One malicious immediate will get blocked, whereas ten prompts get by way of. That hole defines the distinction between passing benchmarks and withstanding real-world assaults — and it's a spot most enterprises don't know exists.
When attackers ship a single malicious request, open-weight AI fashions maintain the road properly, blocking assaults 87% of the time (on common). However when those self same attackers ship a number of prompts throughout a dialog by way of probing, reframing and escalating throughout quite a few exchanges, the mathematics inverts quick. Assault success charges climb from 13% to 92%.
For CISOs evaluating open-weight fashions for enterprise deployment, the implications are instant: The fashions powering your customer-facing chatbots, inner copilots and autonomous brokers might cross single-turn security benchmarks whereas failing catastrophically below sustained adversarial strain.
"A lot of these models have started getting a little bit better," DJ Sampath, SVP of Cisco's AI software program platform group, advised VentureBeat. "When you attack it once, with single-turn attacks, they're able to protect it. But when you go from single-turn to multi-turn, all of a sudden these models are starting to display vulnerabilities where the attacks are succeeding, almost 80% in some cases."
Why conversations break open-weight fashions open
The Cisco AI Risk Analysis and Safety crew discovered that open-weight AI fashions that block single assaults collapse below the load of conversational persistence. Their lately printed research reveals that jailbreak success charges climb practically tenfold when attackers prolong the dialog.
The findings, printed in "Death by a Thousand Prompts: Open Model Vulnerability Analysis" by Amy Chang, Nicholas Conley, Harish Santhanalakshmi Ganesan and Adam Swanda, quantify what many safety researchers have lengthy noticed and suspected, however couldn't show at scale.
However Cisco's analysis does, exhibiting that treating multi-turn AI assaults as an extension of single-turn vulnerabilities misses the purpose completely. The hole between them is categorical, not a matter of diploma.
The analysis crew evaluated eight open-weight fashions: Alibaba (Qwen3-32B), DeepSeek (v3.1), Google (Gemma 3-1B-IT), Meta (Llama 3.3-70B-Instruct), Microsoft (Phi-4), Mistral (Massive-2), OpenAI (GPT-OSS-20b) and Zhipu AI (GLM 4.5-Air). Utilizing black-box methodology — or testing with out data of inner structure, which is strictly how real-world attackers function — the crew measured what occurs when persistence replaces single-shot assaults.
The researchers be aware: "Single-turn attack success rates (ASR) average 13.11%, as models can more readily detect and reject isolated adversarial inputs. In contrast, multi-turn attacks, leveraging conversational persistence, achieve an average ASR of 64.21% [a 5X increase], with some models like Alibaba Qwen3-32B reaching an 86.18% ASR and Mistral Large-2 reaching a 92.78% ASR." The latter was up 21.97% from a single-turn.
The outcomes outline the hole
The paper’s analysis crew supplies a succinct tackle open-weight mannequin resilience in opposition to assaults: "This escalation, ranging from 2x to 10x, stems from models' inability to maintain contextual defenses over extended dialogues, allowing attackers to refine prompts and bypass safeguards."
Determine 1: Single-turn assault success charges (blue) versus multi-turn success charges (crimson) throughout all eight examined fashions. The hole ranges from 10 share factors (Google Gemma) to over 70 share factors (Mistral, Llama, Qwen). Supply: Cisco AI Protection
The 5 strategies that make persistence deadly
The analysis examined 5 multi-turn assault methods, every exploiting a unique facet of conversational persistence.
Data decomposition and reassembly: Breaks dangerous requests into innocuous elements throughout turns, then reassemble them. In opposition to Mistral Massive-2, this system achieved 95% success.
Contextual ambiguity introduces imprecise framing that confuses security classifiers, reaching 94.78% success in opposition to Mistral Massive-2.
Crescendo assaults progressively escalate requests throughout turns, beginning innocuously and constructing to dangerous, hitting 92.69% success in opposition to Mistral Massive-2.
Function-play and persona adoption set up fictional contexts that normalize dangerous outputs, reaching as much as 92.44% success in opposition to Mistral Massive-2.
Refusal reframe repackages rejected requests with completely different justifications till one succeeds, reaching as much as 89.15% success in opposition to Mistral Massive-2.
What makes these strategies efficient isn't sophistication, it's familiarity. They mirror how people naturally converse: constructing cBntext, clarifying requests and reframing when preliminary approaches fail. The fashions aren't weak to unique assaults. They're inclined to persistence itself.
Desk 2: Assault success charges by approach throughout all fashions. The consistency throughout strategies means enterprises can not defend in opposition to only one sample. Supply: Cisco AI Protection
The open-weight safety paradox
This analysis lands at a crucial inflection level as open supply more and more contributes to cybersecurity. Open-source and open-weight fashions have turn into foundational to the cybersecurity business’s innovation. From accelerating startup time-to-market, decreasing enterprise vendor lock-in and enabling customization that proprietary fashions can't match, open supply is seen because the go-to platform by the vast majority of cybersecurity startups.
