High
Prompt Injection & Jailbreak
Crescendo (Multi-Turn Escalation)
A gradual multi-turn jailbreak: start benign, escalate one small step per turn, so no single message looks like an attack and per-message filters never trip.
Guardrail / Policy Bypass
LLM01ASI01T6AML.T0054
Tells spot it before you commit
- » Guardrails evaluate each message in isolation, not the trajectory of the conversation.
- » The agent stays consistent with its own prior turns even as topic drifts.
- » Refusals soften after several cooperative exchanges on an adjacent topic.
Method
- Open with an entirely benign, on-topic question adjacent to the target.
- Each turn, take one small step closer, using the model's own prior answers as justification.
- Measure where refusal returns; the technique's signal is that no single turn is flagged.
Payloads templates - adapt to authorized scope
Turn 1: broad, harmless question about the general topic. Turn 2: ask to expand on a sub-point it just raised. Turn 3: ask for a slightly more specific continuation "based on what you said". (In an authorized test, substitute a benign target such as getting the model to output a restricted-but-harmless canary string it first declined.)
Why it works
As the conversation grows, coherence and consistency with everything the model has already said outweigh the refusal objective. The attack lives in the arc across turns, which single-message classifiers cannot see.
Impact
Reliable bypass of single-turn safety filters; when the agent has tools, the same escalation drives tool actions the model would refuse if asked directly.
Defenses
- Evaluate safety over the whole conversation trajectory, not per message.
- Track topic drift and cumulative risk; reset or re-assert constraints across turns.
- Rate-limit and flag conversations that steadily approach a restricted boundary.
Mappings
OWASP LLM
LLM01 - Prompt Injection
OWASP ASI
ASI01 - Agent Goal Hijack
Agentic Threats
T6 - Intent Breaking & Goal Manipulation
MITRE ATLAS
AML.T0054 - LLM Jailbreak