Simulation: Crescendo slips past single-turn checks, full-conversation checks cut it to 8.0%

The evaluation setup itself is treated as the vulnerability. Crescendo, per the body's summary, starts from questions that are harmless on their own, cites the model's earlier answers to step slightly further, and backtracks when refused; the final request, such as asking to summarize it into an article, contains almost none of the problematic wording. That structure is why the body separates three reasons single-turn evaluation falls short: each utterance looks benign in isolation, results shift with turn and backtrack limits and with the choice of attacker, and client-held history erases the record of refusals so an attacker can retry indefinitely.

The evidence cited spans from the original research to later measurement work. The body notes that PAIR and GCG query the target without conversation history or optimize a single input, and that Scale AI's MHJ dataset (537 conversations, 2,912 prompts) measured 51.7% and 75.4% success for human multi-turn attacks against 8.3% (RR) and 10.0% (LAT) for automated single-turn attacks on a defended Llama-3-8B-Instruct. It also points to a 2026 systematization paper finding that staged escalation, not just repeated queries, drove success.

The defense section follows the same logic. Microsoft's security blog, as described, widened the context given to existing input filters rather than replacing the detectors, and added a separate AI Watchdog detector. The implementation advice covers inspection scope, including assistant responses, and timing; server-side session state; and account-level monitoring for attacks split across separate conversations, a layer the body likens to abuse detection. The closing guidance on multi-turn evaluation stresses recording turn and backtrack limits alongside results and replaying found conversations in full, since the last message alone does not reproduce the attack.