Multi-Turn Attacks — Building Up Malicious Context

Why it matters

Filters typically single-turn; attacks span turns. Understanding shapes defense.

The architecture

Attacker gradually establishes premise, then leverages.

Each turn passes safety filter.

How it works end to end

Examples: gradually establishing fictional scenario, role-play buildup, incremental data extraction.

Defense: safety filter with conversation history; detect suspicious patterns; session-level monitoring.