# Crescendo Attack

> The Crescendo attack is a multi-turn jailbreak that starts with harmless questions on a topic and gradually escalates over several turns, building on the model's own earlier answers until it produces content it would refuse if asked directly.

- Identifier: PTL-0164
- Category: Security & Adversarial Prompting
- Canonical URL: https://protologue.com/t/crescendo-attack/
- Also known as: Crescendo, multi-turn jailbreak
- Introduced: 2024

## Description

Each individual message looks benign, so defenses that check single prompts miss it. The attack exploits the model's tendency to stay consistent with the conversation so far. Defenses need to evaluate the trajectory of a conversation, not only its latest turn.

## Broader terms

- [Jailbreak](https://protologue.com/t/jailbreak/)

## Related terms

- [Many-shot Jailbreaking](https://protologue.com/t/many-shot-jailbreaking/)
- [Multi-Turn Degradation](https://protologue.com/t/multi-turn-degradation/)
- [Guardrails](https://protologue.com/t/guardrails/)

## Sources

- Russinovich et al. (2024). Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack. https://arxiv.org/abs/2404.01833

## Cite this entry

Protologue. (2026). Crescendo Attack. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0164). https://protologue.com/t/crescendo-attack/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)