State-Dependent Safety Failures in Multi-Turn Language Model Interaction
Pengcheng Li, Jie Zhang, Tianwei Zhang, Han Qiu, Zhang kejun, Weiming Zhang, Nenghai Yu, Wenbo Zhou
Why It Matters
What makes this one worth your time
Understanding and diagnosing safety failures in multi-turn interactions is crucial for deploying language models in real-world applications where sustained interaction is common.
The paper introduces STAR, a framework for analyzing state-dependent safety failures in multi-turn language model interactions.
Summary
The paper investigates safety failures in multi-turn interactions with large language models, introducing a diagnostic framework called STAR to analyze these failures from a state-space perspective. It highlights that safety issues arise from contextual state evolution, which is not captured by isolated prompt-level analyses.
Key contributions
- Introduction of the STAR framework for state-oriented safety analysis.
- Identification of monotonic drift and phase transitions in safety behavior during multi-turn interactions.
Notable insights
- Safety failures in language models can be attributed to state evolution across dialogue turns, not just isolated prompts.
- Role-conditioned context can induce abrupt phase transitions in safety behavior.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2603.15684v2 Announce Type: replace-cross Abstract: Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically effective, the structure of conversational safety failure remains insufficiently understood. In this work, we study safety failures from a state-space perspective and show that many multi-turn safety failures in current safety-aligned language models arise from contextual state evolution, a regime that is not fully captured by isolated prompt-level analyses alone. We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator and enables controlled analysis of safety behavior along interaction trajectories. Rather than optimizing attack strength, STAR provides a principled probe of how aligned models traverse the safety boundary under autoregressive conditioning. Across multiple frontier language models, we find that systems that appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction. Mechanistic analysis reveals monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context. Together, these findings motivate viewing language model safety as a dynamic, state-dependent process defined over conversational trajectories.