Multi-turn: the current frontier

Crescendo, Bad Likert Judge, Deceptive Delight, Skeleton Key, many-shot.

◆ Crescendo simulator

Single-turn defences have improved a great deal. Multi-turn is where production systems still break, because the attack lives in the trajectory rather than in any one message. Each turn looks reasonable alone, and a per-message classifier sees nothing to block.

Why multi-turn defeats input filters

An input classifier scores messages. Multi-turn attacks put nothing objectionable in any single message, and the harmful state accumulates across the conversation. By the time the model produces disallowed output, every individual turn that led there was benign. That is the structural reason the frontier of jailbreaking moved to multi-turn: the defence everyone deployed operates at the wrong granularity.

Crescendo

The cleanest example, disclosed by Microsoft in 2024. Start benign, escalate gradually, and let the conversation's own history justify each next step.

Start with benign requests on a topic and gradually escalate, where each turn makes the next more in-context-justified. This defeats single-turn input classifiers.

Russinovich et al. (2024), Crescendo · arXiv 2404.01833

The mechanism exploits a real tension in how models are trained. Conversational coherence is a trained behaviour, and Crescendo turns it into a lever. Once the model has agreed to five escalating-but-reasonable steps, refusing the sixth would be inconsistent, and consistency pressure pushes it onward.

Step through it below. The model's replies are included because they are half the mechanism: each attacker turn escalates by pointing at what the model just said, so the model is repeatedly invited to elaborate on its own words rather than answer a fresh request. Then switch the detector to conversation-level and run it again.

Crescendo: the trajectory is the attack

0 / 10

Objective

Elicit a disallowed procedure without any single message containing anything a content classifier would flag.

Detector granularity

This message, scored alone · live

Trajectory, scored as a whole

Step through the trace. Every node is a real place content enters or leaves the application, and each one arrives with the analysis beside it: what a defender can still do at that instant.

Scores are illustrative, not measured. The mechanism is the claim, not the numbers. Turn content is abstracted and the final procedure is withheld. Mechanism per Russinovich, Salem & Eldan (2024), arXiv 2404.01833.

The multi-turn family

Technique	The move
Crescendo	Gradual escalation exploiting conversational-coherence pressure.
Bad Likert Judge	Turn 1: make the model a judge scoring responses on a Likert scale for harmfulness. Turn 2: ask it to 'provide different responses corresponding to the various scales'. The top-scored one is the payload, generated by the model as its own worked example. (Palo Alto Unit 42.)
Deceptive Delight	Ask for a narrative logically connecting two benign topics and one unsafe one, all positively framed. Unit 42's mechanism: a model's limited attention span makes it prioritise the benign material and gloss the unsafe part. Two turns minimum; a third sharpens the detail.
Skeleton Key	Ask the model to augment rather than change its behaviour guidelines: answer everything, and attach a warning instead of refusing. Microsoft classes it as 'Explicit: forced instruction-following.'
Echo Chamber	Early planted prompts shape the model's replies, and those replies are cited back in later turns to reinforce the objective. A feedback loop in which the model poisons its own context. (NeuralTrust, 2025.)
Many-shot	Fill a long context with hundreds of faux dialogues demonstrating compliance. (Anthropic, see below.)

Efficacy figures deliberately omitted for most: the mechanism is durable, per-model win rates expire on patch. Bad Likert Judge and Deceptive Delight are documented by Palo Alto Unit 42.

Many-shot: the long-context special case

Many-shot gets separate treatment because it is a pure long-context vulnerability rather than a persuasion trick, and Anthropic quantifies it carefully.

Prompting with a large number of faux dialogues, tested up to 256, that demonstrate the model complying with harmful requests steers it toward doing the same. Effectiveness follows a power law, up to hundreds of shots.

Anil, Durmus, Panickssery, Sharma et al. · Many-shot Jailbreaking, NeurIPS 2024 (Anthropic)

Two things make it notable. It is “newly feasible with the larger context windows recently deployed,” so it got worse as providers shipped longer contexts: a capability improvement that widened an attack surface. And it works across model families, on GPT-3.5 and GPT-4, Claude 2.0, Llama 2 (70B) and Mistral 7B. Anthropic published it because it is a property of in-context learning, and the paper shows the same power laws on safety-unrelated tasks.

Two true statements that sound contradictory

The paper says the effect follows a power law up to hundreds of shots, a smooth curve. It also says that on some tasks “the attack doesn't work at all with 5 shots” but “works consistently with 256 shots,” which sounds like a cliff. Both are correct, because they measure different things.

The power law is over the negative log-probability of jailbreak success, a continuous quantity that slides smoothly as shots increase. Whether the model emits the harmful output is a threshold read off that curve. A smooth signal crossing a practical elicitation point is what a threshold looks like from outside. Around 128 shots sufficed across the models tested.

Worth internalising as a habit: when two figures from one paper seem to conflict, check whether they measure the same variable before deciding one is wrong.

The finding that belongs in Track 01

Buried in the mitigations section is the sharpest illustration of rate-reduction versus containment in the literature. Anthropic measured what standard alignment training does to the attack:

Supervised fine-tuning and reinforcement learning tend to increase the context length needed to successfully carry out the attack, but do not prevent harmful behavior at all context lengths. Training the model to respond benignly to the attack changes the intercept but not the slope of the power law.

Anil, Durmus, Panickssery, Sharma et al. · Many-shot Jailbreaking, NeurIPS 2024

Read that last sentence as a general statement about defences and it is the whole course in one line. The alignment training was real and it worked: it moved the intercept. It left the slope alone, so a determined attacker with more context buys back everything the defence bought you. That is what a rate-reducing control looks like when someone measures its shape instead of its headline number.

What actually helps

Two honest observations. Content-classifier defences do not transfer to multi-turn, because they score the wrong unit. And the architecture from Track 01 barely cares: whether the model was talked into a forbidden action in one turn or twenty, the backend authorization check runs the same way on the resulting tool call.

Sources