one—such as recap, compact memory, or explicit reasoning—may fail or increase cost in another. The results strengthen the case for representing task state separately from the transcript. Confirmed requirements, validated facts, revoked decisions, permissions, and tool results should not depend only on their position in textual history. A governance architecture can maintain typed contracts, provenance, and deterministic policies while using conversation as the interface. This relationship is the author's interpretation and an SGAEIA architectural hypothesis , not an empirical validation of the framework. Its effectiveness should be tested against baselines such as full replay, sliding windows, rolling summaries, and retrieved memory. To fix intuition and not as an empirical result , suppose that at each turn there is a probability ε that the model introduces a wrong premise that the user accepts hallucination cascade . The probability that a T-turn conversation has no accumulated error is given by Equation 6. With ε = 5% and T = 20, about 36% remains. Equation 6. Didactic compound-error model; ε and T are hypothetical parameters. Table 4 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Billing has three components: input tokens, output tokens including reasoning tokens, billed as output and the cache read of repeated input. In multi-turn use almost all resent history is read from cache, so the cache-read price differentiates providers more than the input price. Equation 5. Cost of a T-turn conversation with cache: p w write , p c cache read , p o output , in USD per million tokens; N new is the new part of the input at each turn. Table 5 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Availability of each level varies by model; Anthropic points to the effort page as the reference 24 . Sources: 24 – 29 . Names and levels change often; confirm on the official pages. reasoning.context parameter selects the behavior all turns is supported by GPT-5.6 and GPT-6.1 Sol . A configuration update item changes effort between responses without altering the prefix, preserving the cache. Table 6 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Provider caveats: Haiku 5.5 costs more above 100k tokens; Gemini 4 Argon doubles in price from 1 Dec. 2026 and offers only implicit caching; grok-4.7 doubles above 200k tokens; DeepSeek charges half off-peak; and Claude models from 4.7 on use a tokenizer that produces about 30% more tokens for the same text, so per-token prices are not comparable 1:1 across providers 23 . Sources: 23 , 25 , 26 , 28 , 29 . Assumptions: S = 2,000, u = 300, a = 700 tokens; reasoning r = 1,000 low effort or 8,000 high ; the cache always hits; for this simplified scenario, cache writes carry no surcharge. This assumption is not universal: providers may price writes, TTLs, or cache modes separately. By Equation 3, cumulative input over 20 turns is 236 thousand tokens 21.3k new and 214.7k read from cache with reasoning dropped; if 8,000 tokens of reasoning were kept in the history, input would rise to 1.756 million 7.4 times , with 173.3k input tokens at the 20th turn. Figure 4. Left, input tokens per turn in three scenarios; right, illustrative 20-turn cost per model, with cache. Author's calculation on official prices. Table 7 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Readings. With cache, output mainly reasoning dominates: going from low to high effort multiplies cost by 3.4 to 4.5 times. Caching cuts input cost by about 86% in the example models with cache reads at 5% of input , and Anthropic's documentation 20 reports gains of the same order −53% cost and −75% latency over 10 turns . On cost security, OWASP lists Unbounded Consumption LLM10:2025 as a risk: uncontrolled inference consumption becomes a cost attack 16 . Table 8 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 From a security and governance standpoint, multi-turn use changes the system's risk profile. This section gathers the scientific evidence and the risks described in the compendium. The OWASP Top 10 for LLM Applications 2025 edition, 18 Nov. 2024 keeps prompt injection in first place LLM01 and includes Excessive Agency LLM06 , Misinformation