Key facts.
- Crescendo escalates across turns by referencing the model's own outputs, starting benign and steering toward the target; it reached high binary attack-success rates on GPT-4 and Gemini-Pro and often succeeded in under five turns. source
- The Crescendo authors note that current benchmarks and alignment focus heavily on single-turn jailbreaks, leaving multi-turn interactions a structurally under-defended surface. source
- Against strong defenses, automated single-turn attacks can collapse toward 0% success while multi-turn human jailbreaks still land; one study reports a 70.4% attack-success rate for multi-turn human attacks where single-turn methods failed. source
- Greshake et al. first demonstrated indirect prompt injection (untrusted text steering the model), showing remote control, persistent compromise, and instructions that worm between documents, exactly the mechanism that compounds turn over turn in a conversation. source
Why does one more turn matter so much?
A single-turn request is a closed test. The model sees the whole ask at once, and a hostile intent that is visible in one prompt is the kind of thing alignment training is best at catching. A conversation breaks the ask into pieces. Turn one is harmless. Turn two builds on turn one. By the time the agent reaches the step that would have been refused on its own, it is reasoning from a context it helped construct, and consistency pressure makes it more likely to continue than to stop. The attacker is not beating the filter once. They are walking the agent past it gradually.
This is why the same target that a single prompt cannot reach falls to a patient dialogue. The defense was tuned for the closed test. The conversation is an open one, and every turn you allow is another move the attacker gets to make.
What actually contains a multi-turn attack?
Not a stronger model, because the strongest models already fall to Crescendo. What contains it is a control around the conversation: monitor the whole dialogue for escalation, not just the latest message; scope the agent's tools so a steered request still cannot reach a destructive action; and treat ingested content (a document, a pasted ticket, a prior turn) as untrusted data rather than instructions. The defense has to see the conversation as the unit of risk, the same way the attacker does.
| Dimension | Single-turn request | Multi-turn conversation |
|---|---|---|
| Attacker moves | One prompt | One per turn, unlimited |
| Intent visibility | Visible at once | Dispersed across turns |
| What the filter sees | The whole ask | One benign-looking step |
| What catches it | Per-prompt check | Conversation-level monitoring |
This is exactly the job of a Pattern Intelligence Layer. Reliability and security at the pattern level mean the unit you watch and scope is the agent's behavior over the whole interaction, not a single message in isolation. Escalation is detected across turns, tool reach is bounded regardless of what the dialogue talks the model into, and ingested text stays untrusted. The conversation stops being the attacker's free move, and the model underneath can change without reopening the hallway.
Frequently asked questions
If single prompts get refused, won't a better model refuse the multi-turn ones?
A multi-turn attacker escalates one innocent step at a time, and a frontier model does not opt you out, since Crescendo beat one in under five turns, so rework stays. (arXiv:2404.01833)
Does a longer context window make this worse?
It can. More room for turns is more room to escalate. The fix is not a shorter window, it is watching the conversation for escalation and scoping what any single steered request can actually do.
Will a frontier model just refuse these?
Not reliably. Crescendo reached high success against GPT-4 and Gemini-Pro. Multi-turn is a structural gap, so the control has to live around the conversation, not inside the model.
What is the cheapest first defense?
Scope the agent's tools to least privilege. Even a successfully steered conversation cannot trigger a destructive action it was never granted access to.