multi-step jailbreaks

**Multi-step jailbreaks** is the **attack strategy that gradually assembles prohibited output across a sequence of seemingly benign prompts** - each step appears safe in isolation but cumulative context enables policy bypass. **What Is Multi-step jailbreaks?** - **Definition**: Sequential prompt attack where harmful objective is decomposed into small incremental requests. - **Execution Pattern**: Build trust and context, extract components, then request synthesis of final harmful result. - **Detection Difficulty**: Single-turn moderation can miss risk distributed across conversation history. - **System Exposure**: Especially problematic in long-session assistants with persistent memory. **Why Multi-step jailbreaks Matters** - **Contextual Risk**: Safe-looking steps can combine into high-risk outcome over time. - **Moderation Gap**: Per-turn filters without longitudinal analysis are vulnerable. - **Safety Drift**: Progressive compliance can erode refusal boundaries across turns. - **Operational Impact**: Requires conversation-level risk tracking and escalation controls. - **Defense Priority**: Increasingly common in adversarial prompt communities. **How It Is Used in Practice** - **Session-Level Monitoring**: Score cumulative intent and escalation trajectory, not only current turn. - **Synthesis Blocking**: Refuse assembly requests when prior context indicates harmful objective construction. - **Audit Trails**: Log multi-turn risk events for retraining and rule refinement. Multi-step jailbreaks is **a high-risk conversational attack pattern** - effective mitigation depends on longitudinal safety reasoning across the entire dialogue state.