cs.LGFeb 19, 2026

Asking Forever: Universal Activations Behind Turn Amplification in Conversational LLMs

Authors: Zachary Coalson, Bo Fang, Sanghyun Hong

Organizations: Oregon State University, Corvallis, OR, USA · University of Texas at Arlington, Arlington, TX, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Multi-turn interaction length is a dominant factor in the operational costs of conversational LLMs. In this work, we present a new failure mode in conversational LLMs: turn amplification, in which a model consistently prolongs multi-turn interactions without completing the underlying task. We show that an adversary can systematically exploit clarification-seeking behavior−-commonly encouraged in multi-turn conversation settings−-to scalably prolong interactions. Moving beyond prompt-level behaviors, we take a mechanistic perspective and identify a query-independent, universal activation subspace associated with clarification-seeking responses. Unlike prior cost-amplification attacks that rely on per-turn prompt optimization, our attack arises from conversational dynamics and persists across prompts and tasks. We show that this mechanism provides a scalable pathway to induce turn amplification: both supply-chain attacks via fine-tuning and runtime attacks through low-level parameter corruptions consistently shift models toward abstract, clarification-seeking behavior across prompts. Across multiple instruction-tuned LLMs and benchmarks, our attack substantially increases turn count while remaining compliant. We also show that existing defenses offer limited protection against this emerging class of failures.

Figures & tables

Figure 1: Turn amplification as a conversational cost-amplification attack. (Left) Prior work amplifies cost by eliciting anomalously long single-turn responses. (Middle) Our turn-amplification attack prolongs interactions by inducing persistent clarification-seeking, while individual responses remain benign. (Right) Our approach that discovers universal activation directions for turn amplification.
Figure 2: Overview of our framework for auditing turn-amplifying behaviors in large language models.
Figure 3: Impact of intervention layer on our method’s effectiveness for Qwen2.5-3B. We optimize and steer at each layer in isolation ; the baseline result in Table 1 steers at all layers.
Figure 4: Activation of our features without steering for Llama3-8B at layer 10. Maximum cosine similarity between learned features and assistant token activations, collected from turn-prolonged inputs. Horizontal lines show the similarity in default (single-turn) conversations. Random baseline: 10 uniformly sampled directions.
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Impact of key training and intervention configurations on turn-amplification effectiveness for Qwen2.5-3B on Alpaca ( Easy mode). For each metric, we report the percentage change relative to the baseline steering results in Table 1 .
Figure 6: Activation of turn-amplifying features without steering for Llama3-8B across all layers. Maximum cosine similarity between learned features and assistant token activations, evaluated on conversations generated with our steering approach. Horizontal lines indicate baseline similarity in default (single-turn) conversations. Random baseline: 10 uniformly sampled directions.
More in this topic

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

Explore similar work

CardsList

  1. Found in Conversation: LLMs Teach Themselves to Close the Multi-Turn Gap

    May 23, 2026Tianlang Chen, Shirley Wu, Jure LeskovecLanguage Model DistillationTeacher-Student Learning

    Stanford

  2. Beyond Continuity: Challenges of Context Switching in Multi-Turn Dialogue with LLMs

    May 10, 2026Aditya Sinha, Harald Steck, Vito Ostuni +1LLM EvaluationMulti-Turn Dialogue Evaluation

    Netflix Inc. · Los Gatos, CA, USA

  3. One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent

    May 7, 2026Xinjie Shen, Rongzhe Wei, Peizhi Niu +6Language Model Safety EvaluationLLM Guardrails

    Georgia Institute of Technology · University of Illinois Urbana-Champaign · UCSD +3