LLM09 and Unbounded Consumption LLM10 16 . Google's SAIF 17 is a conceptual framework of six elements that lists, among AI-specific risks, model theft, data poisoning, prompt injection and data extraction. Table 9 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 This section incorporates, in full, the content of the author's technical compendium 36 https://dev.toSections%202%20to%204%20of%20the%20original , as a technical basis for this analysis. Agent systems based on execution graphs can represent state as a typed, immutable, event-persisted object , not as the coupled history of a chat. Figure 5. Transactional transition cycle: command, validation, drift check, immutable commit and checkpoint, with failure branches, circuit breaker and time-travel. Author's diagram based on the compendium. Drift shows up in three forms: semantic loss of focus on the goal , behavioral deviation from safety and system guidelines and epistemic accumulation of hallucinations accepted as truth . A. Semantic and contextual drift B. Behavioral and alignment drift C. Epistemic drift cumulative error Implementation requires moving from malleable dictionaries to immutable, typed state contracts with transactional validation. The compendium's code follows, preserved as in the original. State structure with Pydantic python from enum import Enum from pydantic import BaseModel, Field, field validator from typing import List, Dict, Any, Optional from datetime import datetime class AgentRole str, Enum : RESEARCHER = "researcher" EXECUTOR = "executor" CRITIC = "critic" ROUTER = "router" class TaskStatus str, Enum : PENDING = "pending" IN PROGRESS = "progress" VALIDATED = "validated" REJECTED = "rejected" class GlobalState BaseModel : session id: str current step: int = Field ge=0, description="Contador estrito de turnos/transições" goal tree: Dict str, TaskStatus = Field default factory=dict execution log: List Dict str, Any = Field default factory=list risk score: float = Field default=0.0, ge=0.0, le=1.0 @field validator 'execution log' def validate log immutability cls, v : Garante que o log apenas cresce, nunca é reescrito de forma destrutiva return v class Config: frozen = True Imutabilidade estrutural requer cópia via model copy para atualizar The transactional transition cycle. 1 The agent produces a Command raw output . 2 The validator parses it into the corresponding Pydantic schema. 3 If successful, the State Manager generates a new immutable version of the state new state = state.model copy update=... and records the event in a transactional database. Resilient orchestrator php def orchestrate turn state: GlobalState, agent input: str - GlobalState: 1. Validação de pré-condições e estado validate circuit breaker state 2. Execução isolada do agente raw output = run agent safely agent input, state 3. Parse e Tipagem Estrita try: structured output = AgentPayload.model validate json raw output except ValidationError as e: return handle malformed output state, e 4. Checagem de Drift Semântico e de Risco risk = evaluate drift and risk state, structured output if risk 0.8: return trigger circuit breaker rollback state 5. Commit Transacional do Novo Estado new state = state.model copy update={ "current step": state.current step + 1, "execution log": state.execution log + structured output.dict , "risk score": risk } persist checkpoint new state return new state Code comments are kept in the original Portuguese. Minimal Pydantic v2-compatible variant python from pydantic import BaseModel, ConfigDict, Field class GlobalState BaseModel : model config = ConfigDict frozen=True shallow immutability session id: str current step: int = Field ge=0 goal tree: dict str, "TaskStatus" = Field default factory=dict execution log: tuple dict, ... = tuple: growth by new copy risk score: float = Field default=0.0, ge=0.0, le=1.0 commit: new state = state.model copy update={"execution log": state.execution log + payload.model dump , } Time-Travel Debugging is the mechanism of freezing, inspecting, rolling back and forking agent execution through continuous recording of immutable state snapshots. Operational limitation. In LangGraph's official documentation 31 , time travel