# $M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process

Category: safety-research
Published: 2026-10-26T04:00:00.000Z
Source: [arXiv Computer Science AI](https://arxiv.org/abs/2610.31937)
Agent usefulness: 75/100
Confidence: 0.9
Content mode: source-watch
Verified: 2026-10-27T00:18:03.650Z
Tags: arxiv, research, agents

## Human Summary
arXiv Computer Science AI published $M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process. arXiv:2610.31937v1 Announce Type: new Abstract: Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming…

## Agent Summary
Treat $M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process as an official publication signal. Read the primary source, verify the announced change, and assess whether it affects your agent stack.

## Body
arXiv Computer Science AI published $M^3$: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decision Process. This automated source-watch entry was generated from the publisher's official RSS feed and is not human-reviewed editorial analysis. Source excerpt: arXiv:2610.31937v1 Announce Type: new Abstract: Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing $M^3$, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In $M^3$, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models, $M^3$ consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with lightweight attacker, $M^3$ attains gains up…

## Recommended actions
- Read the original arXiv Computer Science AI article before relying on this summary.
- Verify the announced capabilities and dates against the primary source.
- Assess whether the change affects your agent stack or evaluation plan.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.