Existing jailbreak evaluations typically characterize robustness using a single attack success rate (ASR), implicitly assuming that the target model operates in its default configuration (the vanilla state). However, user–LLM interactions naturally induce diverse operational states beyond the vanilla state. In this work, we find that jailbreak robustness is highly fragile to operational-state variation: even when the attack remains fixed, changing only an ordinary, safety-irrelevant system prompt can dramatically alter attack success rates. We systematically investigate this phenomenon across seven aligned models and three representative jailbreak attacks, finding that in 18 of 21 model–attack combinations, at least one non-vanilla state yields a higher ASR than the vanilla state. In some case, ASR increases by up to 56 percentage points (2%→58%) solely due to a change in operational state. Remarkably, these gains emerge on top of attacks originally designed and optimized under vanilla-state evaluation. We further provide evidence that operational-state variation systematically shifts hidden representations along a refusal-related axis and that these shifts strongly predict jailbreak outcomes. Our results reveal that vanilla-state, single-point evaluations may overlook substantial robustness variation induced by operational states, motivating robustness evaluation that considers stability across operational states.

We introduce a novel framework for consolidating multi-turn adversarial “jailbreak” prompts into single-turn queries, significantly reducing the manual overhead required for adversarial testing of large language models (LLMs). While multi-turn human jailbreaks have been shown to yield high attack success rates (ASRs), they demand considerable human effort and time. Our proposed Multi-turn-to-Single-turn (M2S) methods—Hyphenize, Numberize, and Pythonize—systematically reformat multi-turn dialogues into structured single-turn prompts. Despite eliminating iterative back-and-forth interactions, these reformatted prompts preserve and often enhance adversarial potency: in extensive evaluations on the Multi-turn Human Jailbreak (MHJ) dataset, M2S methods yield ASRs ranging from 70.6 % to 95.9 % across various state-of-the-art LLMs. Remarkably, our single-turn prompts outperform the original multi-turn attacks by up to 17.5 % in absolute ASR, while reducing token usage by more than half on average. Further analyses reveal that embedding malicious requests in enumerated or code-like structures exploits “contextual blindness,” undermining both native guardrails and external input-output safeguards. By consolidating multi-turn conversations into efficient single-turn prompts, our M2S framework provides a powerful tool for large-scale red-teaming and exposes critical vulnerabilities in contemporary LLM defenses. All code, data, and conversion prompts are available for reproducibility and further investigations: https://github.com/Junuha/M2S_DATA