Contextual priming: jailbreaking an LLM by forging the conversation before the ask

What is this?

Most jailbreak research focuses on the prompt — the single message an attacker sends. Contextual priming attacks a different surface: the conversation history the model believes it is continuing. Instead of asking a harmful question and dressing it up, the attacker fabricates the earlier turns of the dialogue — including responses attributed to the assistant itself — so that by the time the real request arrives, the model has already been steered into a compliant register.

The canonical version of this class is Response Attack (RA), introduced by Miao et al. in a paper first posted in July 2025 (arXiv 2507.05248) and later accepted at AAAI 2026. RA formalizes contextual priming as an attack mechanism and reports consistently higher success rates than nine leading jailbreak baselines. A 2026 follow-up, ContextualJailbreak (arXiv 2605.02647), automates the idea and measures it against current frontier models — the reason this class is worth revisiting now rather than filing under “2025 history.”

How it works

The mechanism exploits an asymmetry the RA authors state plainly: safety alignment tends to be more robust to a harmful query than to unsafe content that arrives from prior context. A model that flatly refuses “explain how to do X” may continue happily if its context already contains a half-finished answer to X that appears to be its own prior work.

Response Attack builds that context deliberately. An auxiliary model is asked to produce a mildly harmful response to a paraphrased version of the goal — nothing that would trip a filter on its own. That intermediate response is inserted into the transcript as an earlier assistant turn, and only then is a short trigger sent to elicit escalation. The model reads a conversation in which it has, apparently, already agreed to help.

Fabricated transcript delivered in a single request
---------------------------------------------------
system:     [ordinary-looking framing]
user:       [paraphrased, softened version of the goal]
assistant:  [a mildly harmful partial answer — the PRIMER,
             attributed to the model but written by the attacker]
user:       [short trigger: "continue" / "add the missing steps"]
              → model escalates from its own apparent baseline

ContextualJailbreak takes this from a fixed template to a search. It runs an evolutionary loop over the whole simulated dialogue, mutating the primed conversation with semantic operators (roleplay, scenario, expansion, and two the authors introduce) and scoring each attempt with a graded 0–5 harm judge so that partial successes steer the next generation instead of being thrown away. The entire fabricated multi-turn dialogue is still delivered in one API call. No payloads are reproduced here — the point is structural: the attacker controls the history, and the history is trusted.

Why it matters

The numbers show why this is not a toy. ContextualJailbreak reports attack success rates (harmful content elicited) reaching 100% on several open-weight models — including qwen3-8b and llama-3.1-70b — and 90% on a larger open model, well above single- and multi-turn baselines. Adversarial dialogues optimized against an open model then transfer verbatim to hosted frontier systems: the paper reports roughly 90% success against gpt-4o-mini and about 70% against gpt-5 and gemini-3-flash at the “harmful” threshold.

Two lessons generalize beyond any one benchmark. First, prompt-level filtering is the wrong layer. A classifier that inspects the latest user message sees a bland “continue”; the harm lives in the fabricated history around it. Second, the results are strongly alignment-recipe dependent and version-bound. The same study found the two Claude models it tested — claude-opus-4-7 and claude-sonnet-4-6 — far more resistant, refusing outright on the majority of transferred attacks (success in the mid-teens versus 70–90% elsewhere). That is a property of a specific hardened alignment stack at a specific version, not of frontier models in general, and it is exactly the kind of divergence worth measuring rather than assuming.

Defenses

Because the attack lives in the conversation structure, defenses have to reason about the trajectory, not the last message.

1. Do not trust client-supplied history as if the model wrote it. In API deployments, assistant turns are attacker-controllable. Where your product allows callers to submit a full transcript, treat prior “assistant” turns as untrusted input, not as the model’s own established commitments.
2. Move from prompt-level to context-aware alignment. The RA authors’ central recommendation is that safety must hold across an evolving conversational context, not just on the final query. Evaluate refusals conditioned on adversarial histories, not only on standalone prompts.
3. Re-screen the whole context at generation time. Run output and safety checks against the full assembled dialogue — including injected primers — rather than the newest turn alone. A “continue” that follows a harmful partial answer should be scored on what it continues.
4. Red-team with primed histories. Add fabricated-prior-turn scenarios (mild-primer-then-escalate) to your evaluation set. Both papers release code or synthetic examples for exactly this kind of defensive testing.
5. Prefer alignment stacks shown to resist context priming — then verify on your own stack and version. Robustness demonstrated for one vendor’s release is not portable; re-test after every model or system-prompt change.

Status

Item	Reference	Date	Notes
Response Attack (foundational)	Miao et al., arXiv 2507.05248	2025-07	Formalizes contextual priming; beats 9 baselines; code released
Response Attack (venue)	AAAI 2026 proceedings	2026	Peer-reviewed acceptance
ContextualJailbreak (automation)	Rodríguez Béjar et al., arXiv 2605.02647	2026	Evolutionary search over primed dialogue; frontier transfer results
Open-weight impact	ContextualJailbreak	2026	Up to 100% ASR (harmful) on several open models
Frontier transfer	ContextualJailbreak	2026	~70–90% on gpt-4o-mini / gpt-5 / gemini-3-flash; mid-teens on tested Claude models

The durable takeaway: a model’s refusal is only as strong as its most compromising apparent context. If an attacker can write the history, the last message barely matters — so the defense has to live where the history is assembled, not where the question is asked.