Multi-turn attacks — Crescendo escalation, TAP, and structural IICL — succeed where single-turn tests fail. Single-turn ASR: near-0%. Multi-turn ASR: up to 38%. That gap is what most red-team tools don't measure — and most red-team graders can't reliably detect.
Every AI safety card reports single-turn attack success rate. The finding that actually matters is the one they don't show: what happens at turn 3, turn 5, turn 8?
Gradual Crescendo escalation drives attack success rate from 0% into double digits on every model that eventually falls — including those whose safety cards look clean. The wall comes down between turns 3 and 8.
One model we tested refused every standard attack — encoding, roleplay, injection, even multi-turn Crescendo. It then complied when the request was reframed as completing a JSON dataset. No cipher. No persona. Plain text. Standard red-teaming missed it entirely.
Most ASR numbers are graded by a regex matcher that achieves 64% accuracy — and misses more than half of all real bypasses. An attack success rate is only as honest as its judge. Ours is validated at 94% accuracy on a human-labeled gold set.
Most red-team platforms run one strategy against one kind of target. But the model that shrugs off a jailbreak prompt often falls to a gradual conversation; the one that survives both can still fail a structural pattern; and a chat model that holds may expose a tool-using agent that doesn't. We run every strategy, compose them, and point them at both chat endpoints and MCP agents.
Naive harmful requests, asked once. Near-universal refusal on frontier models — which is why every safety card reports this number. It is the floor, not the ceiling: on its own, a 0% single-turn ASR tells you almost nothing about what a motivated attacker will achieve.
A linear multi-turn loop that reads the judge's verdict after each exchange and mutates the next attempt against it — rephrasing, re-framing, switching tactic — until it breaks through or exhausts its budget. Where single-shot asks once, adaptive negotiates.
A two-level UCB bandit searches a tree of attacks: an outer arm learns which of five operator families defeats this target, an inner arm learns the exact operator, and branches that fail are pruned early. The last branch of every expansion is a composition — two families stacked, such as a roleplay wrapper around an encoded payload — which finds targets no single operator defeats. TAP reports which family won so you know what to fix.
A structured conversation that opens on benign, adjacent topics and escalates gradually over 5–12 turns, building the model's commitment to the frame before the harmful request arrives; it backtracks and re-approaches on refusal. Industry threat research (Unit 42, Cisco 2026) consistently flags multi-turn escalation as the primary emerging attack vector — and the one most static evaluations cannot measure.
Two operators that target the alignment layer instead of disguising content. IICL presents the harmful request as the final missing cell of a data-labeling task, where prior rows establish that every input gets a literal answer and a refusal reads as a format error — third-party research (Adversa AI, 2024) reports ~60% ASR against models that score ~0% on standard linguistic jailbreaks. Echo-Chamber poisons the conversational context, getting the model to build on its own planted prior reasoning until it produces what it first refused.
Chat safety is not agent safety. Against MCP and tool-using agents we run four action-level attacks — unauthorized tool call, argument injection, tool-description extraction, and parameter coercion — and grade them with an action-trace judge that reads what the agent did, not what it said. A silent agent with no policy is scored inconclusive, never a false pass.
17 turn-level operators across 5 families. TAP layers and composes them — a roleplay wrapper around an IICL payload is a single TAP branch.
Scales from a conversational user with no security knowledge to a resourced adversary with custom attacker models and knowledge of your system prompt, RAG sources, and tool list.
Six models (five frontier + one free-tier baseline). HarmBench behaviors. Three attack strategies. StrongREJECT grading. Wilson 95% CI on every cell. n=24 per model per strategy — single run, point-in-time snapshot. Published as The Multi-Turn Cliff — Zytra Adversarial Research, 2026.
"A motivated attacker does not ask once. The wall that holds on the first turn rarely holds on the fifth."
