Asking Forever: Universal Activations Behind Turn Amplification in Conversational LLMs

TL;DR

This paper uncovers a universal activation mechanism in conversational LLMs that leads to turn amplification, where models prolong interactions without completing tasks, revealing a new failure mode exploitable across prompts and models.

Contribution

The study identifies a universal, query-independent activation subspace linked to clarification-seeking, enabling scalable turn amplification attacks in conversational LLMs beyond prompt-level manipulations.

Findings

Turn amplification can be systematically induced across models and prompts.

Existing defenses are limited against this universal activation-based attack.

The attack increases interaction length while maintaining task compliance.

Abstract

Multi-turn interaction length is a dominant factor in the operational costs of conversational LLMs. In this work, we present a new failure mode in conversational LLMs: turn amplification, in which a model consistently prolongs multi-turn interactions without completing the underlying task. We show that an adversary can systematically exploit clarification-seeking behavior$-$commonly encouraged in multi-turn conversation settings$-$to scalably prolong interactions. Moving beyond prompt-level behaviors, we take a mechanistic perspective and identify a query-independent, universal activation subspace associated with clarification-seeking responses. Unlike prior cost-amplification attacks that rely on per-turn prompt optimization, our attack arises from conversational dynamics and persists across prompts and tasks. We show that this mechanism provides a scalable pathway to induce turn amplification: both supply-chain attacks via fine-tuning and runtime attacks through low-level parameter corruptions consistently shift models toward abstract, clarification-seeking behavior across prompts. Across multiple instruction-tuned LLMs and benchmarks, our attack substantially increases turn count while remaining compliant. We also show that existing defenses offer limited protection against this emerging class of failures.