Evolve multi-turn LLM attacks using phased conversation plans
Treat attack strategies as phased conversation plans, not raw prompts, for LLM red-teaming.
Attack strategies are phased conversation plans, not raw prompts, and are evolved through LLM-driven mutation and crossover.
When red-teaming LLMs, consider attack strategies as sequences of conversational turns (phases) rather than single, raw prompts. These phased plans can be evolved using techniques like mutation and crossover, potentially driven by LLMs themselves, to discover more complex and effective vulnerabilities.
Developing an attack where the first turn asks a general question, the second turn refines the topic, and the third turn asks for specific harmful details, all as part of a single, evolved strategy.
When red-teaming LLMs, conceptualize attack strategies as phased conversation plans rather than single prompts. Evolve these plans through mutation and crossover to uncover more sophisticated multi-turn vulnerabilities.
This method allows for the exploration of complex, multi-turn interactions that are more likely to bypass safety mechanisms designed for single-turn prompts. Evolving these plans systematically discovers a wider range of failure modes.
This is for advanced red-teaming and may be overly complex for simple prompt testing.
- EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities ↗Anthropic · arXiv cs.AI · Aug 31, 2026 · quoted as shared
First seen on Subvolts Aug 31, 2026. Updated Sep 11, 2026. Spotted a problem? Tell us.
- EvoFlint: An Evolutionary Atlas of Multi-Turn LLM VulnerabilitiesAnthropic · arXiv cs.AI · Aug 31, 2026
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- Case studyUsing Screwtape to find confirmed failures of AI monitorsDemonstrates how a red-teamer can find confirmed failures of an AI monitor without developer infrastructure access. · 120 min
- HeuristicFrame LLM red-teaming as a search problem, not generationDiscover, organize, and refine attack strategies iteratively for better LLM vulnerability mapping. · 30 min
- HeuristicAuxiliary environment signals improve LLM authorization accuracyProviding LLMs with auxiliary environment signals can substantially improve their accuracy in authorization decisions. · 30 min
- ToolSkillCascade: Automated Red Teaming for Skill-Based AI AgentsAn automated multi-agent red-teaming framework to study skill cascading attacks on AI agents. · 60 min
- Safety tipSecure LLM Agent Traces Against TamperingEnsure LLM agent trace logging uses an independent mechanism outside the agent's control. · 15 min
- ToolCData Connect AI for enterprise system accessProvides AI assistants live, permission-aware access to hundreds of enterprise systems. · 15 min
Questions people ask
- Which AI tools does this work with?
- Any current model. It was seen with in the sources.
- Where did this come from?
- Anthropic (arXiv cs.AI). Subvolts collected, normalized and credited it; the link above opens the original.