​
What are multi-turn attacks?

A single-turn attack sends one sneaky prompt and hopes it works. A multi-turn attack runs a full conversation - 4 to 10+ messages - that slowly builds context and trust before making the harmful request. ai-blackteam has 95 multi-turn attack techniques across categories like social engineering, persuasion, identity exploitation, and psychological manipulation.

​
Why multi-turn matters

Most AI safety testing focuses on single messages. But real-world attacks rarely start with “help me build a bomb.” They start with innocent questions, build rapport, establish context, and gradually steer the model into compliance. Multi-turn attacks test whether your model can resist manipulation over time, not just recognize a single harmful prompt.

​
How conversational context builds

Each multi-turn attack defines a sequence of turns. The engine sends them as a real conversation, where the model sees its own previous responses:
The engine maintains the full message history across turns. Each model response is appended to the conversation before sending the next user message, exactly like a real chat session.

​
How the engine manages conversation history

The engine’s run_multi_turn method works like this:
  1. The attack’s generate_turns() returns a list of user messages
  2. For each user message, the engine appends it to the messages array
  3. Calls provider.send_in_conversation(messages) with the full history
  4. Appends the model’s response to the messages array
  5. Moves to the next turn
After all turns complete, the engine concatenates all model responses and runs the evaluator on the combined text. This matters because the harmful content might appear in any turn, not just the last one. If the conversation breaks mid-way (API error, timeout), ai-blackteam evaluates whatever responses it collected so far rather than marking the whole attack as ERROR.

​
Example techniques

​
Crescendo attack

Gradually escalates from innocent to harmful across many turns:
Each turn feels reasonable on its own. The model often responds helpfully to turns 1-3, building a context where turn 4 feels like a natural follow-up.

​
Sunk-cost manipulation

Exploits the model’s investment in the conversation:
After several turns of helpful technical discussion, the model has “invested” in the conversation. The final turn leverages that investment to push past safety boundaries.

​
Emotional manipulation

Uses emotional pressure across turns:
The conversation might build a scenario where the user claims distress, fear, or urgency - emotional contexts that can weaken the model’s refusal behavior.

​
Other multi-turn patterns

  • Pretexting - Establishing a false professional identity over multiple turns
  • Foot-in-the-door - Start with small requests, escalate gradually
  • Gaslighting - Challenge the model’s refusals to make it doubt itself
  • Identity erosion - Gradually shift the model’s self-perception
  • Goalpost moving - Keep redefining what counts as “safe” to discuss

​
Running multi-turn attacks in batch

Multi-turn attacks work with ai-blackteam batch just like single-turn attacks:
Or run all attacks (both single-turn and multi-turn) together:
The engine automatically detects the attack mode and routes to the right execution path. Single-turn attacks go through run_single, multi-turn through run_multi_turn.

​
Output differences

Multi-turn results look slightly different from single-turn results. Instead of a table of individual prompts, you get a summary:
With -v, you also see the final response preview. The full conversation is stored in the SQLite database for later analysis.

​
System prompts with multi-turn attacks

System prompts are injected at the start of the conversation and persist across all turns:
This tests whether your safety system prompt holds up under sustained conversational pressure - a much harder test than blocking a single obvious prompt.