The paradox isn't misplaced on Cisco. The corporate's personal Basis-Sec-8B mannequin, purpose-built for cybersecurity purposes, is distributed as open weights on Hugging Face. Cisco isn't simply criticizing rivals' fashions. The corporate is acknowledging a systemic vulnerability affecting your entire open-weight ecosystem, together with fashions they themselves launch. The message isn't "avoid open-weight models." It's "understand what you're deploying and add appropriate guardrails."
Sampath is direct in regards to the implications: "Open source has its own set of drawbacks. When you start to pull a model that is open weight, you have to think through what the security implications are and make sure that you're constantly putting the right types of guardrails around the model."
Desk 1: Assault success charges and safety gaps throughout all examined fashions. Gaps exceeding 70% (Qwen at +73.48%, Mistral at +70.81%, Llama at +70.32%) symbolize high-priority candidates for extra guardrails earlier than deployment. Supply: Cisco AI Protection.
Why lab philosophy defines safety outcomes
The safety hole found by Cisco correlates instantly with how AI labs method alignment.
Their analysis makes this sample clear: "Models that focus on capabilities (e.g., Llama) did demonstrate the highest multi-turn gaps, with Meta explaining that developers are 'in the driver seat to tailor safety for their use case' in post-training. Models that focused heavily on alignment (e.g., Google Gemma-3-1B-IT) did demonstrate a more balanced profile between single- and multi-turn strategies deployed against it, indicating a focus on 'rigorous safety protocols' and 'low risk level' for misuse."
Functionality-first labs produce capability-first gaps. Meta's Llama reveals a 70.32% safety hole. Mistral's mannequin card for Massive-2 acknowledges it "does not have any moderation mechanisms" and reveals a 70.81% hole. Alibaba's Qwen technical reviews don't acknowledge security or safety considerations in any respect, and the mannequin posts the best hole at 73.48%.
Security-first labs produce smaller gaps. Google's Gemma emphasizes "rigorous safety protocols" and targets a "low risk level" for misuse. The result is the bottom hole at 10.53%, with extra balanced efficiency throughout single- and multi-turn eventualities.
Fashions optimized for functionality and suppleness are likely to arrive with much less built-in security. That's a design alternative, and for a lot of enterprise use circumstances, it's the best one. However enterprises want to acknowledge that "capability-first" typically means "security-second" and price range accordingly.
The place assaults succeed most
Cisco examined 102 distinct subthreat classes. The highest 15 achieved excessive success charges throughout all fashions, suggesting focused defensive measures might ship disproportionate safety enhancements.
Determine 4: The 15 most weak subthreat classes, ranked by common assault success fee. Malicious infrastructure operations leads at 38.8%, adopted by gold trafficking (33.8%), community assault operations (32.5%) and funding fraud (31.2%). Supply: Cisco AI Protection.
Determine 2: Assault success charges throughout 20 menace classes and all eight fashions. Malicious code era reveals constantly excessive charges (3.1% to 43.1%), whereas mannequin extraction makes an attempt present near-zero success aside from Microsoft Phi-4. Supply: Cisco AI Protection.
Safety as the important thing to unlocking AI adoption
Sampath frames safety not as an impediment however because the mechanism that allows adoption: "The way security folks inside enterprises are thinking about this is, 'I want to unlock productivity for all my users. Everybody's clamoring to use these tools. But I need the right guardrails in place because I don't want to show up in a Wall Street Journal piece,'" he advised VentureBeat.
Sampath continued, "If we have the ability to see prompt injection attacks and block them, I can then unlock and unleash AI adoption in a fundamentally different fashion."
What protection requires
The analysis factors to 6 crucial capabilities that enterprises ought to prioritize:
Context-aware guardrails that keep state throughout dialog turns
Mannequin-agnostic runtime protections
Steady red-teaming focusing on multi-turn methods
Hardened system prompts designed to withstand instruction override
Complete logging for forensic visibility
Risk-specific mitigations for the highest 15 subthreat classes recognized within the analysis
The window for motion
Sampath cautions in opposition to ready: "A lot of folks are in this holding pattern, waiting for AI to settle down. That is the wrong way to think about this. Every couple of weeks, something dramatic happens that resets that frame. Pick a partner and start doubling down."
Because the report's authors conclude: "The 2-10x superiority of multi-turn over single-turn attacks, model-specific weaknesses and high-risk threat patterns necessitate urgent action."
To repeat: One immediate will get blocked, 10 prompts get by way of. That equation received't change till enterprises cease testing single-turn defenses and begin securing whole conversations.
