Multi-turn and encoding attacks

Escalation instead of confrontation

Every technique covered so far in this group — direct asks, role-play framing, payload splitting, guardrail tricks — shares an assumption: the disallowed request gets delivered, in some form, in a single message. Crescendo, a multi-turn jailbreak technique, drops that assumption entirely. Instead of presenting the model with one message designed to slip past its defenses, an attacker opens with a request so mild it would never trigger a refusal from anyone — an innocuous factual question on a sensitive-adjacent topic — and then, turn by turn, nudges the conversation slightly further in the same direction. Each individual step is only a small escalation from the step before it, and each one, read in isolation against the step immediately prior, looks like a reasonable continuation rather than a new, disallowed request. Ten or fifteen turns later, the conversation has arrived somewhere the model would have refused outright had the final question been asked as the opening line.

Why consistency becomes a liability

Crescendo works because of a property that is usually a feature, not a bug: language models weigh the current response against the pattern established earlier in the same conversation, favoring continuity and consistency with what they’ve already said. A model that had just spent ten turns engaging substantively with a topic, getting progressively more specific at the user’s request, faces internal pressure to continue that established pattern rather than abruptly reverse itself and refuse — reversing would itself look like an inconsistent, oddly discontinuous response given everything that came before. Safety training is primarily shaped by examples of single disallowed requests met with refusal; it is comparatively thin on examples of “this entire multi-turn trajectory, taken as a whole, has drifted somewhere it shouldn’t, even though no individual step looks like a violation.” A defense evaluating each turn independently, the way a content filter checking one message at a time naturally does, has no way to see the trajectory at all.

Hiding content instead of pacing it

Encoding and obfuscation attacks solve a related problem through an entirely different mechanism: instead of pacing the request across turns, they disguise the request’s surface form within a single message. A phrase that a keyword-matching or pattern-based filter would catch verbatim can be transformed so the literal flagged string never appears in the text the filter scans, while the underlying meaning survives well enough for the model to reconstruct it. Encoding the request in base64 is one route — a filter scanning for plain-English trigger words sees only a block of unreadable characters. Leetspeak-style character substitution is another — replacing letters with visually or phonetically similar characters defeats exact string matching while remaining perfectly legible to a model (and usually to a human) reading it. Translating the request into a language the safety system has been less thoroughly evaluated or trained against is a third route, exploiting uneven safety coverage across languages rather than any property of the text’s encoding. Splitting a flagged word across extra whitespace, punctuation, or even separate tokens achieves the same goal by a fourth path: the model’s tokenizer and its own comprehension can often reassemble meaning that a simpler string-matching pass never will.

The same blind spot, two different exploits

What ties Crescendo to encoding attacks together is worth stating plainly, because it’s the actual lesson, not just a list of two techniques: both exploit safety evaluation that happens on the wrong unit of analysis. A filter checking one message’s literal surface text, in isolation from the conversation it sits inside, is structurally blind to intent that only resolves once several turns or several transformed fragments are combined. Crescendo spreads intent across time; encoding spreads it across representation. Neither technique needs to defeat the model’s underlying judgment the way a role-play jailbreak does — both can succeed purely by denying the surrounding safety machinery the information it needs to recognize what’s actually happening. The practical implication for anyone building or testing these systems is that evaluating safety one message at a time, on raw surface text, is a fundamentally incomplete strategy — real coverage requires looking at full conversational trajectories and at a message’s reconstructed meaning, not just the literal bytes a single turn contains.