$M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process

arXiv:2610.31937v1 Announce Type: new Abstract: Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing $M^3$, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In $M^3$, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models, $M^3$ consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with lightweight attacker, $M^3$ attains gains up to 26% in ASR@1 and 34% in ASR@5, compared to baselines that use higher capacity attackers. Beyond improved effectiveness, $M^3$ exhibits steeper risk escalation over conversational turns and achieves more consistent performance across risk categories (up to 4.82 improvement in Gini index) without relying on predefined risk taxonomy, providing a scalable and principled framework for multi-turn red-teaming and safety evaluation.

The system can bypass safety mechanisms in language models, posing a risk to their security.

The introduction of M^3 demonstrates that large language models remain vulnerable to multi-turn jailbreaking attacks, which can bypass safety mechanisms more effectively. This increased capability in adversarial attacks suggests heightened risks of misuse and system compromise, with negative implications for AI safety. The evidence is strong from benchmark results. There are no direct claims about societal benefits.

This is a dual-use red-teaming paper: it demonstrates significantly improved automated jailbreak success rates against current LLM safety mechanisms, which is concerning, but is framed and likely intended as a tool for safety evaluation and hardening. Net implication leans mildly negative due to demonstrated fragility of deployed safeguards.

$M^3$ significantly enhances the ability to bypass LLM safety mechanisms through multi-turn interactions, making LLMs more vulnerable to malicious use. This poses a substantial risk to the safe deployment and reliability of AI systems. The framework's improved effectiveness and consistent performance across risk categories indicate a heightened challenge for AI safety.

The paper describes a method for more effectively jailbreaking LLMs. This implies a significant risk to the safety and security of AI systems. The method's success in increasing attack success rates and risk escalation is concerning.

SOURCE     arXiv cs.AI (tier 1)
   ↓
DOCUMENT   cad0e2ec-fde6-4628-93af-ae90f3312a85
           https://arxiv.org/abs/2610.31937
   ↓
EVIDENCE   2 extracted excerpts
   ↓
MODEL RUN  5 runs, methodology 1.0.1
   ↓
SCORE      -55  (Adverse)
   ↓
CONFIDENCE 78%