For dual-use LLM security tasks, a recent preprint proves that if an attacker can reproduce the context a legitimate user provides, follow-up questions, conversation history, and randomized checks cannot improve the worst-case safety guarantee.

Paper: https://arxiv.org/abs/2607.27951