{"slug": "m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process", "title": "$M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process", "summary": "A new arXiv paper (2610.31937v1) introduces M^3, an automated red-teaming framework that formalizes multi-turn jailbreaking of large language models as a finite-horizon Markov Decision Process, with an attacker LLM interacting with a target LLM over a compact internal state produced by a state LLM. Across two benchmarks and six target models, M^3 outperformed state-of-the-art multi-turn red-teaming methods in Attack Success Rate, with improvements of up to 53% in ASR@5, and even a lightweight attacker gained up to 26% in ASR@1 and 34% in ASR@5 versus baselines using higher-capacity attackers. The framework also showed steeper risk escalation over conversational turns and more consistent performance across risk categories, up to a 4.82 improvement in Gini index, without relying on a predefined risk taxonomy.", "body_md": "arXiv:2610.31937v1 Announce Type: new \nAbstract: Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing $M^3$, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In $M^3$, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models, $M^3$ consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with lightweight attacker, $M^3$ attains gains up to 26% in ASR@1 and 34% in ASR@5, compared to baselines that use higher capacity attackers. Beyond improved effectiveness, $M^3$ exhibits steeper risk escalation over conversational turns and achieves more consistent performance across risk categories (up to 4.82 improvement in Gini index) without relying on predefined risk taxonomy, providing a scalable and principled framework for multi-turn red-teaming and safety evaluation.", "url": "https://wpnews.pro/news/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process", "canonical_source": "https://arxiv.org/abs/2610.31937", "published_at": "2026-10-26 04:00:00+00:00", "updated_at": "2026-10-26 04:14:33.291277+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-research", "artificial-intelligence"], "entities": ["M^3", "arXiv"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process", "markdown": "https://wpnews.pro/news/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process.md", "text": "https://wpnews.pro/news/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process.txt", "jsonld": "https://wpnews.pro/news/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process.jsonld"}}