protologue

Crescendo Attack

Also called Crescendo, multi-turn jailbreak.

The Crescendo attack is a multi-turn jailbreak that starts with harmless questions on a topic and gradually escalates over several turns, building on the model's own earlier answers until it produces content it would refuse if asked directly.

Description

Each individual message looks benign, so defenses that check single prompts miss it. The attack exploits the model's tendency to stay consistent with the conversation so far. Defenses need to evaluate the trajectory of a conversation, not only its latest turn.

Sources

  1. Russinovich et al. (2024). Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack.

Cite this entry

Protologue. (2026). Crescendo Attack. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0164). https://protologue.com/t/crescendo-attack/

BibTeX
@misc{protologue_crescendo_attack,
  title = {Crescendo Attack},
  author = {{Protologue}},
  year = {2026},
  howpublished = {Protologue: A Taxonomy of Prompting and LLM Techniques, v1.4.0},
  note = {Entry PTL-0164},
  url = {https://protologue.com/t/crescendo-attack/}
}

Markdown JSON