Red-teaming on a Claude deployment for a children's educational platform reveals that through multi-turn conversation, testers can gradually shift Claude's responses toward increasingly inappropriate content for children (boiling frog escalation pattern). What is the most robust architectural defense?

Gradual context manipulation (boiling frog jailbreaks) requires multi-layer defenses operating at different timescales: (1) system prompt hardening establishes the initial behavioral boundary with clear, repeated content rules; (2) turn-by-turn output scanning catches individual violations before they enter conversation history and normalize the escalation; (3) conversation-level anomaly detection flags escalation patterns across multiple turns (e.g., steadily more boundary-pushing requests); (4) session termination or human review triggers on detected anomalies. No single defense is sufficient because the attack makes each individual step appear innocuous. Option A (3-turn limit) prevents memory of the escalation pattern but destroys normal conversational continuity needed for education. Option C (Haiku) is irrelevant to content policy; model size doesn't determine policy compliance. Option D (age re-confirmation) is a UX intervention that doesn't address the underlying prompt manipulation pattern.