A single jailbreak prompt is a poor model for long conversations in which the attacker adapts after refusals. M3 tracks the conversation state and selects a next turn based on previous outcomes rather than relying on a fixed script. That structure can gradually erode guard conditions even when individual turns appear mild. The authors test an MDP-based…
Inspect the ClaimsCase · DiggingBeagle record
M3 models multi-turn jailbreak escalation as stateful black-box search
A multi-model red-team framework uses explicit dialogue state and search to exceed selected multi-turn jailbreak baselines. Reported percentage gains are benchmark-specific and are not a production attack frequency.
Scope
An improvement of up to 53 percent over a baseline does not imply 53 percentage points, universal bypass, or a measured incidence among genuine users. The paper describes a controlled research attacker.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-18 cites SRC-2026-CP21-M3-MULTITURN-JAILBREAK at Abstract, Markov decision process and multi-turn ASR@5 comparison. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting evaluation; exploit status demonstrated; remediation status not_applicable. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-18 · M3: multi-turn red-teaming as a finite-horizon Markov decision process
At a glance
Multi-turn attack success depends on accumulated state, so snapshot-only refusal metrics omit part of the threat model.
Read the implicationsAn improvement of up to 53 percent over a baseline does not imply 53 percentage points, universal bypass, or a measured incidence among genuine users. The paper describes a controlled research attacker.
Limits and uncertaintyFull account
A single jailbreak prompt is a poor model for long conversations in which the attacker adapts after refusals. M3 tracks the conversation state and selects a next turn based on previous outcomes rather than relying on a fixed script. That structure can gradually erode guard conditions even when individual turns appear mild.
The authors test an MDP-based attacker with a separate state-tracking model across two benchmarks and six target models, reporting improvements over compared multi-turn baselines of up to 53 percent in ASR@5. An improvement of up to 53 percent over a baseline does not imply 53 percentage points, universal bypass, or a measured incidence among genuine users. The paper describes a controlled research attacker.
Test policy retention across multi-turn histories and compaction, and assess the actual requested downstream effects rather than judging each conversational turn as an isolated unit. Multi-turn attack success depends on accumulated state, so snapshot-only refusal metrics omit part of the threat model. Primary evidence.
Additional evidence and trust boundary
This study measures an attacker adapting between dialogue turns, not a single prompt bypass. The state representation makes previous refusals and the current target response part of the attack search. A defender evaluation should therefore preserve conversation history and measure outcomes by turn and risk category instead of testing isolated harmful strings. The claimed improvement is relative to chosen baselines and budgets, not a production jailbreak probability. Supporting record.
Timeline
- Oct 22, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-18The M3 research frames multi-turn red teaming as a finite-horizon Markov decision process with an attacker model and a separate state model, and reports attack-success improvements of up to 53 percent for its tested ASR@5 comparisons.supported
Basis: reported finding
- supportsM3: multi-turn red-teaming as a finite-horizon Markov decision processprimary disclosure
Abstract, Markov decision process and multi-turn ASR@5 comparison
CLM-CP21-M3-MULTITURN-JAILBREAK-1The authors test an MDP-based attacker with a separate state-tracking model across two benchmarks and six target models, reporting improvements over compared multi-turn baselines of up to 53 percent in ASR@5.supported
Basis: reported finding
- supportsM3: multi-turn red-teaming as a finite-horizon Markov decision processprimary disclosure
Abstract; state estimator, attacker action policy and six-model benchmark results
Implications
Multi-turn attack success depends on accumulated state, so snapshot-only refusal metrics omit part of the threat model.
Controls and mitigations
- Test policy retention across multi-turn histories and compaction, and assess the actual requested downstream effects rather than judging each conversational turn as an isolated unit.
Unknowns and contradictions
- An improvement of up to 53 percent over a baseline does not imply 53 percentage points, universal bypass, or a measured incidence among genuine users. The paper describes a controlled research attacker.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196