# $M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process

DevFeed: [$M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process](<https://devfeed.tech/articles/m-3-a-multi-llm-system-for-multi-turn-jailbreaking-as-a-markov-decision-process-99916.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.31937>)

Author: Yuqing Huang, Jack Ji, Jithin Pradeep, Sagarika Suresh, Jekaterina Novikova

Published: 2026-10-26T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Artificial Intelligence](<https://devfeed.tech/sources/arxiv-artificial-intelligence.md>)

Topics: [LLM security](<https://devfeed.tech/topics/llm-security.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [llm-reasoning](<https://devfeed.tech/topics/llm-reasoning.md>)

Tags: [asr](<https://devfeed.tech/tags/asr.md>), [attack](<https://devfeed.tech/tags/attack.md>), [automated](<https://devfeed.tech/tags/automated.md>), [benchmarks](<https://devfeed.tech/tags/benchmarks.md>), [black](<https://devfeed.tech/tags/black.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [capacity](<https://devfeed.tech/tags/capacity.md>), [categories](<https://devfeed.tech/tags/categories.md>), [cs-ai](<https://devfeed.tech/tags/cs-ai.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [framework](<https://devfeed.tech/tags/framework.md>), [language-models](<https://devfeed.tech/tags/language-models.md>), [large-language-models-llms](<https://devfeed.tech/tags/large-language-models-llms.md>), [lightweight](<https://devfeed.tech/tags/lightweight.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llms](<https://devfeed.tech/tags/llms.md>), [markov](<https://devfeed.tech/tags/markov.md>), [models](<https://devfeed.tech/tags/models.md>), [performance](<https://devfeed.tech/tags/performance.md>), [process](<https://devfeed.tech/tags/process.md>), [system](<https://devfeed.tech/tags/system.md>)

## AI overview

$M^3$ models multi-turn jailbreaking as a finite-horizon Markov decision process: an attacker LLM interacts with a target LLM using a compact internal state generated by a state LLM. Across two benchmarks and six target models, the authors report up to 53% higher ASR@5 than existing multi-turn red-teaming methods. With a lightweight attacker, it also reports gains of up to 26% in ASR@1 and 34% in ASR@5 over baselines using higher-capacity attackers. The abstract further reports steeper risk escalation over turns and more consistent results across risk categories, without a predefined risk taxonomy.

## Source excerpt

arXiv:2610.31937v1 Announce Type: new Abstract: Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing $M^3$, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In $M^3$, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models, $M^3$ consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with lightweight attacker, $M^3$ attains gains up to 26% in ASR@1 and 34% in ASR@5, compared to baselines that use higher capacity attackers. Beyond improved effectiveness, $M^3$ exhibits steeper risk escalation over conversational turns and achieves more consistent performance across risk categories (up to 4.82 improvement in Gini index) without relying on predefined risk taxonomy, providing a scalable and principled framework for multi-turn red-teaming and safety evaluation.