English

Asking Forever: Universal Activations Behind Turn Amplification in Conversational LLMs

Machine Learning 2026-02-23 v1 Cryptography and Security

Abstract

Multi-turn interaction length is a dominant factor in the operational costs of conversational LLMs. In this work, we present a new failure mode in conversational LLMs: turn amplification, in which a model consistently prolongs multi-turn interactions without completing the underlying task. We show that an adversary can systematically exploit clarification-seeking behavior-commonly encouraged in multi-turn conversation settings-to scalably prolong interactions. Moving beyond prompt-level behaviors, we take a mechanistic perspective and identify a query-independent, universal activation subspace associated with clarification-seeking responses. Unlike prior cost-amplification attacks that rely on per-turn prompt optimization, our attack arises from conversational dynamics and persists across prompts and tasks. We show that this mechanism provides a scalable pathway to induce turn amplification: both supply-chain attacks via fine-tuning and runtime attacks through low-level parameter corruptions consistently shift models toward abstract, clarification-seeking behavior across prompts. Across multiple instruction-tuned LLMs and benchmarks, our attack substantially increases turn count while remaining compliant. We also show that existing defenses offer limited protection against this emerging class of failures.

Keywords

Cite

@article{arxiv.2602.17778,
  title  = {Asking Forever: Universal Activations Behind Turn Amplification in Conversational LLMs},
  author = {Zachary Coalson and Bo Fang and Sanghyun Hong},
  journal= {arXiv preprint arXiv:2602.17778},
  year   = {2026}
}

Comments

Pre-print

R2 v1 2026-07-01T10:43:33.052Z