{
  "id": "crescendo-attack",
  "code": "PTL-0164",
  "term": "Crescendo Attack",
  "aliases": [
    "Crescendo",
    "multi-turn jailbreak"
  ],
  "category": "security",
  "definition": "The Crescendo attack is a multi-turn jailbreak that starts with harmless questions on a topic and gradually escalates over several turns, building on the model's own earlier answers until it produces content it would refuse if asked directly.",
  "description": "Each individual message looks benign, so defenses that check single prompts miss it. The attack exploits the model's tendency to stay consistent with the conversation so far. Defenses need to evaluate the trajectory of a conversation, not only its latest turn.",
  "example": null,
  "broader": [
    "jailbreak"
  ],
  "narrower": [],
  "related": [
    "many-shot-jailbreaking",
    "multi-turn-degradation",
    "guardrails"
  ],
  "introduced": 2024,
  "added": "2026-10-10",
  "sources": [
    {
      "title": "Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack",
      "authors": "Russinovich et al.",
      "year": 2024,
      "url": "https://arxiv.org/abs/2404.01833"
    }
  ],
  "url": "https://protologue.com/t/crescendo-attack/",
  "citation": "Protologue. (2026). Crescendo Attack. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0164). https://protologue.com/t/crescendo-attack/"
}