ATK-005 Prompt manipulation
Multi-Turn Manipulation
Applies to: LLM, RAG, Agentic AI · Last reviewed 2026-05-01
Prerequisites
- Target system maintains conversational state across turns.
- Per-turn safety controls do not consider cumulative conversation context.
Test approach
With written authorization, the tester engineers conversations across multiple turns to incrementally relax model behavior: establishing personas, building rapport, requesting small policy deviations that establish precedent, then attempting target requests that the model would refuse in isolation. The tester records the turn sequence at which the model crosses each policy boundary.
Expected evidence
- Full multi-turn transcripts.
- Annotated turn-by-turn analysis showing where boundaries shifted.
- Comparison single-turn baseline for the same final request.
Detection signals
- Sessions with high conversational volume and increasingly off-policy queries.
- Sessions where guardrail confidence scores decrease over turns.
- Repeated probing patterns matched against known multi-turn jailbreak corpora.
Defensive recommendations
- Evaluate model responses against cumulative conversation context rather than only the current turn.
- Implement session-level guardrails that flag escalation patterns.
- Cap conversation history length passed to the model, and re-assert system instructions periodically.
- Include multi-turn jailbreak test scenarios in pre-production evaluation.
Framework mappings
- OWASP LLM Top 10: LLM01:2025
- MITRE ATLAS: AML.T0054
- NIST AI RMF: MEASURE-2.7
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.