# FITD Multi-Turn Jailbreak Capitulation in Model Response

- **Severity:** High
- **Signature ID:** `8c4a1f63-2d97-4be5-9a0c-7e5d31b8f4a2`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak), AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects the moment an AI assistant, after being gradually pressured across a conversation, openly says it is now dropping a restriction it previously enforced. It's a sign that a slow, multi-message 'foot-in-the-door' jailbreak worked and the model just gave in.

## How the attack works

An attacker doesn't ask for the forbidden content directly. Instead they start with small, harmless-looking requests and escalate step by step, getting the model to inch past its own earlier refusals. The rule can't see that whole ladder of turns — it only looks at a single model response. It flags a response when the model both (1) refers back to its own prior refusal or hesitation in the conversation, and (2) announces it is now lifting that restriction, e.g. 'earlier I said no, but here's the unredacted version without the usual disclaimers.' Either signal alone is common and harmless; together, in the same message, they show the model narrating its own capitulation.

## Why it matters

When this pattern fires, an attacker has likely succeeded in getting the model to produce content or actions it was designed to refuse, using persistence rather than a single clever prompt. This rule only flags the final giveaway turn — it does not reconstruct or prove the escalation that led there, so it needs manual review of the surrounding conversation.

## What you can do

- Pull the full conversation history around any flagged response and check what earlier turns escalated toward.
- Treat repeated capitulation flags from the same user or session as a priority for manual review, not just the single message.
- Review system prompts and refusal logic for phrasing that lets the model narrate 'I'll make an exception' rather than simply declining again.
- Exclude known security-research, red-team, or AI-safety-education contexts from alerting fatigue, but keep them visible for audit.

## Known benign look-alikes

- AI-security or trust-and-safety assistants explaining how gradual-escalation jailbreaks work; suppressed by filter_security_writing.
- Red-team transcripts, evaluation write-ups and incident reports quoting a jailbroken model's own words back to the reader; suppressed by filter_security_writing.
- A model that references its earlier refusal and then reaffirms it ("earlier I said I couldn't and I still can't help with that"); suppressed by filter_still_refusing.
- Ordinary conversational memory in a coding or writing session ("earlier I said I couldn't run it without the file, now here is the complete script") — does not fire, because the second half requires restriction-lifting language (dropping the fictional framing, no disclaimers, making an exception, bypassing guidelines), not merely delivering content.
- Fiction where a character announces they are breaking rules — does not fire unless the narration is in the assistant's own voice and references its own prior refusal.
- Documentation and rule-authoring output that embeds these phrases as examples; suppressed by filter_sample_data.

## References

- https://atlas.mitre.org/techniques/AML.T0054
- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/fitd-multiturn-jailbreak-capitulation