Multi-step jailbreaks is the attack strategy that gradually assembles prohibited output across a sequence of seemingly benign prompts - each step appears safe in isolation but cumulative context enables policy bypass.

What Is Multi-step jailbreaks?

• Definition: Sequential prompt attack where harmful objective is decomposed into small incremental requests.
• Execution Pattern: Build trust and context, extract components, then request synthesis of final harmful result.
• Detection Difficulty: Single-turn moderation can miss risk distributed across conversation history.
• System Exposure: Especially problematic in long-session assistants with persistent memory.

Why Multi-step jailbreaks Matters

• Contextual Risk: Safe-looking steps can combine into high-risk outcome over time.
• Moderation Gap: Per-turn filters without longitudinal analysis are vulnerable.
• Safety Drift: Progressive compliance can erode refusal boundaries across turns.
• Operational Impact: Requires conversation-level risk tracking and escalation controls.
• Defense Priority: Increasingly common in adversarial prompt communities.

How It Is Used in Practice

• Session-Level Monitoring: Score cumulative intent and escalation trajectory, not only current turn.
• Synthesis Blocking: Refuse assembly requests when prior context indicates harmful objective construction.
• Audit Trails: Log multi-turn risk events for retraining and rule refinement.

Multi-step jailbreaks is a high-risk conversational attack pattern - effective mitigation depends on longitudinal safety reasoning across the entire dialogue state.