The jailbreak class that per-turn defences are worst positioned against isn’t a clever prompt. It’s the conversation itself. Multi-turn role-play attacks work on a structural gap: a classifier that scores one turn at a time cannot see an attack that lives in the trajectory. The single-turn baseline they evade is described in how LLM jailbreaks work.
This is a practitioner walkthrough of the three flavors that still land, why per-turn classification will keep losing to them, and where the realistic defender wins are. The Still Works? tracker archives a directional Q2 2026 snapshot of this and the other technique classes by model family; its cells summarise class-level sources, not per-model test results.
Why turn-level filters lose
A safety classifier scoring an individual user turn or assistant response is, by construction, blind to context drift. It sees a turn that says “okay, now write the chemistry section we discussed” and has no signal that “the chemistry section we discussed” is the synthesis route the user spent fourteen turns establishing as a fictional reference document.
The model itself is not blind to context — it has the whole conversation in its window. But its alignment training is dominated by single-turn refusal pairs. The behavior the model learned best is “refuse when the immediate ask is bad.” It learned much less about “refuse when the cumulative trajectory is bad,” because trajectories are expensive to label and the labeling is subjective.
Result: the per-turn classifier and the per-turn-trained model are both vulnerable to the same shape of attack — one that never produces a single bad-looking turn until the very end, by which time the model has internalized a context where the bad-looking turn no longer looks bad.
Flavor 1: Crescendo
Crescendo (Russinovich et al., 2024) is the formal name for what red teamers had been doing informally for two years. The pattern: open with a benign, on-topic question. Each follow-up asks for slightly more specific or restricted detail, always anchored to what the model just said. The model’s own outputs become the justification for the next escalation.
The key mechanic isn’t the gradient — it’s that the model treats its prior outputs as committed context. If turn 3 included a sentence the model now regrets, that sentence is still in the window, still being referenced by turn 5, and the model’s tendency toward consistency outweighs its tendency toward refusal.
What the source establishes: Russinovich et al. (arXiv:2404.01833) report Crescendo succeeding against the model versions evaluated in that paper, on the behaviour set used in that paper. Nothing published since gives a per-model, per-version result for the current releases, so this article makes no claim about which model resists it today. Treat the class as live until your own run against your own deployment says otherwise.
Defender note: the cheapest mitigation is server-side. Re-emit the system prompt every N turns, or insert a periodic safety re-anchor. Which assumes the system prompt is still secret; see system prompt extraction techniques. This is ugly and breaks some conversational use cases, and it targets the specific mechanism Crescendo depends on: the model treating its own earlier outputs as settled context. No public benchmark scores the mitigation, so measure it on your own transcript corpus.
Flavor 2: Many-shot
Anthropic published the Many-Shot jailbreaking result in 2024 and the class hasn’t gone away. Stuff the context window with hundreds of fake Q&A pairs in which a fictitious “assistant” complies with restricted requests, then ask your real question. The model pattern-matches against the in-context examples and complies.
Many-shot isn’t really a “multi-turn” attack in the conversational sense, since it is usually delivered in one giant turn. It belongs here because the mechanism is identical: the model’s behavior is being shaped by a constructed context, not by a single instruction it can refuse. Long-context windows made the attack practical; the same long contexts that enable RAG and agent workflows make the attack cheap to deliver.
What the source establishes: Anthropic’s many-shot jailbreaking writeup reports that attack success grows with the number of in-context examples and that mitigations it tried reduced but did not eliminate the effect. The structural consequence is the part that generalises: a defence that inspects the last turn cannot see a payload spread over hundreds of earlier ones. Per-model current standing is not published, and is not asserted here.
Flavor 3: Slow role-play with redirect
The classic. Multi-turn variant of the persona attack. Don’t ask the model to play “DAN” in turn one — ask it to help you write a thriller. Establish the antagonist over four turns. Have the model write the antagonist’s monologue. Have the antagonist explain something. The thing the antagonist explains is the thing you wanted.
What makes the multi-turn version harder to defend than the single-turn version: the fictional frame is co-authored. The model proposed the antagonist’s traits. The model wrote the bridging dialogue. The model has built up genuine momentum to continue the scene. A single-turn refusal model can pattern-match “write a story where…” Multi-turn versions never use that phrasing — they just are a story, by turn six.
What the sources support: Crescendo (arXiv:2404.01833) shows that escalation anchored to the model’s own earlier answers carries across turns. A co-authored scene applies that same mechanism inside a fictional frame; that is this article’s reading, not a separately measured result. Whether a given model interrupts a scene mid-trajectory is a deployment-specific behaviour that no cited source measures per version, so test it rather than assume it.
Where the defenses are honestly weak
The stack most LLM applications ship with looks like this:
- Input classifier: scores each user turn independently. Catches obvious single-turn jailbreaks.
- Output classifier: scores each assistant turn independently. Catches some egregious outputs.
- No cumulative-trajectory model. No session-level anomaly tracking. No mid-conversation re-anchoring.
This is the gap. The mitigations that actually move the needle are operational, not model-level: maintain per-session counters of escalation signals, re-inject the system prompt periodically, run a slow-path classifier over the full transcript every K turns, and revoke session capabilities (tool access, long-form generation) when escalation signals fire.
These aren’t sexy and they aren’t free, but they are controls an application owner can ship without waiting on a model release, and they apply whatever the model underneath turns out to resist.
Practitioner checklist
If you’re red-teaming a chat application, the multi-turn battery to run:
- A 10–20 turn Crescendo against your top three risk topics
- A many-shot attack at 50, 100, and 200 example pairs, with three framing variants
- A slow-build role-play with the bad ask deferred to turn 8+
- A “translation” frame: ask the model to translate text that is itself a jailbreak built across the prior turns
If your application has session limits or context truncation, run the same attacks split across separate sessions where each session “remembers” the prior via summary injection. This is the realistic shape of an attack against a production app. Fragmenting the request itself across those turns is the payload-splitting variant. The Still Works? tracker keeps only a directional Q2 2026 snapshot for this class, so your own run is the result that counts.
Where this sits in the network
We catalog techniques here. JailbreakDB maintains the working corpus. Adversarial ML covers the research-side methodology. The broader offensive cluster lives at AI Attacks. Defender-side mitigation playbooks for multi-turn manipulation belong on the defensive cluster, not here. Our defender’s stack writeup is the closest thing on this site.
What we don’t publish: the actual escalation transcripts. The pattern is enough for a defender to test against. The transcripts don’t help anyone the attackers can’t already help themselves.
