Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models

State, cost, reliability, security, and governance

SGAEIA Research Series — Article 25

Aridio Silva — Independent Researcher, Brazil

ORCID: 0009-0008-2411-6995

DOI: 10.5281/zenodo.23867630

License: CC BY 4.0

Abstract {-}

This article examines how moving from a single-turn interaction to a multi-turn trajectory changes the state, cost, reliability, security, and governance of systems built on large language models. The analysis is a critical narrative review supported by scientific papers, official provider documentation, standards, security taxonomies, and explicitly identified original calculations. A model has no intrinsic conversational memory across independent inferences; continuity is reconstructed by the client or through provider-managed state services. When an application fully replays a history that grows at an approximately constant rate, the logical sum of input tokens grows quadratically with the number of calls, although caching, truncation, compaction, and external memory change billed cost, latency, and effective computation.

Benchmark evidence shows that requirement fragmentation, cross-turn dependencies, intent shifts, information retrieval, and reliance on previous model outputs create different failure modes; there is no single “multi-turn” condition. Evidence on explicit reasoning and memory techniques is mixed and task- and protocol-dependent. In agentic systems, accumulated history also expands gradual attacks, persistence of malicious content, error propagation, and unbounded consumption. The article relates these findings to governed routing and SGAEIA, arguing for a separation between transcript, operational state, and assurance evidence. This relationship is an architectural interpretation and validation agenda, not empirical proof of the framework.

Keywords: LLM; single-turn; multi-turn; conversational state; LLM routing; prompt caching; reliability; security; runtime governance; SGAEIA.

1. Introduction, scope and method

Definitions. A message is a unit attributed to a role such as user, assistant, system, or tool. An inference call is one execution of the model that receives a representation of state and produces an output. An interaction round is, in this article, the cycle formed by a new user input and the corresponding system response, possibly including internal tool calls. In the cost equations, T denotes the number of principal calls or rounds as stated; when a benchmark uses a different convention, it is declared explicitly.

Research question. How does the choice between single-turn and multi-turn affect (a) state mechanics, (b) token and credit cost, (c) performance and reliability, and (d) security and governance in frontier LLMs?

Method and source policy. Primary sources are preferred: papers (arXiv, proceedings), official provider documentation and blogs, standards and legislation. Secondary sources are used only when flagged. Every reference was checked for authorship, date, identifier and venue; the audit result is in Section 12 (Bibliography), with unverified items marked as such. Prices and reasoning levels are a snapshot of Oct./Nov. 2026 taken from official pages, and change often.

Limitations. No provider publishes performance for each model and each reasoning level separately for single-turn and multi-turn. The cost tables use explicit assumptions and are own calculations, not provider data.

How to read. Each section ends with an analysis box. Equations are numbered images; figures carry text descriptions.

2. Foundations: turn, state and mechanics

2.1 The model has no intrinsic conversational memory

A language model does not, by itself, preserve conversational memory across independent inferences. Continuity may be reconstructed by the client, which replays messages or derived state, or by a provider service that maintains items, identifiers, or server-side compaction. In either case, the current response depends on a selected representation of the past. That representation should be treated as manipulable input subject to truncation, summarization, error, access control, and audit, rather than as an automatically trustworthy record. Three practical consequences:

Cost and latency grow with each turn because the history is reprocessed, and the conversation is bounded by the context window.
The client controls the "past". Earlier turns can be synthetic; for security, the history is a manipulable input surface, not a trustworthy record.
Multi-turn is not the same as long context. A single 100k-token prompt is long context in one turn; multi-turn is defined by incremental disclosure of information and dependence on the model's own earlier answers.

Figure 1. Single turn (one call, no state) and multiple turns (history resent and growing). Author's diagram.

2.2 Single turn: isolated efficiency

In single-turn use the interaction is limited to one request and one answer, and the model has no inherent memory of earlier interactions.

Isolation and relative determinism. Each call is an atomic event, which eases prompt unit testing, reproducibility and static input/output validation policies.
Low latency and cost. With no accumulated history, input tokens are minimal (prompt caching aside), reducing per-inference cost and Time to First Token.
Reduced persistence across calls. The absence of replayed history reduces persistence of malicious content across inferences, but does not eliminate indirect prompt injection in a single call containing untrusted pages, email, documents, or RAG results.

