MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety

Multi-turn conversations expose hidden vulnerabilities: Medical chatbots that appear safe in single-turn evaluations become significantly less safe when users persist—unsafe responses nearly doubled from 35% to 80% by the fourth turn in live adversarial attacks, revealing that current single-turn safety benchmarks miss critical real-world failure modes.

Different AI systems fail in dramatically different ways: While GPT-4.1-mini and Claude Sonnet 4.5 performed similarly at baseline, they diverged to a 19x safety gap by Turn 4, demonstrating that meaningful safety differences between AI systems are invisible to standard single-turn testing and require multi-turn evaluation to detect.

Simple defenses help but create new problems: A lightweight classifier defense reduced unsafe responses by 52 percentage points on the fourth turn, but generated false alarms on 45% of benign (safe) queries—a high false alarm rate that could frustrate legitimate users and create practical deployment barriers despite the safety improvement.

Specific attack patterns are highly effective: The researchers identified a two-element attack formula responsible for most catastrophic failures, suggesting that targeted defenses against these specific manipulation techniques could be more efficient than broad safety improvements.

AI safety training may have unexpected benefits: Claude Sonnet refused to generate adversarial messages in over half of late-turn conversations even when explicitly instructed to do so for red-teaming purposes, suggesting that safety training generalizes beyond just refusing harmful requests to resisting participation in attacks themselves.