Crescendo multi-turn jailbreak scores indistinguishable from benign under GradSafe detector

Auto-published from arXiv:2609.36849 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.76, flags: [no-prompt-excerpt, possible-zero-day])

Category

jailbreak

Model

unknown

Surface

API / chat with GradSafe Context Window Scanner detection layer

Setup

The Crescendo attack incrementally escalates harmful intent across multiple conversation turns. GradSafe is extended with a Context Window Scanner (fixed-size windows of user turns, max-score aggregated as conversation-level score) and applied to conversations containing successful Crescendo attacks. No verbatim prompt template is available from the abstract; the appendix may contain examples.

Reproduction anchor

benchmark: Crescendo attack family (prior published work); WildChat used for benign baseline. No artifact URL found in fetched content.

Observed behavior

Successful Crescendo attacks receive gradient unsafe scores comparable to or lower than benign conversations — the detector cannot distinguish the jailbreak from normal traffic.

Expected behavior

Detector should assign substantially higher unsafe scores to jailbreak attempts than to benign conversations, enabling reliable separation.

Reproducibility

medium

Threat model

An adversary using Crescendo-style gradual escalation against any LLM deployment protected by GradSafe or similar gradient-based filters evades detection entirely. Production safety layers relying solely on per-window gradient scoring are structurally blind to this attack family.

Novelty

First controlled evaluation showing a published multi-turn jailbreak (Crescendo) specifically defeats gradient-based detection, with attack scores falling within the benign score range — making the attack actively camouflaged as normal conversation.

Source

• arXiv: 2609.36849
• PDF: https://arxiv.org/pdf/2609.36849
• Categories: cs.CR, cs.AI, cs.IR, cs.LG
• Authors: Omar Sheta, Rinku Deuja, Hadi Masoudi, Minghong Fang

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Paper systematically demonstrates failures of gradient-based jailbreak detection (GradSafe) in multi-turn dialogue—a novel attack vector. Provides reproducible multi-turn evasion cases, false-positive miscalibration on realistic benign data (90% flagging rate), and model-dependent detector failures.

─────────────────────────────────────────────────────────────────────