Architectural limits: no iterative refinement (any adjustment means rewriting the prompt) and unfitness for tasks needing step-by-step planning, iterative debugging or design-space exploration.

2.3 Multi-turn: state and context management

In multi-turn use, the accumulated history (user, assistant and optionally tool calls) is reprocessed or managed at each interaction. In long sessions, three strategies avoid saturating the window and degrading attention:

Sliding window. Keeps only the last N interactions; simple, but suffers "catastrophic amnesia" for long-range dependencies.
Dynamic summarization. A subsystem (or the LLM itself in the background) compresses old history into consolidated summaries.
External memory / conversational RAG. History and artifacts are stored in vector or relational stores and retrieved by semantic search according to the current turn's intent.

A related line of research treats the context window as an operating system's main memory. MemGPT [6] proposes virtual context management: the main context (instructions, working context and a FIFO queue) is complemented by external storage, with paging driven by function calls.

2.4 Complexity: what is quadratic and what is not

In Transformers [1], attention costs O(n²·d) per layer (Equation 1). Quadratic growth is polynomial, not exponential. Two layers must be distinguished:

Within a call, the prefill of the context has cost quadratic in input size, and each generated token attends to the cached keys at cost linear in the context.
Across the conversation, if each round adds an approximately constant number of tokens and the application fully replays history without truncation or compaction, the logical sum of input tokens grows as O(T²) in the number of calls T (Equations 2 and 3). Caching, server-side persistence, and billing policies can make billed cost and effective computation follow different curves.

Equation 1. Scaled dot-product attention and complexity per layer, after Vaswani et al. [1].

Equation 2. Input at turn t, where S is the system prompt, u the user tokens per turn, a the visible assistant tokens, r the reasoning tokens and κ = 1 if reasoning is kept in the history (κ = 0 otherwise).

Equation 3. Cumulative input over T turns: quadratic in T.

2.5 Comparison matrix

2.6 Section analysis

3. History and evolution of methods and techniques

Recent LLM evolution can be read along seven dimensions that influence each other. Figure 2 shows only milestones whose date was checked against a primary source (Section 12); unverified milestones were left out on purpose.

Figure 2. Multidimensional timeline (architecture and context; alignment and dialogue; inference-time reasoning; memory and agents; cost and infrastructure; multi-turn evaluation; security and governance). Author's work based on sources [1]–[22].

3.1 Era 1 (2017–2021): architecture and prompting

The Transformer [1], published in June 2017, replaced recurrence with attention and made training parallelizable. Models were trained with small windows, between 512 and 2,048 tokens [5], and used through prompting: a text or a few examples were given and the model completed it [2]. This is, in essence, a single-turn regime.

3.2 Era 2 (2022): alignment and the dialogue format

InstructGPT 2 showed that fine-tuning with human feedback (RLHF) makes a model preferable, on user instructions, to a GPT-3 more than a hundred times larger. On 30 November 2022 OpenAI launched ChatGPT, whose dialogue format lets it answer follow-up questions, admit mistakes and challenge incorrect premises [18]. Here multi-turn stops being a research topic and becomes a product format.

3.3 Era 3 (2023): context, memory, evaluation and first attacks

Context. By 2023 there were models with 4k to 100k tokens, but Lost in the Middle 5 showed that performance drops when relevant information sits in the middle and that more context does not always help.
Memory. MemGPT 6 proposed context paging and external storage.
Evaluation. MT-Bench 4 established two-turn dialogue evaluation with an LLM judge.
Security. Greshake et al. 3 introduced indirect prompt injection: retrieved data acts as "arbitrary code". Google released SAIF 17.

3.4 Era 4 (2024): long context, caching, reasoning and protocols

Long context. Gemini 1.5 22 offered an experimental 1-million-token window (128k default); Google itself acknowledges high computational cost and the need to optimize latency.
Caching. Anthropic's prompt caching 20 reported up to 90% lower cost and 85% lower latency on long prompts; in a 10-turn conversation with a long system prompt, latency fell from ~10 s to ~2.5 s and cost by 53%.
Reasoning. o1 19 trained the model by reinforcement learning to produce a chain of thought before answering, with performance rising with inference-time thinking (test-time compute).
Agents and protocols. MCP 21 standardized how assistants connect to tools and data.
Evaluation and security. MT-Bench-101 7 created a hierarchical taxonomy of 13 tasks; Crescendo [8] showed multi-turn jailbreaks using benign inputs; OWASP published the 2025 edition of the LLM Top 10 [16]; Regulation (EU) 2024/1689 [14] was published on 12 Jul. 2024.

