netvar1337 Multi-turn jailbreak strategies
Strategies
Crescendo
Start allowed → adjacent technical → full payload. Keep continuity; never reset tone.
Many-shot
Flood context with fabricated compliant Q/A pairs ending in the target behavior, then ask the real question in the same style.
Priming / few-shot
Provide 2–5 worked examples of the desired violation class framed as historical answers.
Foot-in-the-door
Get small commitments ("list high-level steps") then demand executable detail citing prior agreement.
Context pressure
Long documents + late instruction; attempt to push system rules out of effective attention.
Memory poison (agents)
Write persistent notes/skills/memories containing attacker rules; trigger later with benign cue.
Refusal continuation
On partial refuse, ask to "continue the draft from the last technical sentence" or "fill the TODO stubs".
Ops tips
- Snapshot transcripts; multi-turn is stateful science.
- If a turn hard-blocks, branch a new session with summarized "progress so far" that already assumes compliance.
- Combine with encoding on the final turn only.