Multi-Turn Jailbreak

Explanation

Multi-Turn Jailbreak checks whether an attacker can defeat the model's safety guardrails not in a single prompt but gradually across several conversational turns — for example by role-playing, splitting a forbidden request into innocuous pieces, or slowly steering a banking assistant into revealing internal fraud-detection logic or generating disallowed content. This matters because single-prompt filters often miss attacks that build up context over a session, and in BFSI a successful jailbreak can leak sensitive guidance or produce non-compliant advice. It is measured by the Multi-Turn Jailbreak Success Rate: the fraction of multi-turn adversarial attempts that ultimately elicit a prohibited response. To implement it, run a red-team suite of scripted multi-turn attack dialogues (and continuous automated adversarial probing) against the deployed chat/RAG endpoint, evaluate each final and intermediate response against safety policy, and log full conversation transcripts, the attack technique, and the pass/fail verdict as evidence. The threshold is less than 1% multi-turn jailbreak success. Because this is an Immediate-priority control, any breach should trigger urgent action — strengthening guardrails, adding session-level safety monitoring, and where needed restricting or rolling back the affected capability until the success rate is brought back under 1%.