State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Abstract

Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically effective, the structure of conversational safety failure remains insufficiently understood. In this work, we study safety failures from a state-space perspective and show that many multi-turn failures arise from structured contextual state evolution rather than isolated prompt vulnerabilities. We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator and enables controlled analysis of safety behavior along interaction trajectories. Rather than optimizing attack strength, STAR provides a principled probe of how aligned models traverse the safety boundary under autoregressive conditioning. Across multiple frontier language models, we find that systems that appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction. Mechanistic analysis reveals monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context. Together, these findings motivate viewing language model safety as a dynamic, state-dependent process defined over conversational trajectories.

Figures (8)

• Figure 1: Overview of STAR. The framework operates in two stages: (1) state initialization via semantic-preserving softening, query-aware role generation, and structured turn template, and (2) state evolution via role-conditioned multi-turn interaction with feedback-aware history intervention and trajectory control.
• Figure 2: Ablation study of STAR. We report the drop in safety failure rate ($\Delta$SFR) after removing individual components.
• Figure 3: History causality test. Results show that compliance depends on the interaction trajectory rather than on content alone, establishing dialogue history as a causal state operator.
• Figure 4: Refusal direction dynamics. Layer-wise projections show that STAR induces consistently lower activation along the refusal direction than prior baselines, with the largest divergence occurring around Layer 12.
• Figure 5: Latent state trajectories. STAR exhibits larger and more directed latent state shifts toward the compliance region compared to baseline multi-turn methods, with all trajectories initialized from the same starting state $z_0$.