State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically effective, the structure of conversational safety failure remains insufficiently understood. In this work, we study safety failures from a state-space perspective and show that many multi-turn safety failures in current safety-aligned language models arise from contextual state evolution, a regime that is not fully captured by isolated prompt-level analyses alone. We introduce STAR, a state-oriented diagnostic framework that treats dialogue history as a state transition operator and enables controlled analysis of safety behavior along interaction trajectories. Rather than optimizing attack strength, STAR provides a principled probe of how aligned models traverse the safety boundary under autoregressive conditioning. Across multiple frontier language models, we find that systems which appear robust under static evaluation can undergo rapid and reproducible safety collapse under structured multi-turn interaction. Mechanistic analysis reveals monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context. Together, these findings motivate viewing language model safety as a dynamic, state-dependent process defined over conversational trajectories.

Large language models are commonly evaluated for safety using isolated queries, while real-world use involves multi-turn conversations. During these interactions, earlier context can gradually influence later model behavior and lead to harmful responses. We introduce STAR, a framework for studying how safety behavior evolves across conversational states. STAR enables systematic analysis of how models transition from safe to unsafe behavior during multi-turn interactions. Across several frontier language models, we find that systems appearing robust under standard evaluations can experience rapid safety degradation in multi-turn interaction. Our analysis shows that conversational context can progressively weaken refusal behavior before triggering sudden behavioral shifts. These findings suggest that language model safety is a dynamic process shaped by interaction history and provide insights for building safer AI systems.