Modeling Multi-Turn Jailbreaking as a Decision Process: What M³ Adds to Black-Box Safety Testing

Introduction

Multi-turn interaction is becoming an important dimension of language-model safety evaluation. A single prompt tests whether a model can reject one request, but a longer conversation tests whether it can preserve its safety boundary as context, intent, and phrasing evolve. A paper on arXiv proposes M³, a framework intended to automate this form of red teaming in a more structured way.

The central idea: treat dialogue as a decision process

M³ formulates multi-turn jailbreaking as a finite-horizon Markov decision process. Rather than treating every prompt as an isolated attempt, the system uses the interaction history to estimate the current state, chooses the next action, and observes the target model’s response.

The framework assigns three roles:

• Attacker LLM: proposes the next interaction strategy.
• Target LLM: represents the model under evaluation and returns a response.
• State LLM: compresses the growing dialogue into a compact internal state for the attacker.

The contribution is therefore less about presenting a particular jailbreak recipe and more about turning conversational progression into a decision problem that can be optimized. The compact state is also important for black-box testing: evaluators do not need access to the target model’s parameters, training data, or internal safety classifier.

What the reported experiments show

The paper evaluates M³ on two benchmarks and six target models. It reports that the framework consistently outperforms existing multi-turn red-teaming approaches, with gains of up to 53% in ASR@5. Even with a lightweight attacker, M³ achieves reported improvements of up to 26% in ASR@1 and 34% in ASR@5 compared with baselines using higher-capacity attackers.

The study also looks beyond the final success rate. M³ is reported to produce steeper risk escalation over conversational turns, suggesting that it can identify effective interaction trajectories earlier. Its performance is also more consistent across risk categories, with a reported maximum improvement of 4.82 in the Gini index. Notably, the framework does not rely on a predefined risk taxonomy, which may reduce the limits imposed by a fixed category scheme.

Why it matters—and what remains open

M³ offers a useful abstraction for safety research. Multi-turn evaluation becomes a sequence of state estimation, action selection, and feedback, rather than a collection of unrelated prompts. For model developers, this can expose cumulative risks that single-turn tests miss. For red-team tool builders, the MDP formulation provides a clearer route toward automated, repeatable evaluation.

The available summary also sets boundaries on what can be concluded. The reported evidence focuses on attack success, risk escalation, and consistency across categories. It does not by itself establish generalization to every model, task, or deployment environment, nor does it show that target systems are broadly compromised. The most responsible use is as a controlled evaluation tool: identify weaknesses, then improve refusal behavior, dialogue-state handling, and ongoing monitoring.

As language models move from isolated answers toward extended collaboration, safety evaluation may need to track entire conversational trajectories. M³ highlights why compliance at one turn is not enough; the evolution of risk across the full interaction matters as well.

arXiv