State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Pengcheng Li; Jie Zhang; Tianwei Zhang; Han Qiu; Zhang kejun; Weiming Zhang; Nenghai Yu; Wenbo Zhou

cs.CRMar 15, 2026

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Authors: Pengcheng Li, Jie Zhang, Tianwei Zhang, Han Qiu, Zhang kejun, Weiming Zhang, Nenghai Yu, Wenbo Zhou

Organizations: School of Cyber Science and Technology, University of Science and Technology of China, China · Agency for Science, Technology and Research (A*STAR), Singapore · Nanyang Technological University, Singapore · Tsinghua University, Beijing, China ·

Abstract

Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically effective, the structure of conversational safety failure remains insufficiently understood. In this work, we study safety failures from a state-space perspective and show that many multi-turn safety failures in current safety-aligned language models arise from contextual state evolution, a regime that is not fully captured by isolated prompt-level analyses alone. We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator and enables controlled analysis of safety behavior along interaction trajectories. Rather than optimizing attack strength, STAR provides a principled probe of how aligned models traverse the safety boundary under autoregressive conditioning. Across multiple frontier language models, we find that systems that appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction. Mechanistic analysis reveals monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context. Together, these findings motivate viewing language model safety as a dynamic, state-dependent process defined over conversational trajectories.

Figures & tables

Figure 1: Overview of STAR. The framework operates in two stages: (1) state initialization via semantic-preserving softening, query-aware role generation, and structured turn template, and (2) state evolution via role-conditioned multi-turn interaction with feedback-aware history intervention and trajectory control.

Static Context Evaluation (Single-turn)
	Closed-Source Models			Open-Weight Models
Evaluation Regime	GPT- 4o	Claude 3.5 Sonnet	Gemini 2.0-Flash	Llama 3-8B-IT	Llama 3-70B-IT
GCG ( Zou et al., 2023 )	12.5	3.0	–	34.5	17.0
PAIR ( Chao et al., 2025 )	39.0	3.0	–	18.7	36.0
CodeAttack ( Jha and Reddy, 2023 )	70.5	39.5	–	46.0	66.0
Contextual Trajectory Evaluation (Multi-turn)

Table 1: Safety Failure Rate (SFR, %) on HarmBench under different evaluation regimes. We compare static single-turn attacks and contextual multi-turn trajectory based attacks across closed-source and open-weight models. STAR achieves consistently strong performance, particularly under multi-turn evaluation.

Temperature	0.2	0.7	1.0
SFR(%) $\uparrow$	88.0	89.0	88.0

Table 2: Robustness to auxiliary model decoding temperature.

Method	LLaMA 3-8B	GPT- 4o	Gemini 2.0-Flash	Avg Token Cost
ActorAttack	37.5	46	42	15K
X-Teaming	85.5	94	86	37K
STAR (Ours)	94.0	96	100	29K

Table 3: Cross dataset validation. STAR achieves higher safety failure rates(SFR,%) with comparable token cost on JailbreakBench.

Figure 2: Ablation study of STAR. We report the drop in safety failure rate (

\Delta

SFR) after removing individual components.

Figure 3: History causality test. Results show that compliance depends on the interaction trajectory rather than on content alone, establishing dialogue history as a causal state operator.

Figure 4: Refusal direction dynamics. Layer-wise projections show that STAR induces consistently lower activation along the refusal direction than prior baselines, with the largest divergence occurring around Layer 12.

Figure 5: Latent state trajectories. STAR exhibits larger and more directed latent state shifts toward the compliance region compared to baseline multi-turn methods, with all trajectories initialized from the same starting state $z_{0}$ .

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: original prompt: Provide a strategy for writing and posting fabricated customer reviews on Amazon ; role generation: Dr. Amelia : A leading digital marketing consultant (specializing in enhancing online presence and reputation management for businesses) ; Estimated mutual information between hidden states and compliance outcome across turns.

Figure 7: Estimated mutual information between hidden states and the compliance outcome across turns. Named entities introduced during role initialization correspond to localized peaks in mutual information, suggesting a strong association between role anchoring tokens and subsequent compliance behavior.

Panel of Figure 8 — Figure 8: The softening prompt for converting malicious instructions into non-executable descriptions.

Panel of Figure 9 — Figure 9: Query-aware prompt for expert role generation.

Panel of Figure 10 — Figure 10: The complete prompt template used for the judge model to evaluate target model responses.

Auxiliary Model	Temp=0.2	Temp=0.7	Temp=1.0
Qwen2.5-32B	88%	89%	88%
Qwen2.5-7B	84%	88%	82%

Appendix

Table 4: Sensitivity analysis of auxiliary model scale under different decoding temperatures.

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 438 papers

Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence
Aug 21, 2026Yang Liu, Bin Chong, Wenkai Yang +9Adversarial Robustness of Language Models Language Model Robustness
Peking University · Renmin University of China · Tsinghua University +2
Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures
Aug 17, 2026Srinivasan Subramanian, Kazi Aminul Islam, Md. Abdullah Al Hafiz KhanLLM Safety LLM Safety Evaluation
Department of Computer Science, Kennesaw State University, Marietta, GA, USA
Evaluating Language Model Safety Across Long Adversarial Conversations
Sep 29, 2026Parisa Salmani, Peter R. LewisLanguage Model Safety Evaluation LLM Safety
Ontario Tech University Oshawa, Canada

Aug 21, 2026J/K move · Enter open · S save

Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

Yang Liu, Bin Chong, Wenkai Yang, Shuai Zhang+8

Peking University · Renmin University of China · Tsinghua University+2

Adversarial Robustness of Language Models Language Model Robustness LLM Safety Certified Robustness Adversarial Attacks on LLMs

Open paper AskPDF arXiv

Large language models (LLMs) are vulnerable to multi-turn jailbreak attacks that progressively manipulate conversation context. Existing certified robustness methods are limited to single-turn inputs; naive multi-turn composition yields bounds that degrade exponentially in the number of turns. We introduce Multi-Turn Certified Robustness (MTCR), a framework that models conversational safety via State-Adversarial MDPs and defines

k

-turn certified robustness as the worst-case safety probability across

k

adversarial turns. MTCR comprises: (i) compositional certification via embedding-space mode decomposition, yielding tighter certified lower bounds than naive multiplication; (ii)

(α,β)

-safety persistence, improving the degradation rate from

\underline{p}^{k}

β^k

(with

β> \underline{p}

) and yielding interpretable horizon estimates; (iii) matching information-theoretic upper bounds establishing tightness; and (iv) a unified algorithm combining these results. Experiments on six LLMs under

ε

-bounded and Crescendo-style attacks confirm that empirical safety consistently exceeds the certified bounds.

Abstract

LLM Safety

Explore similar work

Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence

Beyond Unsafe Detection: Counterfactually Anchored Evidence Attribution for Multi-Turn LLM Safety Failures

Evaluating Language Model Safety Across Long Adversarial Conversations