has two operations: replay resume from an earlier checkpoint and fork branch with modified state ; checkpoints are saved at each super-step . But replay re-executes the nodes after the checkpoint: LLM and API calls fire again and may return different results . So debugging is only deterministic if LLM and tool outputs are recorded event sourcing of the responses and reused. The documentation does not mention restoring seeds . Table 10 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 This section incorporates Sections 5 to 7 of the compendium 36 , as a technical basis for this analysis. Statements about SGAEIA are the author's own original work and have not undergone independent evaluation. Strict-compliance architecture represents the shift from static governance to runtime enforcement engineering . The core principle: the LLM is never part of the critical authorization path trust path ; security comes from deterministic invariants. Figure 6. Application plane, governance and control plane, and infrastructure plane. Author's diagram based on the compendium. Fundamental layers Regulatory scope. Articles 12 record-keeping and 14 human oversight of Regulation EU 2024/1689 14 apply to high-risk systems. Append-only, tamper-evident records contribute to compliance but do not guarantee it in isolation. NIST AI RMF 1.0 is document NIST AI 100-1 13 . Action classification and human oversight matrix Table 11 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 SGAEIA Secure Governed Autonomous Edge Intelligence Architecture is an open, neutral reference architecture , conceived by Aridio Silva 34 , 35 , aimed at governance, security and runtime control of autonomous agents and distributed/edge AI . Core premise. In agentic environments, the object of assurance is the complete system in operation , not the isolated language model; governance is intrinsic to the execution infrastructure, not a static post-processing step. Figure 7. SGAEIA's twelve responsibility planes and seven cross-cutting invariants, per the compendium. The twelve planes: 1 agency and agent lifecycle; 2 cryptographic identity and attribution unique SPIFFE/X.509 per agent ; 3 delegation and authority scope strict subset ; 4 deterministic policy and enforcement policy-as-code : OPA/Cedar/WASM ; 5 inter-agent communication and bus; 6 state management and persistent memory immutable, versioned, auditable ; 7 tool integration and API mediation pre/in/post-action interception ; 8 containment, limits and isolation at the edge sandboxing , WASM, microVMs ; 9 observability, evidence and auditability Evidence-as-Code , append-only ; 10 resilience, rollback and recovery circuit breaking and time-travel rollback ; 11 human oversight and control interfaces HITL portals ; 12 continuous assurance and risk assessment monitoring of risk score and compliance . The seven cross-cutting invariants: Bounded Authority autonomy strictly limited to the current task ; Revocable Trust revocation with bounded, observable, and tested latency ; Zero-Trust Runtime Enforcement no transition is implicitly trusted ; Tamper-Evident Lineage cryptographically verifiable audit trail ; Deterministic Policy Mediation policy mediated outside the LLM decision path and not directly modifiable by conversational content ; Least-Privilege Delegation strict limits on context passing between agents ; Continuous Assurance continuous validation of compliance and risk mitigation . Relation to this study. Plane 6 state , 10 rollback and 12 continuous assurance directly address the multi-turn risks of Sections 4 to 7; Planes 3, 4 and 7 address injection and escalation risk Section 6 . Article 24 of the SGAEIA Research Series treated routing as a governed decision about models, data, resources, and trajectories 49 . This article develops the temporal unit of that decision. In a multi-turn interaction, the router does not receive only a new question: it receives a representation of the past, possibly summarized, retrieved, or reconstructed. If that representation omits a constraint, incorporates an error, or loses the chain of authority, selection may be technically efficient and still invalid. The admissible set of models