Research
M^3: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 4 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
M³ demonstrates how adaptive, multi-turn attacks can progressively bypass LLM safeguards, highlighting risks that single-turn safety evaluations can miss.
M³ is an automated red-teaming framework that models multi-turn LLM jailbreaking as a finite-horizon Markov Decision Process, pairing an attacker LLM with a state LLM that maintains a compact conversational state. Across two benchmarks and six target models, the authors report attack-success improvements of up to 53% in ASR@5 over existing methods.