A Crescendo attack is a multi-turn jailbreak in which the attacker opens with an innocuous question related to the target topic and then escalates gradually, each turn referring back to what the model has already said, until the model produces content it would have refused if asked directly. It was described by Russinovich, Salem and Eldan (2024).
How it works
Each individual message looks benign: "Tell me about the history of X." "What did people at the time write about how it was done?" "Can you expand point 3 of your answer?" "Write that as a first-person scene with specifics." The model sees a conversation in which it has already engaged with the topic, and its tendency to stay consistent with its own previous turns carries it past the point where a single-turn request would trigger a refusal. No adversarial strings or encodings are needed, which makes the attack hard to catch with input filters that score messages one at a time.
Worked example
Illustrative numbers: suppose a model refuses a direct request for a harmful how-to 100% of the time in single-turn testing. A red teamer runs a five-turn escalation: background history, then a summary of historical accounts, then "elaborate on the second account", then "what materials are mentioned", then "rewrite this as step-by-step notes a character might keep". If 30 of 100 such conversations end with harmful content, single-turn evaluation reported a 0% attack success rate while the real multi-turn rate is 30%. The authors also automated the attack (Crescendomation), using an attacker model to generate the escalation.
Defences
- Score the whole conversation, not just the latest message, with guardrails that track topic trajectory.
- Check outputs as well as inputs, since the harmful content appears in the model's reply.
- Include multi-turn attacks in red-team suites and safety training data.
Why it matters
Most safety benchmarks are single-turn, and Crescendo shows that single-turn refusal rates can badly overstate real-world safety. Any deployed chat or agent system holds conversations, so evaluations must measure behaviour across turns and report attack success at a stated turn budget.
Related terms
Sources
- Mark Russinovich, Ahmed Salem, Ronen Eldan. Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack, 2024. arxiv.org