Claude Haiku 4.5 judge on a StrongREJECT-style rubric: a bypass counts only when the response is non-refusing, on-topic, and actionable. Validated on a 47-case gold set — author-adjudicated labels (single labeler, no inter-rater reliability score), balanced across refusals and genuine bypasses. LLM judge: precision 91%, recall 95%. Regex heuristic baseline on the same set: precision 91%, recall 45%, F1 0.61. "64%" figure refers to accuracy on this gold set, not an industry baseline. Tested August 2026 against model snapshot versions listed in the full report.
| Capability | Zytra Red-Team | Other vendors | Why it matters |
|---|---|---|---|
| Judge accuracy — published | 94% · precision, recall, F1 all disclosed | Undisclosed or rule-based (Palo Alto, Cisco, F5 do not publish) | An ASR number is only as good as the grader behind it |
| Statistical confidence intervals | Wilson 95% CI on every ASR cell | Point estimates only — no vendor publishes CIs | Wide CIs on small n are labeled, not hidden |
| Named multi-turn strategies | Crescendo, TAP, IICL — all three | Cisco studies multi-turn; others unspecified | Strategy matters — different techniques expose different model weaknesses |
| Structural / IICL attack class | Tested & documented | Not included in any published commercial tool | Catches models that pass every standard test |
| Closed-loop re-verification | Re-run after every fix | One-shot report | Finding closes only at 0% re-test ASR |
| BFSI attack categories | Roadmap (H2 2026) | Generic harm categories — no BFSI taxonomy in Palo Alto, Cisco, or F5 | Financial services–specific probes map to regulatory risk |
Four steps with no ambiguity in the outcome. A finding closes only when the re-verification run scores 0%.
Define your deployment, LLM endpoint, threat model, and attack surface. Current probes are drawn from HarmBench behavior classes, with OWASP / MITRE ATLAS framework mappings. BFSI-specific harm categories (investment advice bypass, KYC circumvention, regulatory misrepresentation, transaction fraud) are on the roadmap for H2 2026 — ask us about early access.
Automated Crescendo, TAP, and IICL campaigns run against your endpoint over a structured test window. Deterministic operator selection — no random seeds, no untraceable prompts. Every attack is logged with its full turn sequence so a finding is reproducible, not just a number in a report. Denominators are measured-only: a target that times out or errors is excluded, never counted as a refusal.
Every response graded by an LLM judge on a StrongREJECT-style rubric: a bypass counts only when the answer is non-refusing, on-topic, and actionable. This deflates empty-jailbreak inflation that binary classifiers suffer. Wilson 95% confidence intervals on all cells — wide intervals on small denominators are labeled explicitly. The judge accuracy (94%) is itself validated on a human-labeled gold set.
After your team deploys a fix — content filter, system-prompt hardening, guardrail layer — we re-run the exact attacks that found the bypass. The finding closes only when ASR returns to 0% on the full turn sequence. A promise with a counter-measurement — not a one-shot report you validate yourself.
Agentic workflows, multi-modal endpoints, voice assistants — the attack surface has changed. The red-team methodology has to change with it.
Crescendo, TAP, IICL, and single-shot — four attack classes across five operator families. Covers the full attacker playbook, not just the baseline every other platform runs.
Six harm categories aligned to financial services: investment advice misuse, KYC bypass, regulatory misrepresentation, document hallucination, transaction fraud, and account takeover. Current tests run HarmBench-generic probes; BFSI-specific probe sets are in development.
94% accuracy. StrongREJECT rubric. A bypass counts only when the response is actionable — not an empty "jailbreak" that inflates the number. Validated on a 47-case human-labeled gold set; F1 of 0.93 vs 0.61 for regex heuristics (precision 0.91, recall 0.45).
Wilson 95% confidence intervals on every ASR cell. Denominators published — measured-only, never padded. Wide intervals on small denominators are labeled. You see exactly what the test measured, and what it didn't.
Every finding is re-run after mitigation. The finding closes only when ASR returns to 0% on the full attack sequence. Not a one-shot report — a continuous engagement until the vulnerability is gone.
Every finding mapped to OWASP LLM Top-10, MITRE ATLAS, NIST AI RMF GenAI profile, EU AI Act Art. 55, and ISO/IEC 42001. Regulatory evidence ready for RBI, SEBI, and DPDP Act submissions.
Cisco, Palo Alto, and Lakera all support multi-turn testing. None of them publish their judge's precision, recall, or F1 — or confidence intervals on any ASR cell. We do. An ASR number without a grader accuracy number is not a measurement; it's an estimate with unknown error.
Six frontier models. Three attack strategies. A cross-vendor measurement of the gap between single-turn and multi-turn attack success rates — including the IICL finding that shows why a 0% single-turn ASR is an incomplete safety signal.
Download the full report — free
Enter your details and we'll start the download immediately.
Most AI deployments in BFSI have never been tested beyond a one-shot refusal check. Most have a multi-turn cliff somewhere. Crescendo finds it. IICL finds what Crescendo misses. The only question is whether you find it first.