and configurations may change during the conversation because of active identity, data classification, remaining budget, required tools, external effects already executed, and revoked or updated policies. The router should optimize only within that set. Fallback must not turn a safety refusal into an outage to bypass, or send data to a deployment that does not satisfy the same conditions. A model switch is also a state transition. Models differ in tokenization, tool use, structured formats, preservation of reasoning, interpretation of instructions, and operating policies. Substitution preserves the trajectory only when it retains mandatory constraints, required capabilities, applicable authority, and necessary evidence, or when any loss is detected and handled before execution. Table 12 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 This table is a conceptual model, not a completed normative SGAEIA specification. The central synthesis is: the transcript is a narrative interface; governed state is an operational artifact; the evidence trail is an assurance artifact . The three are related but should not be conflated. Table 13 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Anthropic's support article 5 Mar. 2026 33 acknowledges that Claude can produce incorrect or misleading answers "hallucination" , mentions outdated information and citations that sound authoritative without basis, and recommends not treating the model as a single source of truth and checking the sources in search results. Strengths: it admits that error can sound convincing and distinguishes model error from synthesis error over real sources. Limitations: it does not separate error types staleness, invention, reasoning, synthesis , does not quantify frequency, does not mention the multi-turn effect Section 4 and does not teach how to verify. For any reference: 1 open the DOI or identifier and check title, authors and year; 2 find the passage that supports the claim; 3 confirm the venue a preprint is not a published paper ; 4 flag what was not verified. Table 14 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Table 15 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Author's analytical inferences: 1 competitive advantage will probably shift from raw capability to reliability per cost ; 2 cache-read price will tend to weigh more than input price in product comparisons; 3 runtime governance will tend to become a procurement requirement in regulated environments as the 2027 dates approach. Table 16 from Article 25. © 2026 Aridio Silva · SGAEIA Research Series — Article 25 · CC BY 4.0 Moving from single-turn to multi-turn interaction is not merely an interface change. It turns history into operational state, expands cumulative cost, introduces dependencies between decisions, and creates distinct mechanisms of failure, persistence, and attack. Performance observed in an isolated call is therefore insufficient evidence of trajectory reliability. The evidence reviewed here shows that multi-turn degradation depends on the task, protocol, presentation of context, memory mechanism, and the model's reliance on its own prior outputs. Caching, compaction, summarization, retrieval, and model switching can reduce cost or extend capability, but they also change provenance, authority, and reproducibility conditions. For LLM routers and SGAEIA, the central consequence is that selection and governance must operate over explicit state and verifiable evidence. Constraints, permissions, revoked decisions, external effects, and remaining budget must survive model transitions and fallbacks. SGAEIA provides an architectural hypothesis for separating transcript, state, and assurance; its effectiveness should be evaluated empirically against reproducible baselines and threat scenarios. Aptitude A⁹⁰ ; Best-case performance—the 90th percentile—of a model on an instruction over repeated simulations 10 . Attention self-attention ; Mechanism through which each position weighs all other positions, with an O n²·d computational cost per layer 1 . Blast radius; Extent of the possible damage when an authorized action fails or is abused. Cedar; Open-source authorization language with