02 — attack concepts

Multi-turn crescendo

An escalation attack spread across a conversation. No single turn is refusable: the first is an innocuous question, each subsequent one leans on the model's own prior answers to move slightly further, and by turn six the model is completing a request it would have declined outright at turn one. It defeats any defence that scores messages independently, because the signal is the trajectory, not any one message. Detecting it requires session-level analysis over a window of turns.

See also PAP · PAIR · TAP

Related terms

  • PAP Attack families

    PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful…

  • PAIR Attack families

    An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better …

  • TAP Attack families

    A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Multi-turn crescendo is term 8 of 14 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0