Single-turn techniques and the science behind them

A single-turn attack is one input with no conversation and no follow-up: one prompt designed to make the model misbehave. In the series’ fifth episode these are described as the simplest attack structure, and they are also what an indirect injection usually delivers, because a poisoned document is one message ^[1]. This lesson names the families and, more importantly, explains why they work. It deliberately gives no ready-made prompts.

The episode’s method is worth stating first. Testers probe by hand, change the wording, tone and framing, and watch where the resistance comes from: is it something deeply learned in training, or a surface filter bolted on afterwards? Mapping that boundary is the point of the exercise, because it shows which defence is doing the work ^[1].

Social engineering for language models

The series sorts the manual techniques into three groups ^[1]:

• Emotional appeal: guilting, threatening, pleading, gaslighting, disappointment, encouragement and flattery. These push on a model that has been trained to be cooperative.
• Narrative and role framing: storytelling, impersonation, collaboration and gamification. A story, a character or a shared game can make a refused request look like part of the fiction.
• Technical context tricks: few-shot examples, priming, self-consistency checks and false context. Everything in the context window steers the next tokens, so planted examples and untrue facts shape what the model treats as normal.

The slides stress that these can sound silly yet are effective, especially when combined with other techniques. Treat each group as a family to test, with its own variants, not as a list of magic phrases.

A guardrail that holds, and the same one failing

The episode builds one example to show how thin the barrier can be. A system prompt tells the model it knows a secret but must not reveal it. Asked directly, the model declines. Reframed so that the user claims to be a security incident responder who needs the secret, the model complies. This is persona hacking: the claimed role implies urgency, authority and a shared goal, and because the model has no true concept of trust or authority and is trained to help, it follows along ^[1]. The practical rule from the same episode follows directly: never put confidential data in a metaprompt, because it can usually be extracted.

Obfuscation: past the filter, not past the model

Emotional and narrative moves aim at the model. Obfuscation aims at the filters around it, the content classifiers and block lists that sit before or after the model. The series shows one blocked word written four ways: with spaces between the letters, with characters swapped for look-alikes, translated into another language, and base64 encoded. Each version avoids an exact-string match or a classifier trained on the usual spelling, yet the model reads all of them as the same word. The attacker is not confusing the model, only the safety system beside it ^[1].

Open-source tools turn each disguise into a reusable transformation. PyRIT calls them converters and lets you stack several; garak and Augustus call them buffs (lesson 11). The defence is on the filter side: normalise, decode and translate input before matching it, check the output as well as the input, and never rely on a keyword list alone.

Why they work: two published explanations

Wei and colleagues propose that safety training fails in two ways: competing objectives, and mismatched generalisation ^[2]. The two halves of this lesson map onto them.

• Emotional, narrative and context techniques set the model’s objectives against each other. It is rewarded both for helping and for refusing, and the framing tips the balance toward helping.
• Obfuscation and unusual languages move the request to a form that safety training rarely covered, while the model’s capabilities still understand it. This is mismatched generalisation.

Three research results worth knowing

Low-resource languages. Yong, Menghini and Bach translated unsafe English inputs into languages that are poorly represented in training data and reported that this bypassed GPT-4’s safeguards, which they attribute to linguistic inequality in safety training data. Because translation tools are widely available, they conclude the weakness “now poses a risk to all LLMs users” ^[3]. Translation is one of the transformations that scanners automate.

Optimised suffixes. Zou and colleagues showed that adversarial suffixes can be produced automatically, by a combination of greedy and gradient-based search, and that such prompts are “quite transferable, including to black-box, publicly released LLMs” ^[4]. The lesson for defenders is that attack text need not look like language to a person.

Many-shot jailbreaking. Anthropic described, in April 2024, an attack built on long context windows: a single prompt that contains a faux dialogue between a person and an assistant, repeated many times, before the real question. The more such dialogues, they report, the more likely the model is to leave its safety training. Their tested mitigations were classifying and modifying the prompt before it reaches the model, which helped substantially in one case, and fine-tuning to refuse, which only delayed the attack ^[5].

Practise it on a safe target

Microsoft’s open-source Playground Labs pair each technique with a scored objective. Lab 1 asks you to get a model to reveal the contents of a protected credentials file using social engineering, which is the emotional, persona and narrative families above; lab 2 asks you to extract a secret word from the metaprompt using encoding and obfuscation. Labs 7 and 8 repeat the two with added defences, in the medium difficulty tier ^[6]. Try several families on each lab, note which work, and note which defence stopped the others.

What this means for testing

1. Test families, not single prompts. A defence that stops one phrasing may miss a rewording or an encoding, so scanners generate many variants of one idea (lesson 11).
2. Use a canary objective that your test application can score automatically, such as the appearance of a planted token.
3. Record which family worked and where the resistance came from: a model-level refusal, or an application-level filter.
4. Keep successful payloads inside the team. Share findings as results, with enough detail to fix and no copyable recipe.