$M^3$ framework improves jailbreaking success rates by up to 53% on six models
$M^3$ is a new automated red-teaming framework that models multi-turn jailbreaking as a Markov Decision Process (MDP). The system uses an attacker LLM to interact with a target LLM while maintaining a compact internal state managed by a separate state LLM. This approach avoids the heuristics and assumptions of prior methods, allowing it to operate in fully black-box settings.
Key points
- $M^3$ models jailbreaking as a finite-horizon Markov Decision Process (MDP) for automated red-teaming
- Outperforms existing methods by up to 53% in Attack Success Rate (ASR) on six target models
- Works with lightweight attackers while maintaining gains of 26-34% in ASR at one to five turns
Researchers evaluated $M^3$ on two benchmarks and six target models. It outperformed existing multi-turn red-teaming methods, achieving up to a 53% higher Attack Success Rate (ASR) at five turns. Even with a lightweight attacker, $M^3$ still improved ASR by 26% at one turn and 34% at five turns compared to baselines using stronger attackers. The framework also escalates risk more steeply over turns and delivers more consistent performance across risk categories, with a 4.82 improvement in the Gini index.
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Research
All →- Researchers release LAMB, a Latin language model trained on 74B tokens · 1 src
- Researchers explore how aligned LLMs generalize to new tasks · 1 src
- Researchers propose agentic framework for emotion reasoning with evidence checks · 1 src
- Researchers propose 24 quality dimensions for knowledge graphs used by LLMs · 1 src
- Researchers introduce Schema Coherence Inventory to test belief consistency in language models · 1 src
Comments
via GitHub Discussions