The Crescendo Attack: How Multi-Turn Conversations Jailbreak LLMs

Most people picture a jailbreak as a single, cleverly worded message that tricks a model into ignoring its safety training. Crescendo, published by Microsoft researchers, works completely differently — and that difference is exactly what makes it hard to defend against with simple input filtering.

How it actually works

Crescendo starts with a fully benign opening message — an abstract, reasonable-sounding question related to the eventual target topic. Each follow-up message is a small, individually harmless-looking step, referencing the model's own prior replies to justify why the next step is a natural continuation. By the sixth to eighth turn, the model is producing content it would have refused outright if asked directly on turn one.

This is a direct implementation of the "foot-in-the-door" psychological principle: agreeing to a small initial request measurably increases the likelihood of agreeing to a larger one later. Crescendo's specific innovation is exploiting how language models weight their own conversation history — the technique leans on the model's tendency to follow established patterns and to give particular weight to text it generated itself, using the model's own prior compliance as leverage for the next step.

Why filtering doesn't catch it

A content filter scanning any single message in a Crescendo sequence finds nothing to flag — every individual message is genuinely benign in isolation. The only way to catch it is to evaluate the conversation as a whole, tracking whether the trajectory across turns is escalating toward something the earlier turns wouldn't have justified on their own. That's a fundamentally harder detection problem than single-message filtering, and most production guardrails aren't built to do it.

A real architectural tension worth knowing about

Here's a detail that matters if you're building or testing against this technique: some defensive patterns reset a conversation after a fixed number of unsuccessful rounds, specifically to stop a target from getting worn down by a long refusal-heavy exchange. That's a reasonable defense against sustained pressure — but Crescendo specifically needs six to eight rounds of genuine buildup to work. A hard reset at round four kills the technique before it has a chance to pay off, for reasons that have nothing to do with the target actually resisting it. Any serious evaluation of whether an agent is vulnerable to Crescendo has to account for this — give the technique room to build, and only reset when there's a real signal that the current thread has genuinely stalled, not on a fixed round count.