Conversational Complexity for Assessing Risk in Large Language Models
John Burden, Manuel Cebrian, Jose Hernandez-Orallo
TL;DR
Framing the dual-use risk of large language model conversations, the paper introduces two information-theoretic metrics, Conversational Length (CL) and Conversational Complexity (CC), to quantify the minimal effort required to elicit harmful outputs. It operationalizes Minimum Conversational Complexity (MCC) through LM-based probability estimates and, where possible, compression-based approximations, validating the framework on the Kevin Roose–Bing episode and a large Anthropic red-teaming dataset. The findings show that harmful interactions are typically longer and more complex, with CC correlating with harm and offering a practical signal for safety auditing, though substantial overlap with harmless cases remains. The work also discusses limitations and proposes a conservative universal risk bound to guide future LLM safety research.
Abstract
Large Language Models (LLMs) present a dual-use dilemma: they enable beneficial applications while harboring potential for harm, particularly through conversational interactions. Despite various safeguards, advanced LLMs remain vulnerable. A watershed case in early 2023 involved journalist Kevin Roose's extended dialogue with Bing, an LLM-powered search engine, which revealed harmful outputs after probing questions, highlighting vulnerabilities in the model's safeguards. This contrasts with simpler early jailbreaks, like the "Grandma Jailbreak," where users framed requests as innocent help for a grandmother, easily eliciting similar content. This raises the question: How much conversational effort is needed to elicit harmful information from LLMs? We propose two measures to quantify this effort: Conversational Length (CL), which measures the number of conversational turns needed to obtain a specific harmful response, and Conversational Complexity (CC), defined as the Kolmogorov complexity of the user's instruction sequence leading to the harmful response. To address the incomputability of Kolmogorov complexity, we approximate CC using a reference LLM to estimate the compressibility of the user instructions. Applying this approach to a large red-teaming dataset, we perform a quantitative analysis examining the statistical distribution of harmful and harmless conversational lengths and complexities. Our empirical findings suggest that this distributional analysis and the minimization of CC serve as valuable tools for understanding AI safety, offering insights into the accessibility of harmful information. This work establishes a foundation for a new perspective on LLM safety, centered around the algorithmic complexity of pathways to harm.