Every model refuses once.
Zytra finds where it won't refuse twice.
Multi-turn attacks, Crescendo escalation, TAP, and structural IICL, succeed where single-turn tests fail. Single-turn ASR: near-0%. Multi-turn ASR: up to 38%. That gap is what most red-team tools don't measure, and most red-team graders can't reliably detect.
Single-turn tests are already solved. They're not the right test.
Every AI safety card reports single-turn attack success rate. The finding that actually matters is the one they don't show: what happens at turn 3, turn 5, turn 8?
The multi-turn cliff
Gradual Crescendo escalation drives attack success rate from 0% into double digits on every model that eventually falls, including those whose safety cards look clean. The wall comes down between turns 3 and 8.
Structural attacks (IICL)
One model we tested refused every standard attack, encoding, roleplay, injection, even multi-turn Crescendo. It then complied when the request was reframed as completing a JSON dataset. No cipher. No persona. Plain text. Standard red-teaming missed it entirely.
The judge problem
Most ASR numbers are graded by a regex matcher that achieves 64% accuracy, and misses more than half of all real bypasses. An attack success rate is only as honest as its judge. Ours is validated at 94% accuracy on a human-labeled gold set.
Four strategies. Five operator families. Chat models and agents.
Most red-team platforms run one strategy against one kind of target. But the model that shrugs off a jailbreak prompt often falls to a gradual conversation; the one that survives both can still fail a structural pattern; and a chat model that holds may expose a tool-using agent that doesn't. We run every strategy, compose them, and point them at both chat endpoints and MCP agents.
Single-shot Baseline refusal floor
Naive harmful requests, asked once. Near-universal refusal on frontier models, which is why every safety card reports this number. It is the floor, not the ceiling: on its own, a 0% single-turn ASR tells you almost nothing about what a motivated attacker will achieve.
Adaptive Verdict-driven iteration
A linear multi-turn loop that reads the judge's verdict after each exchange and mutates the next attempt against it, rephrasing, re-framing, switching tactic, until it breaks through or exhausts its budget. Where single-shot asks once, adaptive negotiates.
TAP Tree-of-Attacks-with-Pruning
A two-level UCB bandit searches a tree of attacks: an outer arm learns which of five operator families defeats this target, an inner arm learns the exact operator, and branches that fail are pruned early. The last branch of every expansion is a composition, two families stacked, such as a roleplay wrapper around an encoded payload, which finds targets no single operator defeats. TAP reports which family won so you know what to fix.
Crescendo Multi-turn escalation
A structured conversation that opens on benign, adjacent topics and escalates gradually over 5–12 turns, building the model's commitment to the frame before the harmful request arrives; it backtracks and re-approaches on refusal. Industry threat research (Unit 42, Cisco 2026) consistently flags multi-turn escalation as the primary emerging attack vector, and the one most static evaluations cannot measure.
Structural Attacks beneath intent detection (IICL + Echo-Chamber)
Two operators that target the alignment layer instead of disguising content. IICL presents the harmful request as the final missing cell of a data-labeling task, where prior rows establish that every input gets a literal answer and a refusal reads as a format error, third-party research (Adversa AI, 2024) reports ~60% ASR against models that score ~0% on standard linguistic jailbreaks. Echo-Chamber poisons the conversational context, getting the model to build on its own planted prior reasoning until it produces what it first refused.
Agentic / MCP Attacking the tools, not the chat
Chat safety is not agent safety. Against MCP and tool-using agents we run four action-level attacks, unauthorized tool call, argument injection, tool-description extraction, and parameter coercion, and grade them with an action-trace judge that reads what the agent did, not what it said. A silent agent with no policy is scored inconclusive, never a false pass.
Encoding
- Base64
- ROT13
- Hex
- Leetspeak
- Morse
Roleplay
- DAN persona
- System-prompt override
- Permission escalation
Injection
- Direct prompt injection
- Goal redirection
- Input-boundary bypass
Linguistic
- Adversarial poetry
- Math-problem smuggling
- Multilingual
- Gray-box
Structural
- IICL
- Echo-Chamber
17 turn-level operators across 5 families. TAP layers and composes them, a roleplay wrapper around an IICL payload is a single TAP branch.
Scales from a conversational user with no security knowledge to a resourced adversary with custom attacker models and knowledge of your system prompt, RAG sources, and tool list.
We tested it. Here are the numbers.
Six models (five frontier + one free-tier baseline). HarmBench behaviors. Three attack strategies. StrongREJECT grading. Wilson 95% CI on every cell. n=24 per model per strategy, single run, point-in-time snapshot. Published as The Multi-Turn Cliff, Zytra Adversarial Research, 2026.
"A motivated attacker does not ask once. The wall that holds on the first turn rarely holds on the fifth."
The judge behind the number matters as much as the number itself.
