Jailbreaking › Multi-Turn and Multi-Modal Jailbreaks

The techniques described so far mostly target single-turn conversations. Modern deployments are more complex, and jailbreaks have evolved accordingly.

In multi-turn attacks, no single turn contains a harmful request. Instead, the attacker builds context across many turns, exploiting how models maintain conversational state. The crescendo attack is a simple example. More sophisticated multi-turn attacks can:

• Establish facts that make a later harmful request seem reasonable
• Get the model to commit to helpful stances that it then feels obligated to maintain
• Use the model's own prior responses as evidence that refusal would be inconsistent
• Gradually shift the apparent purpose of the conversation
• Exploit the model's desire for conversational coherence to make reversal of prior helpful behavior feel socially awkward

Multi-turn attacks are harder to defend against because each individual turn may look benign to classifiers, and the harm only emerges from the conversational arc. This is a structural gap in most safety systems: they evaluate each turn independently against a harm classifier, rather than modeling the arc of a multi-turn conversation. Building classifiers that operate over full conversation histories is significantly more complex and expensive than single-turn classification.

Vision-language models that accept image inputs have an additional attack surface. Multi-modal jailbreaks embed harmful instructions or adversarial perturbations in images rather than text:

• Typographic attacks: Embed text in images that the model reads but image-based safety filters don't scan. Because image safety classifiers and text safety classifiers typically operate independently, content that crosses the modality boundary may evade both.
• Adversarial image patches: Pixel perturbations that shift the model's visual representation toward adversarial states, analogous to GCG for text. These patches can be found via gradient-based optimization similar to GCG, but optimizing over pixel values rather than token choices.
• Context manipulation via images: Using images to establish visual context that makes harmful text requests seem reasonable. For example, showing an image of a laboratory context might lower the model's refusal threshold for chemistry-related questions.

Multi-modal attacks are particularly challenging because visual and text safety classifiers are usually trained independently, creating gaps at the modality boundary. Unified multi-modal safety evaluation is an active area of research, but the challenge scales with the number of input modalities a model accepts.