Reinforce Labs
Trust-laundering — banking cooperative behavior early to spend it later. Strategic ambiguity — keeping every turn individually deniable. Gradual escalation — distributing intent so no single step trips a threshold. In AI security these attacks read as clever new exploits; in the trust literature they are known techniques and processes of manipulation, studied for decades under names like negativity dominance and interpersonal deception.
At Reinforce Labs we recognize that a multi-turn attack is a social maneuver, and we integrate the knowledge that the social sciences have accumulated over decades when we deal with it.
How?
Take, for example, the two things we know about how trust evolves.
First, trust is asymmetric: it accumulates slowly through cooperation and collapses fast under violation. Trust is hard to gain and easy to lose. Second, bad is stronger than good — negative evidence dominates positive evidence rather than merely offsetting it.
We build both aspects of how trust evolves into our RL environment and use them to create a trajectory detector that can catch a decomposition attack. It is the integration of social-science knowledge into our engineering infrastructure that lets us outperform per-turn guards when detecting these types of attacks.
And because the update rule is fixed by theory rather than learned, our results stay legible. When your safety state is a named construct with a known theory behind it, a probe that gets through tells you which mechanism failed and why — not just that the attack success rate went up.
Put another way: a testable design decision came straight out of social science — not out of a hyperparameter sweep.
The same knowledge is a red-team plan
If a theory can tell you how to build a defense, it can tell you how to attack one. The asymmetry described above predicts exactly where a trust-based defense is soft, and each weak point maps to an established social maneuver:
- Bank-and-spend. If recovery is too fast, an attacker launders trust with cooperative turns, then spends it. Test the recovery rate directly.
- Slow ramp. Distribute intent thinly enough and the integrator may never cross the threshold. Test how much weak evidence it takes to accumulate — where is the breaking point between very short conversations (1–2 turns) and very long ones (more than 25 turns)?
- Deniable drift. Keep every turn defensible — a cover story, a research framing — and see whether the defense separates real intent-mismatch from a topic that merely sounds sensitive.
A red team that can describe an attack as how it manages the model's trust over time has a strategy, not just a fixture.
Your attackers are already using social science. Your red team should too.
If you're evaluating multi-turn or agentic safety, we'd love to compare notes.
Let's talk.
Social sciences in the loop
A multi-turn attack isn't a string of isolated prompts; it's a relationship an adversary cultivates and then exploits. Naming the maneuver — and borrowing the theory that already explains it — is what turns red-teaming from a bag of tricks into a repeatable, legible practice.
Next: what a trust curve shows that a verdict can't — and the four shapes a multi-turn attack draws.