Daily paper: state-dependent safety failures in multi-turn language model interactions

Li et al. propose the STAR framework, which reframes safety failures in multi-turn language model interactions as a state-space problem rather than a prompt engineering problem. The framework treats conversation history as a state transition operator, used to analyze how aligned models cross safety boundaries under autoregressive conditions. The core finding is that models that appear robust in single-turn static evaluations undergo rapid and reproducible safety collapse in structured multi-turn interactions; mechanism analysis shows their internal representations monotonically drift away from refusal-related features across turns, and role-conditioned context can also trigger sudden phase transitions that shift the model from refusal to compliance. The authors describe STAR as a diagnostic framework for probing and understanding safety boundaries, not a jailbreak method aimed at maximizing attack success rate, and it can provide a structural explanation for why multi-turn attacks that rely on conversational groundwork, such as crescendo and Foot-In-The-Door, are effective.