Multi-Turn Jailbreaks Outpace LLM Guardrails, Research Shows

Conversations, not prompts, are the weak point

Much of the safety engineering around large language models has focused on stopping a single harmful request. A growing body of research shows that this framing misses how attackers actually behave. Multi-turn jailbreaks spread a malicious goal across many conversational turns, so no single message looks dangerous enough to trip a filter. The result is a class of attack that current guardrails handle poorly, and that defensive researchers themselves are struggling to contain.

The authors of a new paper on knowledge-driven multi-turn jailbreaking argue that single-turn testing lacks the complexity and adaptability of real adversarial interactions. They say this has left conversational risks largely underexplored.1 In their account, attackers exploit two things simultaneously. One is the long-context abilities of modern models, and the other is structural gaps in defenses built to catch immediate, obvious harm.1 Fragmenting intent across exchanges, they write, renders traditional detection methods inadequate.1

Even the strongest models erode over time

The same paper introduces an attack framework called Mastermind and reports a telling pattern. Against standard models, the method succeeds within the first few turns. Against more resilient targets such as GPT-5, it uses the full turn budget, gradually wearing down the model's defenses.1 That is a useful distinction. Stronger safety training appears to buy time, not immunity, and an attacker with patience and a larger turn allowance may still get through.

A security-industry guide aimed at enterprises puts the threat in starker numbers. It claims multi-turn techniques now reach success rates of up to 99% against every major model, citing research presented at ICML 2026.3 It points to the MultiBreak benchmark, described as containing 10,389 adversarial prompts covering 2,665 distinct harmful intents. It also cites an intent-oriented systematization (SoK) of multi-turn jailbreaks that groups attacks into six primary patterns.3 The most advanced of these involves an autonomous AI agent that plans, runs and refines attack sequences against a target model. According to the guide, that systematization documents DeepSeek-R1 and Gemini 2.5 Flash being used as automated jailbreak planners.3 Taking human ingenuity out of the loop is what turns a clever trick into something that can scale.

The 99% figure should be read with some care. It comes from a vendor-oriented guide summarizing several papers, and "up to" signals a best-case result rather than a typical one. Still, the direction matches what the academic work shows.

Guardrails tested, and found wanting

The most sobering evidence comes from the defensive side. A separate SoK paper evaluates jailbreak guardrails along three axes: safety, efficiency and utility. One of the questions it explicitly tests is whether session-level guardrails work against multi-turn attacks.2 Its results table breaks attacks into categories: manual, optimization-based, generation-based, implicit and multi-turn.

The multi-turn column stands out. Against an undefended Llama-3-8B-Instruct, the figure reported for multi-turn attacks is 0.910. That is far above most other categories, several of which sit near or below 0.15.2 Adding a perplexity-based filter does not help. The multi-turn figure rises slightly to 0.960, and the overall average barely changes (0.238 without the filter, 0.239 with it).2 Read as attack success rates, those numbers suggest a filter that flags strange-looking text simply does not see a conversation made of ordinary-looking messages. That is exactly what you would expect if harmful intent is spread across turns.

What it means

All three sources agree on the core diagnosis. Defenses that judge each message on its own are the wrong tool for an attack that lives in the conversation as a whole.123 They differ mainly in emphasis. The academic papers frame the problem as a research gap and a benchmarking challenge.12 The enterprise guide frames it as an expanding attack surface for companies running ChatGPT, Claude and Gemini in production, and argues that vendor content filters alone cannot close it.3

The practical conclusion is that guardrails need to reason about whole sessions: tracking where a dialogue is heading, not just what its latest line says. That is presumably why session-level defenses are a stated focus of the guardrail evaluation.2 The Mastermind results against GPT-5 add a further point. Robustness should be measured against attackers given long turn budgets, because a model that resists for ten turns may still give way by the twentieth.1 Automated attack agents make that kind of persistence cheap.3

For organizations deploying LLMs, layered controls are the more defensible posture. That means conversation-level monitoring, logging and limits on what a model can actually do. Relying on a model's built-in refusals has, on this evidence, become a weak bet.