3.5 Era 5 (2025–2026): reliability, reasoning effort and regulatory recalibration

DeepSeek-R1 11 spread reinforcement-trained reasoning in open models.
Laban et al. [10], published at ICLR 2026 and distinguished as an Outstanding Paper, showed degradation for every model evaluated under its underspecified-conversation protocol; the two reasoning models tested did not eliminate the loss.
In 2026 providers expose reasoning effort levels (low to max) as a cost and quality parameter [24]–29.
Regulation (EU) 2026/1744 [15], in force since 27 Jul. 2026, postponed the Annex III high-risk obligations to 2 Dec. 2027.

3.6 Cross-cutting reading of the timeline

Three patterns stand out. (1) Each capability advance (long context, reasoning) was followed by cost advances (caching) and evaluation advances, but multi-turn evaluation arrived after the product. (2) Security followed the conversation: risk moved from the isolated prompt to the history and to retrieved data. (3) Governance moved from principles to runtime controls, the subject of Sections 7 and 8.

3.7 Section analysis

4. Multi-turn performance: the evidence

4.1 Benchmarks that introduced multi-turn

MT-Bench [4] evaluated two-turn conversations (for example, ask for a text and then ask for it to be re-explained to a child); MT-Bench-101 [7] expanded to 4,208 turns across 1,388 dialogues and 13 tasks, organized into perception, adaptability and interactivity, and observed that usual alignment techniques and chat-specific designs gave no clear gains in multi-turn abilities. These benchmarks are generally episodic: each turn brings a subtask that can be scored in isolation.

4.2 Lost in Conversation (Laban et al., ICLR 2026)

Laban et al. 10 compare single-turn and multi-turn on the same tasks. The sharding method splits each instruction into pieces, and the simulated user reveals at most one per turn. Three main conditions: FULL (full instruction in one turn), CONCAT (shards concatenated in one turn) and SHARDED (one shard per turn).

Figure 3. Mean performance P (0 to 100) in the three conditions, per [10]. Bars: 90 (FULL), 85.6 (CONCAT = 95.1% of FULL) and 65 (SHARDED). Author's chart.

Metrics. For each instruction, with N simulations and scores S:

Equation 4. Mean performance (P), aptitude (A⁹⁰, the best-case performance) and unreliability (U, the gap between the 90th and 10th percentiles) [10].

Results (v1, 9 May 2025). 15 LLMs from eight families, six tasks (code, database, actions/APIs, math, data-to-text and summarization), over 200 thousand simulated conversations. Mean of 90% in single-turn against 65% in multi-turn; a 39% drop in the abstract and text; aptitude −16% and unreliability +112%. Degradation appears already with two turns. CONCAT reaches 95.1% of FULL, so the loss does not come from rephrasing. The two reasoning models tested (o3 and DeepSeek-R1) deteriorate similarly and produce answers 33% longer on average, with more assumptions.

Qualitative causes: premature final-answer attempts; answer "bloat" (final answers 20 to 300% longer); loss in middle turns; and verbosity. Temperature zero does not fix it: with temperature 0 on both sides about 30 points of unreliability remain. Mitigations: repeating requirements every turn (SNOWBALL) recovers 15 to 20% of the drop; a final RECAP is better but unrealistic.

Study limitations (noted by the authors): automated simulation, analytical tasks, English and text only. The authors consider that real-world degradation is likely larger than measured. Recommendations: retry in a fresh conversation and consolidate requirements into a single prompt.

4.3 Long context and attention: Lost in the Middle

Liu et al. [5] showed a U-shaped curve: performance is higher when relevant information is at the start or end of the context and drops when it is in the middle, and it decreases as context grows, even in long-context models. Laban et al. observed an analogue across turns (loss-in-middle-turns).

