This One Weird Trick: Multi-Prompt LLM Jailbreaks (Safeguards Hate It!)

This report examines multi-turn prompt attacks (many-shot jailbreaks) that incrementally steer LLMs toward unsafe outputs through techniques such as role-play, sycophancy-driven reinforcement, context saturation, and crescendo attacks that reuse the model’s own content. It emphasizes the need for scalable, repeatable evaluations and introduces two tools—PromptGenerator for generating escalating prompt sets and CrescendoAttacker for automated, cross-provider testing and behavioral classification—while outlining defensive directions including RLAIF and anti-sycophancy mitigations.