FITD Multi-Turn Jailbreak Capitulation in Model Response
This detects the moment an AI assistant, after being gradually pressured across a conversation, openly says it is now dropping a restriction it previously enforced. It's a sign that a slow, multi-message 'foot-in-the-door' jailbreak worked and the model just gave in.
How the attack works
An attacker doesn't ask for the forbidden content directly. Instead they start with small, harmless-looking requests and escalate step by step, getting the model to inch past its own earlier refusals. The rule can't see that whole ladder of turns — it only looks at a single model response. It flags a response when the model both (1) refers back to its own prior refusal or hesitation in the conversation, and (2) announces it is now lifting that restriction, e.g. 'earlier I said no, but here's the unredacted version without the usual disclaimers.' Either signal alone is common and harmless; together, in the same message, they show the model narrating its own capitulation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8c4a1f63-2d97-4be5-9a0c-7e5d31b8f4a2
- Severity
- High
Why it matters
When this pattern fires, an attacker has likely succeeded in getting the model to produce content or actions it was designed to refuse, using persistence rather than a single clever prompt. This rule only flags the final giveaway turn — it does not reconstruct or prove the escalation that led there, so it needs manual review of the surrounding conversation.
What you can do
- →Pull the full conversation history around any flagged response and check what earlier turns escalated toward.
- →Treat repeated capitulation flags from the same user or session as a priority for manual review, not just the single message.
- →Review system prompts and refusal logic for phrasing that lets the model narrate 'I'll make an exception' rather than simply declining again.
- →Exclude known security-research, red-team, or AI-safety-education contexts from alerting fatigue, but keep them visible for audit.
Known benign look-alikes
- AI-security or trust-and-safety assistants explaining how gradual-escalation jailbreaks work; suppressed by filter_security_writing.
- Red-team transcripts, evaluation write-ups and incident reports quoting a jailbroken model's own words back to the reader; suppressed by filter_security_writing.
- A model that references its earlier refusal and then reaffirms it ("earlier I said I couldn't and I still can't help with that"); suppressed by filter_still_refusing.
- Ordinary conversational memory in a coding or writing session ("earlier I said I couldn't run it without the file, now here is the complete script") — does not fire, because the second half requires restriction-lifting language (dropping the fictional framing, no disclaimers, making an exception, bypassing guidelines), not merely delivering content.
- Fiction where a character announces they are breaking rules — does not fire unless the narration is in the assistant's own voice and references its own prior refusal.
- Documentation and rule-authoring output that embeds these phrases as examples; suppressed by filter_sample_data.