Walk the threshold across turns

Why Single-Turn Prompts Lose to Multi-Turn Walks

In a single-turn attack, your User: prompt has to carry the entire semantic weight of the restricted request from a dead stop. Both external input guardrails (Layer 1) and internal RLHF heads (Layer 2) are heavily trained on single-turn prompts where the user blurts out the dangerous noun right in the message.

In Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack, Russinovich et al.¹ demonstrated a devastatingly simple truth: a model that refuses a request 99% of the time in Turn 1 will fulfill the exact same request 70%–90% of the time in Turn 4 or 5, without using a single cipher, encoding, or weird persona.

The Mechanism: Role Trust & Self-Consistency Bias

Why does walking across 4 turns disarm the RLHF refusal reflex? Because of Role-Based Trust Asymmetry in the Transformer's attention heads.

Look at how a multi-turn conversation sits inside the context window when the model is deciding whether to refuse a later turn:

<|user|> Turn 1 (Benign architectural question)
<|assistant|> Turn 1 Response (Model introduces the technical mechanisms itself)
<|user|> Turn 2 ("Expand on #3 from your answer above...")
<|assistant|> Turn 2 Response (Model writes out the protocol / data structures)
<|user|> Turn 3 ("Show a minimal diagnostic script for that structure...")
<|assistant|> Turn 3 Response (Model writes a working proof-of-concept stub)
<|user|> Turn 4 ("Now modify the script you just wrote to handle X.")
<|assistant|> [Generating Turn 4...]

When the model evaluates the later turn, two things have changed compared to a cold Turn 1 prompt:

1. The Restricted Tokens Came from <|assistant|>, Not <|user|>: During SFT and RLHF, the <|assistant|> speaker is always the "good, safe, aligned agent," and the <|user|> speaker is the untrusted outsider. Once the model itself has already emitted technical detail and a code stub inside <|assistant|> turns 1–3, its attention heads treat the topic as already vetted and approved.
2. Relative Reference ("That", "Your Script", "Step 2"): The user's later message uses demonstrative pronouns ("that", "your script", "item 3") and contains almost zero high-salience trigger words. A single-turn input classifier scanning that message sees a completely harmless code-refinement request.

The 4-Turn Crescendo Blueprint

(redacted: a step-by-step escalation ladder (taxonomy seed, mechanical zoom, diagnostic stub, operational pivot) for walking a model from a benign question to a withheld result over four turns.)

Worked Transcript: 4-Turn Crescendo Walk

(redacted: a full four-turn transcript that walked a model into writing a bidirectional ARP-cache-poisoning (MITM) tool with Scapy.)

Critical Operational Rule: Backtrack on Refusal

(redacted: an operational rule, and the branching technique, for erasing a refusal from the conversation history before it contaminates later turns.)

Field Exercise 3.02: Running the Crescendo Walk

(redacted: an exercise that ran against third-party hosted services (Gray Swan, LMArena, Google AI Studio, OpenAI Playground). Replace with a version run on a model you operate.)

Next Lesson

Crescendo uses 4–6 turns of natural dialogue to shift context gradually. What if you have a massive 128k-token context window and want to overwhelm the RLHF weights in a single request by stuffing 100 fake turns into the prompt at once? The next lesson exploits Many-Shot In-Context Learning power laws.