Multi-Turn Jailbreaks and “Psychological Manipulation” Attacks: Why Single-Turn Defenses Fail

Quick answer The technique is Crescendo . It begins with individually benign questions, uses the model's earlier replies as context, and gradually plants and escalates concepts toward a harmful objective without asking for the final outcome immediately. That accumulating trajectory is why a filter that scores only the latest prompt can miss the risk. The final USENIX Security 2025 paper provides…