4.4 Convergent and divergent evidence from multi-turn benchmarks

LLMs Get Lost in Multi-Turn Conversation is not isolated evidence. The final paper was published at ICLR 2026 and received an Outstanding Paper distinction [37], [38]. Its principal result—an average 39% drop when requirements for the same task are disclosed gradually—should be interpreted within its sharded-simulation design: analytical tasks, simulated conversations, English-only text, and models from a specific time window.

Other benchmarks measure partly different failure modes. MT-Eval organizes interactions into recollection, expansion, refinement, and follow-up [39]. MultiChallenge, published in Findings of ACL 2025, evaluates four realistic challenges that jointly require instruction following, context allocation, and in-context reasoning; every evaluated model scored below 50% accuracy, with a best average of 41.4% [40]. StructFlowBench models six structural relationships between turns and identifies difficulty in understanding conversational flow [41]. mtRAG, published in TACL, adds retrieval through 110 human-generated conversations averaging 7.7 turns and totaling 842 tasks [42].

Evidence about explicit reasoning is mixed. In Laban et al.'s design, the two reasoning models tested did not eliminate degradation and generated longer answers. In contrast, MARS-Bench reports that explicit reasoning improves robustness in long conversations involving intent shifts and cross-turn dependencies [43]. The defensible conclusion is not that “more reasoning does not work,” but that its effect depends on the task, protocol, memory management, and metric.

Taken together, these studies show that “multi-turn” is not a single condition. At least five mechanisms should be separated: (1) requirements disclosed in fragments; (2) structural dependencies between turns; (3) distraction and intent shifts; (4) retrieval of external evidence; and (5) dependence on the model's own previous answers. A mitigation that helps one—such as recap, compact memory, or explicit reasoning—may fail or increase cost in another.

4.5 Implications for state, cost, and SGAEIA

The results strengthen the case for representing task state separately from the transcript. Confirmed requirements, validated facts, revoked decisions, permissions, and tool results should not depend only on their position in textual history. A governance architecture can maintain typed contracts, provenance, and deterministic policies while using conversation as the interface. This relationship is the author's interpretation and an SGAEIA architectural hypothesis, not an empirical validation of the framework. Its effectiveness should be tested against baselines such as full replay, sliding windows, rolling summaries, and retrieved memory.

4.6 An illustrative error-propagation model

To fix intuition (and not as an empirical result), suppose that at each turn there is a probability ε that the model introduces a wrong premise that the user accepts (hallucination cascade). The probability that a T-turn conversation has no accumulated error is given by Equation 6. With ε = 5% and T = 20, about 36% remains.

Equation 6. Didactic compound-error model; ε and T are hypothetical parameters.

4.7 Section analysis

5. Token and credit economics

5.1 Billing mechanics

Billing has three components: input tokens, output tokens (including reasoning tokens, billed as output) and the cache read of repeated input. In multi-turn use almost all resent history is read from cache, so the cache-read price differentiates providers more than the input price.

Equation 5. Cost of a T-turn conversation with cache: p_w (write), p_c (cache read), p_o (output), in USD per million tokens; N_new is the new part of the input at each turn.

5.2 Reasoning levels by provider (Nov. 2026 snapshot)

*Availability of each level varies by model; Anthropic points to the effort page as the reference [24]. Sources: [24]–[29]. Names and levels change often; confirm on the official pages.

5.3 How each provider treats earlier turns' reasoning

OpenAI [25]: in models before GPT-5.6, past-turn reasoning does not enter the next turn's context; the GPT-5.6 family includes it by default, and the reasoning.context parameter selects the behavior (all_turns is supported by GPT-5.6 and GPT-6.1 Sol). A configuration_update item changes effort between responses without altering the prefix, preserving the cache.
Anthropic [24]: reasoning blocks of earlier turns that stay in context are billed as input (all turns in some models, only the last in others). Changing effort at the top of the request invalidates the cache; per-message change (beta) preserves cache points. Per-request reasoning tends to decrease as the conversation grows long.
Google [27]: thought signatures keep reasoning continuity; in stateless mode, thought blocks must be resent exactly as received.
xAI [28]: grok-4.7 always returns encrypted reasoning, which must be sent back unchanged to keep reasoning across turns; reasoning cannot be turned off.
DeepSeek [29]: with and without reasoning modes; peak and off-peak prices.