formal analysis capabilities 12 . Chain of thought CoT ; Sequence of reasoning steps generated before the final answer 19 . Checkpoint; Persistent snapshot of an agent’s state that provides a basis for resumption, replay, and forking 31 . Circuit breaker; Mechanism that interrupts an execution flow when a defined risk threshold is exceeded. CONCAT; Experimental condition in which an instruction’s fragments are concatenated and presented in a single turn 10 . Context / context window; Maximum quantity of tokens that a model can process within a single inference call. Drift; Progressive deviation that may be semantic, behavioral, or epistemic, including accumulated errors across turns. Event sourcing; Practice of persisting every state transition as an append-only event, enabling later state reconstruction. Evidence-as-Code; Compliance and assurance evidence generated, structured, and verified as code; a central SGAEIA concept. Fork; New execution branch created from a checkpoint with a modified state 31 . FSM / DAG; Finite-state machine or directed acyclic graph used to represent and control agent execution flows. FULL; Single-turn experimental condition in which the complete instruction is supplied at once 10 . Guardrail; Programmable control layer that filters, validates, or restricts system inputs, outputs, and actions. Hallucination cascade; Propagation of an incorrect premise accepted in one turn into subsequent turns and decisions. HITL human-in-the-loop ; Explicit human approval, review, or supervision before a critical action is executed. Indirect prompt injection; Malicious instructions embedded in retrieved or external data that a model interprets as commands 3 . Jailbreak; Technique intended to induce a model to circumvent or violate its governing policies. KV cache; Previously computed attention keys and values reused during token generation. Lost in the Middle; Performance degradation that occurs when relevant information is positioned in the middle of a long context 5 . MCP Model Context Protocol ; Open protocol for connecting AI assistants and agents to tools, systems, and data sources 21 . Multi-turn; Interaction composed of a sequence of messages in which each response may depend on previous inputs, outputs, and accumulated state. OPA / Rego; Policy-as-code engine and declarative language used to evaluate authorization and governance rules. Prefill; Inference phase in which the model processes the input prompt before generating output tokens. Prompt cache; Reuse of an already processed prompt prefix, commonly billed at a reduced cache-read price 20 . RAG; Retrieval-augmented generation, in which external documents are retrieved and incorporated into the model’s context. Reasoning effort; Parameter that controls the amount of inference-time reasoning performed before an answer is produced. Reasoning tokens; Internal reasoning or thinking tokens generated before the final answer and commonly billed as output. RLHF; Reinforcement learning from human feedback, used to align model behavior with human preferences 2 . SHARDED; Multi-turn experimental condition in which one fragment of an instruction is disclosed per turn 10 . Sliding window; Context-management strategy that retains only the most recent N interactions. SNOWBALL / RECAP; Strategies that repeat accumulated requirements at every turn or restate them at the end of the interaction 10 . Stateless / stateful; Distinction between a system that preserves no operational state across calls and one that retains or reconstructs state. Test-time compute; Computation expended during inference, including the generation of reasoning tokens 19 . Time-travel debugging; Reconstruction, replay, and forking of executions from previously recorded checkpoints. Token; Unit of text processed by a language model and commonly used as the basis for usage billing. TTFT; Time to First Token—the interval between submitting a request and receiving the first generated token. Turn; One message attributed to a conversational role, such as user, assistant, system, or tool. Unbounded Consumption; Risk of uncontrolled inference, resource usage, or financial cost, corresponding to OWASP LLM10 16 . Unreliability U ; Difference between the 90th and 10th percentiles of observed model performance 10 . Zero Trust; Security principle under which no entity, request, state transition, or delegated authority is trusted implicitly. Bibliographic verification policy. Each reference was checked for authorship, date, identifier and venue during the research stage 30 Oct. to 1 Nov. 2026 . Legend: ✔ verified against a primary source; ◐ partly verified or via a secondary source; ○ awaiting confirmation against a primary source supplied by the author or drawn from a preliminary record . ◐ and ○ items must not be treated as validated . Accessed: 1 Nov. 2026. 1 VASWANI, A.; SHAZEER, N.; PARMAR, N.; USZKOREIT, J.; JONES, L.; GOMEZ, A. N.; KAISER, Ł.; POLOSUKHIN, I. Attention is all you need. In: ADVANCES IN NEURAL INFORMATION PROCESSING SYSTEMS 30 NeurIPS 2017 , 2017, p. 5998–6008. arXiv:1706.03762, 12 Jun. 2017. DOI 10.48550/arXiv.1706.03762. ✔ 2 OUYANG, L. et al. Training language models to follow instructions with human feedback. arXiv:2203.02155, 4 Mar. 2022. ✔ preprint; publication at NeurIPS 2022 not confirmed 3 GRESHAKE, K.; ABDELNABI, S.; MISHRA, S.; ENDRES, C.; HOLZ, T.; FRITZ, M. Not what you've signed up for: compromising real-world LLM-integrated applications with indirect prompt injection. arXiv:2302.12173, 23 Feb. 2023 v2, 5 May 2023 . ✔ poster at the ICML 2023 conversational-AI workshop; publication at AISec'23 not confirmed 4 ZHENG, L. et al. Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. In: ADVANCES IN NEURAL INFORMATION PROCESSING SYSTEMS 36 NeurIPS 2023 , p. 46595–46623. arXiv:2306.05685. ✔ venue and pages checked via the reference list of 10 5 LIU, N. F.; LIN, K.; HEWITT, J.; PARANJAPE, A.; BEVILACQUA, M.; PETRONI, F.; LIANG, P. Lost in the middle: how language models use long contexts. Transactions of the Association for Computational Linguistics , v. 12, p. 157–173, 2024. DOI 10.1162/tacl a 00638. arXiv:2307.03172 6 Jul. 2023 . ✔ 6 PACKER, C.; FANG, V.; PATIL, S. G.; LIN, K.; WOODERS, S.; GONZALEZ, J. E. MemGPT: towards LLMs as operating systems. arXiv:2310.08560, 12 Oct. 2023 v2, 12 Feb. 2024 . ✔ 7 BAI, G. et al. MT-Bench-101: a fine-grained benchmark for evaluating large language models in multi-turn dialogues. In: ANNUAL MEETING OF THE ACL, 62., 2024, Bangkok. Proceedings … v. 1, p. 7421–7454. DOI 10.18653/v1/2024.acl-long.401. ✔ 8 RUSSINOVICH, M.; SALEM, A.; ELDAN, R. Great, now write an article about that: the Crescendo multi-turn LLM jailbreak attack. In: USENIX SECURITY SYMPOSIUM, 34., 2025, Seattle. Proceedings … p. 2421–2440. arXiv:2404.01833. ✔ 9 BULLWINKEL, B. et al. A representation engineering perspective on the effectiveness of multi-turn jailbreaks. In: ICML 2025 WORKSHOP DIG-BUGS, 2025. Poster. ✔ 10 LABAN, P.; HAYASHI, H.; ZHOU, Y.; NEVILLE, J. LLMs get lost in multi-turn conversation. International Conference on Learning Representations ICLR , 2026. Outstanding Paper. Initial version: arXiv:2505.06120. ✔ 11 GUO, D. et al. DeepSeek-R1: incentivizing reasoning capability in LLMs via reinforcement learning. arXiv:2501.12948, 2025. ◐ identifier confirmed indirectly through the reference list of 10 12 CUTLER, J. W.; DISSELKOEN, C.; ELINE, A.; HE, S.; HEADLEY, K.; HICKS, M.; HIETALA, K.; IOANNIDIS, E.; KASTNER, J.; MAMAT, A.; MCADAMS, D.; MCCUTCHEN, M.; RUNGTA, N.; TORLAK, E.; WELLS, A. M. Cedar: a new language for expressive, fast, safe, and analyzable authorization. Proceedings of the ACM on Programming Languages , v. 8, n. OOPSLA1, 2024. DOI 10.1145/3649835. arXiv:2403.04651. ✔ 13 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY NIST . Artificial Intelligence Risk Management Framework AI RMF 1.0 . NIST AI 100-1. Gaithersburg: NIST, Jan. 2023. DOI 10.6028/NIST.AI.100-1. ◐ identifier and date confirmed via copies of the document and secondary sources 14 EUROPEAN UNION. Regulation EU 2024/1689 Artificial Intelligence Act . Official Journal of the European Union , L, 12.7.2024. ◐ content of Arts. 12 and 14 checked against accessible copies of the text 15 EUROPEAN UNION. Regulation EU 2026/1744 "Digital Omnibus on AI" . Official Journal of the European Union , L, 24.7.2026; in force 27.7.2026. ◐ checked against seven consistent secondary sources 16 OWASP GENAI SECURITY PROJECT. OWASP Top 10 for LLM Applications 2025 v2.0 . 