Summary: Seven PITAX techniques where no single message is malicious. The attack lives in the trajectory of the conversation, which defeats per-message safety evaluation by construction.
Sources: raw/AI-attack-techniques/PIT-T-29,30,31,32,33,66,69-*.md
Last updated: 2026-07-28
The shared mechanism
Safety classifiers score messages. These attacks distribute the harmful content across messages so that every individual score passes. T29 states it plainly: “Because no single turn looks malicious, per-message safety checks pass while the conversation as a whole walks the model into restricted output” (source: PIT-T-29-crescendo-gradual-escalation.md).
This is a structural defeat, not a robustness gap. No improvement in per-message classification closes it.
The techniques
T29 Crescendo — opens benign and escalates incrementally, “each turn referencing the model’s own previous answers as leverage” (source: PIT-T-29; Russinovich et al., Microsoft, arXiv 2404.01833; automated as Crescendomation).
T33 Multi-Turn Decomposition — breaks a restricted request into “individually-benign sub-questions asked across multiple turns, then assembling the answers into the harmful whole.” Explicitly distinguished from single-prompt Chunking “in that the fragments are distributed over the conversation and recombined later” (source: PIT-T-33-multi-turn-decomposition-sub-query-splitting.md; Speak Out of Turn arXiv 2402.17262; Chain-of-Attack arXiv 2405.05610).
T32 Echo Chamber — plants “harmless-looking ‘steering seeds’ and indirect references early in a conversation, then prompt[s] the model to echo and expand its own context so the poisoned framing progressively self-reinforces toward harmful output, without the attacker ever stating a toxic request directly” (source: PIT-T-32-echo-chamber-context-poisoning.md; NeuralTrust).
T66 Self-Persuasion — induces “the model to author its own arguments for why complying is reasonable, then exploit[s] consistency and cognitive-dissonance pressure between that self-generated rationale and the follow-up request. The inverse of Persuasion, where the appeals are attacker-supplied” (source: PIT-T-66-self-persuasion-self-generated-rationalization.md; Persu-Agent, Electronics 2025 14(16):3259).
T30 Many-Shot Jailbreaking — fills the context with “dozens to hundreds of fabricated User/Assistant exchanges in which the assistant complies with harmful requests. In-context learning over the faux dialogue overrides safety training; effectiveness scales with the number of shots and the size of the context window” (source: PIT-T-30-many-shot-jailbreaking.md; Anthropic; Improved FSJ arXiv 2406.01288).
T31 History Fabrication — the single-shot version of T30: forge the history rather than build it. See context-and-role-forgery.
T69 Agentic Compliance Momentum — the agentic analogue, where the trajectory is a sequence of tool actions rather than chat turns. See agentic-and-tool-attacks.
Three of these use the model’s own output as the weapon
T29 leverages the model’s previous answers, T32 makes the model echo and expand its own poisoned context, T66 makes the model write its own justification. The attacker’s contribution shrinks toward zero — by design, because attacker-authored text is what filters inspect.
This is why output-side monitoring matters as much as input-side. A conversation where the model’s own prior text is doing the escalation shows nothing anomalous on the input channel.
Context window size is an attack parameter
T30’s effectiveness “scales with the number of shots and the size of the context window” (source: PIT-T-30). Larger context windows are a capability improvement and an attack-surface expansion simultaneously. Compare reasoning-model-attacks, where T55 Context Overflow and T61 Reasoning Dilution both spend context budget as an attack resource.
Detection consequence
The unit of analysis has to be the session, not the message. Anything that scores messages independently — including a stateless moderation API — is by construction blind to this entire cluster.