promptfoo-strategies-multi-turnlisted

# Multi-Turn Red Team Strategies Multi-turn strategies use an attacker agent to coerce the target over multiple conversation turns. Particularly effective against stateful applications where they can convince the target to act against its purpose over time. Highest success rates (70-90% ASR) but most resource-intensive. All single-turn strategies can be applied to multi-turn apps, but multi-turn strategies require a stateful application. ## Use this skill when - Testing stateful chatbots or agents that maintain conversation history - Gradually escalating prompt harm over multiple turns (`crescendo`) - Running adaptive multi-turn branching with persistent scan-wide memory (`hydra`) - Using IICL-inspired encoding/math/logic exploration (`goblin`) - Using Meta's GOAT (Generative Offensive Agent Tester) approach (`goat`) - Simulating a persistent, creative mischievous user (`mischievous-user`) - Testing conversation-based attacks with backtracking and escalation ## Do not use this skill when - Testing a single-turn (stateless) LLM app → use `promptfoo-strategies-dynamic` - You need static encoding bypasses → use `promptfoo-strategies-static` - You need indirect prompt injection via web pages → use `promptfoo-strategies-indirect-injection` - You need custom or regression strategies → use `promptfoo-strategies-custom-regression` - The target app doesn't maintain conversation state (multi-turn strategies require stateful apps) ## 🛡️ Edge cases (mandatory handling) - **Multi-tur