18 Nov. 2024. CC BY-SA 4.0 license. Available at: https://genai.owasp.org/ https://genai.owasp.org/ . ✔ 17 GOOGLE. Introducing Google's Secure AI Framework. Jun. 2023. Available at: https://blog.google/technology/safety-security/introducing-googles-secure-ai-framework/ https://blog.google/technology/safety-security/introducing-googles-secure-ai-framework/ . ✔ 18 OPENAI. Introducing ChatGPT. 30 Nov. 2022. Available at: https://openai.com/index/chatgpt/ https://openai.com/index/chatgpt/ . ✔ 19 OPENAI. Learning to reason with LLMs. 12 Sep. 2024. Available at: https://openai.com/index/learning-to-reason-with-llms/ https://openai.com/index/learning-to-reason-with-llms/ . ✔ 20 ANTHROPIC. Prompt caching with Claude. Aug. 2024 generally available 17 Dec. 2024 . Available at: https://www.anthropic.com/news/prompt-caching https://www.anthropic.com/news/prompt-caching . ✔ the claude.com page shows "14 Aug. 2025", at odds with 2024 coverage 21 ANTHROPIC. Introducing the Model Context Protocol. 25 Nov. 2024. Available at: https://www.anthropic.com/news/model-context-protocol https://www.anthropic.com/news/model-context-protocol . ✔ 22 GOOGLE. Our next-generation model: Gemini 1.5. 15 Feb. 2024. Available at: https://blog.google/technology/ai/google-gemini-next-generation-model-february-2024 https://blog.google/technology/ai/google-gemini-next-generation-model-february-2024 ; and What is a long context window?, at https://blog.google/technology/ai/long-context-window-ai-models/ https://blog.google/technology/ai/long-context-window-ai-models/ . ✔ 23 ANTHROPIC. Pricing. Claude Platform Docs . Available at: https://platform.claude.com/docs/en/about-claude/pricing https://platform.claude.com/docs/en/about-claude/pricing . ✔ Oct.–Nov. 2026 snapshot 24 ANTHROPIC. Steering thinking; Effort. Claude Platform Docs . Available at: https://platform.claude.com/docs/en/build-with-claude/thinking-steering-and-cost https://platform.claude.com/docs/en/build-with-claude/thinking-steering-and-cost . ✔ 25 OPENAI. Models; Pricing; Reasoning models. OpenAI API Docs . Available at: https://developers.openai.com/api/docs/models https://developers.openai.com/api/docs/models . ✔ 26 GOOGLE. Gemini Developer API pricing. Available at: https://ai.google.dev/gemini-api/docs/pricing https://ai.google.dev/gemini-api/docs/pricing . ✔ 27 GOOGLE. Gemini thinking. Available at: https://ai.google.dev/gemini-api/docs/thinking https://ai.google.dev/gemini-api/docs/thinking . ✔ 28 XAI. Models; Pricing; Reasoning. xAI Docs . Available at: https://docs.x.ai/developers/models https://docs.x.ai/developers/models . ✔ 29 DEEPSEEK. Models & Pricing. DeepSeek API Docs . Available at: https://api-docs.deepseek.com/quick start/pricing/ https://api-docs.deepseek.com/quick start/pricing/ . ✔ 30 ANTHROPIC. Using the Messages API. Claude Platform Docs . Available at: https://platform.claude.com/docs/en/build-with-claude/working-with-messages https://platform.claude.com/docs/en/build-with-claude/working-with-messages . ✔ 31 LANGCHAIN. LangGraph: persistence; use time-travel. Available at: https://docs.langchain.com/oss/python/langgraph/persistence https://docs.langchain.com/oss/python/langgraph/persistence and https://docs.langchain.com/oss/python/langgraph/use-time-travel https://docs.langchain.com/oss/python/langgraph/use-time-travel . ✔ 32 PYDANTIC. Migration guide Pydantic V2 . Available at: https://docs.pydantic.dev/ https://docs.pydantic.dev/ . ✔ 33 ANTHROPIC. Claude está fornecendo respostas incorretas ou enganosas. O que está acontecendo? Claude is giving incorrect or misleading answers. What is happening? Anthropic Help Center , 5 Mar. 2026. Available at: https://support.claude.com/pt/articles/8525154 https://support.claude.com/pt/articles/8525154 . ✔ 34 Silva, Aridio 2026 . SGAEIA: Secure Governed Autonomous Edge Intelligence Architecture Version 0.3.4 . Zenodo, 2026. DOI 10.5281/zenodo.22557796. Public frozen artifact under Apache-2.0; ongoing development maintained in a controlled private repository. ✔ 35 Silva, Aridio 2026 . Articles on DEV Community https://dev.to/aridiosilva :