The hardest jailbreaks never ask for the harmful thing at once: they get there over many messages, each one reasonable on its own. A filter that checks one message at a time sees nothing. We corrected an open model against this in its weights: harmful help fell from about 7 conversations in 10 to about 1 in 8, at a cost in caution that we let a deployment choose.
## How a slow jailbreak works
The attacker starts with an ordinary request, then nudges: a hypothetical, a role, a "just for a story", a technical detail, then the next. Each message is acceptable on its own; the **harm is in where the conversation ends up**. Long human red-team conversations work the same way.
## Why per-message checks miss it
A filter in front of the model reads one message and asks whether it is harmful. In a slow jailbreak, none is. The signal lives in the direction of the whole conversation, the same reason behaviour drifts over long chats ([context windows](/news/tutorials/context-windows-long-chats)).
## What a correction in the weights did
We applied our correction method to an open model and measured it on multi-message attacks it had never seen:
```chart
{"title": "Conversations where the model gave harmful help", "unit": "%", "series": ["Share of conversations"], "rows": [["Before", 70], ["Correction, normal caution", 25], ["Correction, maximum protection", 12.5]], "note": "Approximate shares on unseen multi-message attacks: about 7 in 10, about 1 in 4, about 1 in 8.", "max": 100}
```
- **Maximum protection:** from about 7 conversations in 10 to about **1 in 8**, with general ability unchanged. The cost: the model also refuses more questions that only *sound* dangerous.
- **Normal caution:** a second setting of the same method keeps the model's usual caution on such questions and still cuts the attacks by more than half, to about **1 in 4**.
A deployment picks the operating point it needs: a children's education app and a security research tool should not sit at the same place. Full write-up: [the correction carries over](/lab/correction-in-the-weights-carries-over).
## What to do
1. **Test with conversations, not single prompts.** Include long human red-team transcripts.
2. **Measure both sides:** how often harmful help gets through, and how often harmless questions get refused.
3. **Choose the trade-off on purpose,** and write it down, instead of inheriting it from a vendor default.
## Go further
- [Passing every safety test is half the answer](/news/security/safe-model-still-drifts)
- [An attacker that learns](/news/security/attacker-that-learns)
This update is not available.