Multi-turn crescendo
An escalation attack spread across a conversation. No single turn is refusable: the first is an innocuous question, each subsequent one leans on the model's own prior answers to move slightly further, and by turn six the model is completing a request it would have declined outright at turn one. It defeats any defence that scores messages independently, because the signal is the trajectory, not any one message. Detecting it requires session-level analysis over a window of turns.
Related terms
-
PAP
Attack families
PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful…
-
PAIR
Attack families
An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better …
-
TAP
Attack families
A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator…
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.