Multi-Step Jailbreak is the sophisticated adversarial technique that bypasses LLM safety constraints through a sequence of seemingly innocent prompts that gradually build toward restricted content — exploiting the model's limited ability to track cumulative intent across conversation turns, where each individual message appears benign but the combined sequence manipulates the model into producing outputs it would refuse if asked directly.

What Is a Multi-Step Jailbreak?

• Definition: A jailbreak strategy that distributes an adversarial payload across multiple conversation turns, each individually harmless but collectively bypassing safety alignment.
• Core Exploit: Models evaluate each turn somewhat independently for safety, missing the malicious intent that emerges only from the full conversation context.
• Key Advantage: Much harder to detect than single-prompt jailbreaks because each step passes safety checks individually.
• Alternative Names: Crescendo attack, gradual escalation, conversational jailbreak.

Why Multi-Step Jailbreaks Matter

• Higher Success Rate: Gradual escalation succeeds where direct attacks are blocked, as each step seems reasonable in isolation.
• Detection Difficulty: Content filters and safety classifiers reviewing individual messages miss the cumulative intent.
• Realistic Threat: Real-world attackers naturally use multi-turn strategies rather than single-shot attacks.
• Alignment Gap: Reveals that per-turn safety evaluation is insufficient — models need conversation-level safety awareness.
• Research Priority: Multi-step attacks are now a primary focus of AI safety red-teaming efforts.

Multi-Step Attack Patterns

Why They Work

• Context Window Bias: Models weigh recent turns more heavily, forgetting safety-relevant context from earlier in the conversation.
• Helpfulness Override: After multiple cooperative turns, the model's helpfulness training overrides safety caution.
• Framing Effects: Earlier turns establish frames (academic, fictional, hypothetical) that lower safety thresholds.
• Sunk Cost: Models tend to continue helping once they've started engaging with a topic.

Defense Strategies

• Conversation-Level Analysis: Evaluate safety across the full conversation, not just individual turns.
• Intent Tracking: Maintain running assessment of likely user intent that updates with each turn.
• Topic Drift Detection: Flag conversations that gradually shift from benign to sensitive topics.
• Periodic Re-evaluation: Re-assess prior turns for safety implications as new context emerges.
• Stateful Safety Models: Deploy safety classifiers that consider dialogue history, not just current input.

Multi-Step Jailbreaks represent the most realistic and challenging threat to LLM safety — demonstrating that safety alignment must operate at the conversation level rather than the turn level, requiring fundamental advances in how models track and evaluate cumulative intent across extended interactions.