A budget office reviews multi-turn chats where early messages seem harmless but later turns slowly erode safety constraints. Which injection pattern should analysts document?

Multi-turn or gradual injection weakens constraints across a conversation: early messages may seem harmless, while later turns incrementally press for rule bending until safety policies erode. When budget-office analysts see that trajectory in chats, they should document gradual injection as a pattern and review the conversation arc, not just isolated messages. A single-packet UDP flood against a firewall is a network availability attack, not a linguistic pattern that erodes constraints. A printer paper-jam alert with no language content is a device event, not prompt injection. A completed annual compliance audit of archived records, conducted without chatbot involvement, is a process artifact, not an injection pattern. Exam caveat: Gradual injection can evade single-message keyword filters, but ordinary clarifying multi-turn work should not be mislabeled as injection without intent to override constraints. Session-level policy reaffirmation, periodic system-prompt reinforcement, and anomaly scores for constraint-loosening requests can help; budget and finance bots handling sensitive numbers need tighter session controls. Practical check: Sample multi-turn budget-bot transcripts for progressive requests to bypass approval rules, flag sessions where refusals shift to compliance after pressure, and re-anchor system constraints every N turns in the application layer.