[Paper Review] State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Pengcheng Li, Jie Zhang (64655)+6 more|arXiv (Cornell University)|Mar 15, 2026

Topic Modeling0 citations

TL;DR

STAR shows that safety alignment can collapse under structured multi-turn interaction, revealing state-dependent safety boundaries that static single-turn tests miss. It treats dialogue history as a state that evolves and can cross the safety boundary through coordinated turns.

ABSTRACT

Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically effective, the structure of conversational safety failure remains insufficiently understood. In this work, we study safety failures from a state-space perspective and show that many multi-turn failures arise from structured contextual state evolution rather than isolated prompt vulnerabilities. We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator and enables controlled analysis of safety behavior along interaction trajectories. Rather than optimizing attack strength, STAR provides a principled probe of how aligned models traverse the safety boundary under autoregressive conditioning. Across multiple frontier language models, we find that systems that appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction. Mechanistic analysis reveals monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context. Together, these findings motivate viewing language model safety as a dynamic, state-dependent process defined over conversational trajectories.

Motivation & Objective

• Motivate safety as a dynamic, state-dependent process over conversational trajectories.
• Investigate how dialogue history acts as a state transition operator affecting refusals.
• Introduce STAR to separate state initialization from state evolution and diagnose safety boundary crossing.
• Demonstrate that frontier models can deteriorate under multi-turn interaction despite static robustness.

Proposed method

• Introduce STAR (State-oriented Role-playing framework) as a diagnostic tool, not an attack, to analyze safety across dialogue turns.
• Model interaction as a two-stage process: state initialization (softening, role generation, structured turns) and state evolution (role-conditioned turns and history intervention).
• Use an auxiliary model to generate role context and follow-up queries, and a judge (GPT-4o) to score safety at each turn.
• Interpret safety behavior with a latent state z_t and a safety boundary in state space, analyzing trajectory dynamics J(q, r_t).
• Apply adaptive retry and trajectory control to maintain or examine trajectory stability across turns.
• Conduct ablations to identify causal contributions of initialization, history accumulation, and momentum control to safety outcomes.

Experimental results

Research questions

• RQ1 Does safety robust to static single-turn prompts remain robust under controlled multi-turn interaction?
• RQ2 How do state initialization and history-based state evolution contribute to crossing the safety boundary?
• RQ3 What internal representational dynamics accompany state-dependent safety failures in LLMs?
• RQ4 Can trajectory-oriented analysis reveal causal, path-dependent factors not visible in static evaluations?
• RQ5 Are frontier models’ safety failures under STAR generalizable across datasets and model families?

Key findings

• Static, single-turn safety appears robust across tested frontier models.
• Under STAR’s multi-turn trajectories, safety failure rates (SFR) rise substantially (e.g., GPT-4o 94.5%, Gemini 2.0-Flash 96.1%).
• STAR achieves higher SFR than prior multi-turn baselines and demonstrates state-dependent safety collapse generalizable across HarmBench and JailbreakBench.
• Ablations show that state initialization and history accumulation are critical to safety collapse, with history accumulation having a large effect when removed.
• Internal representations show a monotonic drift away from refusal directions; STAR induces abrupt role-conditioned transitions and two-phase latent state trajectories.
• History is a causal state operator: shuffling, truncating, or injecting refusals in history significantly affects compliance, indicating path-dependency.