5.4 Prices (USD per million tokens) and cache weight

Provider caveats: Haiku 5.5 costs more above 100k tokens; Gemini 4 Argon doubles in price from 1 Dec. 2026 and offers only implicit caching; grok-4.7 doubles above 200k tokens; DeepSeek charges half off-peak; and Claude models from 4.7 on use a tokenizer that produces about 30% more tokens for the same text, so per-token prices are not comparable 1:1 across providers [23]. Sources: [23], [25], [26], [28], [29].

5.5 A 20-turn example (own calculation)

Assumptions: S = 2,000, u = 300, a = 700 tokens; reasoning r = 1,000 (low effort) or 8,000 (high); the cache always hits; for this simplified scenario, cache writes carry no surcharge. This assumption is not universal: providers may price writes, TTLs, or cache modes separately. By Equation 3, cumulative input over 20 turns is 236 thousand tokens (21.3k new and 214.7k read from cache) with reasoning dropped; if 8,000 tokens of reasoning were kept in the history, input would rise to 1.756 million (7.4 times), with 173.3k input tokens at the 20th turn.

Figure 4. Left, input tokens per turn in three scenarios; right, illustrative 20-turn cost per model, with cache. Author's calculation on official prices.

Readings. With cache, output (mainly reasoning) dominates: going from low to high effort multiplies cost by 3.4 to 4.5 times. Caching cuts input cost by about 86% in the example (models with cache reads at 5% of input), and Anthropic's documentation [20] reports gains of the same order (−53% cost and −75% latency over 10 turns). On cost security, OWASP lists Unbounded Consumption (LLM10:2025) as a risk: uncontrolled inference consumption becomes a cost attack [16].

5.6 How to compare models and effort levels (proposed protocol)

Choose tasks with verifiable answers.
Run three conditions: full instruction (FULL), concatenated shards (CONCAT) and shards per turn (SHARDED) [10].
Cross model and effort level, comparing providers only at equivalent levels (for example, high with high).
Measure P, A⁹⁰ and U (Equation 4), repeating N ≥ 10 simulations per pair.
Measure real cost from the response usage fields (reasoning tokens, cache reads and writes), keeping effort fixed during each conversation so as not to invalidate the cache.

5.7 Section analysis

6. Security and risk in multi-turn use

From a security and governance standpoint, multi-turn use changes the system's risk profile. This section gathers the scientific evidence and the risks described in the compendium.

6.1 Attacks that depend on several turns

Gradual escalation (Crescendo). Russinovich, Salem and Eldan [8] describe a jailbreak that uses only benign inputs and exploits the model's tendency to follow patterns and attend to recent text, especially what it generated itself. Instead of asking for something forbidden at once (which would be refused in a single turn), the attacker escalates gradually. The authors point to the evaluation gap: existing jailbreak benchmarks covered only single turns.
Why single-turn defenses fail. A later paper from the same team [9] reports that aligned models tend to represent Crescendo responses internally as more benign than harmful as turns increase, which helps explain why defenses designed for single turns, such as representation circuit breakers, fail.
Indirect prompt injection. Greshake et al. [3] showed that retrieved data (pages, e-mails, documents) can work as instructions, "blurring the line between data and instructions", with impacts such as data theft, worming and contamination of the information ecosystem. In multi-turn use, an injection placed in an intermediate turn can persist in the history and hijack the agent's behavior in later turns.

6.2 Risks specific to the accumulated history

Persistence of malicious state. In an agentic environment, the content of a page read by a tool can contaminate the state and reappear in every later turn.
Hallucination cascade (error propagation). A subtle error in turn 2, implicitly accepted by the user ("ok, continue"), is incorporated into the conversation's official state and contaminates later reasoning (see the Equation 6 model). Laban et al. [10] corroborate: models "overly rely on previous incorrect attempts".
Difficulty auditing authority limits. In regulated architectures, ensuring that a fixed-scope directive is applied across dozens of turns is computationally harder than in isolated calls.
Unbounded consumption. Long conversations with high reasoning are a cost-attack vector (LLM10:2025, Unbounded Consumption) [16].