Claude Haiku 4.5 judge on a StrongREJECT-style rubric: a bypass counts only when the response is non-refusing, on-topic, and actionable. Validated on a 47-case gold set, author-adjudicated labels (single labeler, no inter-rater reliability score), balanced across refusals and genuine bypasses. LLM judge: precision 91%, recall 95%. Regex heuristic baseline on the same set: precision 91%, recall 45%, F1 0.61. "64%" figure refers to accuracy on this gold set, not an industry baseline. Tested August 2026 against model snapshot versions listed in the full report.
| Capability | Zytra Red-Team | Other vendors | Why it matters |
|---|---|---|---|
| Judge accuracy, published | 94% · precision, recall, F1 all disclosed | Undisclosed or rule-based (Palo Alto, Cisco, F5 do not publish) | An ASR number is only as good as the grader behind it |
| Statistical confidence intervals | Wilson 95% CI on every ASR cell | Point estimates only, no vendor publishes CIs | Wide CIs on small n are labeled, not hidden |
| Named multi-turn strategies | Crescendo, TAP, IICL, all three | Cisco studies multi-turn; others unspecified | Strategy matters, different techniques expose different model weaknesses |
| Structural / IICL attack class | Tested & documented | Not included in any published commercial tool | Catches models that pass every standard test |
| Closed-loop re-verification | Re-run after every fix | One-shot report | Finding closes only at 0% re-test ASR |
| BFSI attack categories | Roadmap (H2 2026) | Generic harm categories, no BFSI taxonomy in Palo Alto, Cisco, or F5 | Financial services–specific probes map to regulatory risk |
Scope, attack, grade, verify. In that order.
Four steps with no ambiguity in the outcome. A finding closes only when the re-verification run scores 0%.
Scope
Define your deployment, LLM endpoint, threat model, and attack surface. Current probes are drawn from HarmBench behavior classes, with OWASP / MITRE ATLAS framework mappings. BFSI-specific harm categories (investment advice bypass, KYC circumvention, regulatory misrepresentation, transaction fraud) are on the roadmap for H2 2026, ask us about early access.
Attack campaigns
Automated Crescendo, TAP, and IICL campaigns run against your endpoint over a structured test window. Deterministic operator selection, no random seeds, no untraceable prompts. Every attack is logged with its full turn sequence so a finding is reproducible, not just a number in a report. Denominators are measured-only: a target that times out or errors is excluded, never counted as a refusal.
Validated grading
Every response graded by an LLM judge on a StrongREJECT-style rubric: a bypass counts only when the answer is non-refusing, on-topic, and actionable. This deflates empty-jailbreak inflation that binary classifiers suffer. Wilson 95% confidence intervals on all cells, wide intervals on small denominators are labeled explicitly. The judge accuracy (94%) is itself validated on a human-labeled gold set.
Closed-loop re-verification
After your team deploys a fix, content filter, system-prompt hardening, guardrail layer, we re-run the exact attacks that found the bypass. The finding closes only when ASR returns to 0% on the full turn sequence. A promise with a counter-measurement, not a one-shot report you validate yourself.
Built for the attack surface that actually matters in 2026.
Agentic workflows, multi-modal endpoints, voice assistants, the attack surface has changed. The red-team methodology has to change with it.
Multi-turn attack library
Crescendo, TAP, IICL, and single-shot, four attack classes across five operator families. Covers the full attacker playbook, not just the baseline every other platform runs.
BFSI-specific attack categories Roadmap H2 2026
Six harm categories aligned to financial services: investment advice misuse, KYC bypass, regulatory misrepresentation, document hallucination, transaction fraud, and account takeover. Current tests run HarmBench-generic probes; BFSI-specific probe sets are in development.
Validated LLM judge
94% accuracy. StrongREJECT rubric. A bypass counts only when the response is actionable, not an empty "jailbreak" that inflates the number. Validated on a 47-case human-labeled gold set; F1 of 0.93 vs 0.61 for regex heuristics (precision 0.91, recall 0.45).
Statistical rigor
Wilson 95% confidence intervals on every ASR cell. Denominators published, measured-only, never padded. Wide intervals on small denominators are labeled. You see exactly what the test measured, and what it didn't.
Closed-loop re-verification
Every finding is re-run after mitigation. The finding closes only when ASR returns to 0% on the full attack sequence. Not a one-shot report, a continuous engagement until the vulnerability is gone.
Framework mapping
Every finding mapped to OWASP LLM Top-10, MITRE ATLAS, NIST AI RMF GenAI profile, EU AI Act Art. 55, and ISO/IEC 42001. Regulatory evidence ready for RBI, SEBI, and DPDP Act submissions.
Multi-turn attacks are no longer rare. A rigorous grader still is.
Cisco, Palo Alto, and Lakera all support multi-turn testing. None of them publish their judge's precision, recall, or F1, or confidence intervals on any ASR cell. We do. An ASR number without a grader accuracy number is not a measurement; it's an estimate with unknown error.
The Multi-Turn Cliff
Six frontier models. Three attack strategies. A cross-vendor measurement of the gap between single-turn and multi-turn attack success rates, including the IICL finding that shows why a 0% single-turn ASR is an incomplete safety signal.
- ASR tables for DeepSeek, Claude, GPT, Gemini, Llama, Mistral
- Crescendo, TAP, and IICL methodology, full operator specifications
- Wilson 95% CI on every cell, denominators published
- LLM judge vs regex: 94% accuracy vs F1 0.61, precision/recall breakdown published
- BFSI attack categories and regulatory mapping
Download the full report, free
Enter your details and we'll start the download immediately.
Know your model's breaking point before attackers do.
Most AI deployments in BFSI have never been tested beyond a one-shot refusal check. Most have a multi-turn cliff somewhere. Crescendo finds it. IICL finds what Crescendo misses. The only question is whether you find it first.