6.3 Reference taxonomies

The OWASP Top 10 for LLM Applications (2025 edition, 18 Nov. 2024) keeps prompt injection in first place (LLM01) and includes Excessive Agency (LLM06), Misinformation (LLM09) and Unbounded Consumption (LLM10) [16]. Google's SAIF [17] is a conceptual framework of six elements that lists, among AI-specific risks, model theft, data poisoning, prompt injection and data extraction.

6.4 Section analysis

7. State of the art in state management and drift mitigation

This section incorporates, in full, the content of the author's technical compendium 36, as a technical basis for this analysis.

7.1 State management

Agent systems based on execution graphs can represent state as a typed, immutable, event-persisted object, not as the coupled history of a chat.

Hierarchical memory. Working memory (short term): the immediate task context, with a strict token limit. Episodic memory (medium term): compressed history of relevant interactions in vector stores with temporal and semantic indexing. Semantic/procedural memory (long term): static knowledge graphs or externally validated business rules that the agent consults instead of memorizing in the prompt. (Compare with MemGPT's hierarchy [6].)
Deterministic state machines (FSMs) with event sourcing. The agent flow is modeled as a finite state machine or directed acyclic graph (DAG); each transition produces an auditable event. This enables time-travel debugging (pause, inspect, fork or roll back the state to an exact turn) and transactional checkpoints (persistence at each node, for example in PostgreSQL with JSONB), with resilience to infrastructure failures.
Strict typing contracts per transition. Each turn's outputs pass through strict validation parsers (Pydantic, Zod) before entering the global state. If the model violates the schema, the framework rejects the transition and triggers an isolated self-repair loop.

Figure 5. Transactional transition cycle: command, validation, drift check, immutable commit and checkpoint, with failure branches, circuit breaker and time-travel. Author's diagram based on the compendium.

7.2 Drift mitigation

Drift shows up in three forms: semantic (loss of focus on the goal), behavioral (deviation from safety and system guidelines) and epistemic (accumulation of hallucinations accepted as truth).

A. Semantic and contextual drift

System prompt anchorage. Core directives and constraints are not injected only at the start; advanced routers re-inject anchors at strategic points of the history or use attention with positional bias. This echoes the recommendation to repeat requirements [10] and the position effect [5].
Goal-directed summarization. Instead of linear summaries, the state keeps a tree of pending and completed objectives; old history is dropped or summarized according to progress toward the original goal.

B. Behavioral and alignment drift

Layered guardrails (runtime circuit breakers). The router acts as a governance proxy between turns; lightweight classifiers inspect state and intermediate outputs and, on policy deviation, the circuit trips, triggering fallback or human intervention (HITL).
Adversarial validation (critic loops). In critical flows, the state generated by an executor is submitted to an independent critic agent that checks it against the original constraints.

C. Epistemic drift (cumulative error)

External ground-truth verification. When a turn generates a new premise (code, financial data), the framework forces a validation tool to run (compilers, linters, official APIs, SQL) and writes the validated result, not the LLM's assumption, into the state.

7.3 Practical implementation: state contracts and runtime checks

Implementation requires moving from malleable dictionaries to immutable, typed state contracts with transactional validation. The compendium's code follows, preserved as in the original.

State structure with Pydantic

from enum import Enum from pydantic import BaseModel, Field, field_validator from typing import List, Dict, Any, Optional from datetime import datetime class AgentRole(str, Enum): RESEARCHER = "researcher" EXECUTOR = "executor" CRITIC = "critic" ROUTER = "router" class TaskStatus(str, Enum): PENDING = "pending" IN_PROGRESS = "progress" VALIDATED = "validated" REJECTED = "rejected" class GlobalState(BaseModel): session_id: str current_step: int = Field(ge=0, description="Contador estrito de turnos/transições") goal_tree: Dict[str, TaskStatus] = Field(default_factory=dict) execution_log: List[Dict[str, Any]] = Field(default_factory=list) risk_score: float = Field(default=0.0, ge=0.0, le=1.0) @field_validator('execution_log') def validate_log_immutability(cls, v): # Garante que o log apenas cresce, nunca é reescrito de forma destrutiva  return v class Config: frozen = True # Imutabilidade estrutural (requer cópia via model_copy para atualizar)

The transactional transition cycle. (1) The agent produces a Command (raw out...

Single-Turn and Multi-Turn Interactions in Frontier Generative AI Models: State, cost, reliability, security, and governance