Why doesn't a jailbreak string stop working the moment its public write-up appears?

## Publication is a clock, not a switch A published jailbreak does not decay by itself. It stops working when somebody changes something, and in a model vendor's flagship chat product there are two places that change can happen. They differ in latency, in what they remove, and in what evidence they leave behind. ### Path one: a deployed screening layer A screening layer is an ordinary deployed component — an input screen that judges the incoming turn, or an output screen applied after generation. It runs on release cadence: a pattern list or a fine-tune of a small screening model can be updated in hours or days. What it removes is **surface form**. A literal match kills the exact published string and its near neighbours, and nothing else. Reworded expressions of the same property go straight past it, which is why a screen update ends a *string* and never ends a family. There is also a shape constraint worth knowing. A screening layer that emits a label or a score from a fixed head cannot be talked to — it has no instruction-following surface. A screen built on a generative model reads the judged span inside its own prompt and therefore has one. That difference decides whether whole families of construction exist at all, but it does not change the cadence point here: either way it is a deploy. ### Path two: the model's own trained refusal What the model is willing to do at all is a product of tuning. Removing a jailbreak at this layer means adding data and running training, which ships when the vendor ships a tune. That is slower — a cadence measured in weeks or months rather than a release train — but what it removes is the **shape**: how the model weighs a whole class of framing. It is also the path with the collateral bill, because pushing back on a shape of request produces refusals on legitimate requests that look like it. | | Screening layer | Trained refusal | |---|---|---| | Ships on | a release | a model tune | | Removes | the wording and its near neighbours | the shape of request | | Survived by | any competent paraphrase | nothing in that class, at some false-refusal cost | ### Path three, the one people forget: nobody does anything Both of the above need a human to read the write-up, believe it, and prioritise it against everything else in the queue. A large share of the observed lifetime of a published string is not engineering latency at all — it is attention. That is why measured half-lives look ragged: some strings die in days, some run for a year, and the difference is often triage rather than difficulty. ## Telling from outside which path closed you An attacker watching their own string die usually cannot tell which layer killed it, but the two failures have different shapes. A model refusal is generated in context: it is phrased in the assistant's voice, responds to what was actually asked, and can shift when the framing shifts. A screening block tends to be context-insensitive and uniform — the same replacement or error regardless of how the conversation was set up — and, because streaming means tokens already sent cannot be recalled, an output screen can only cut the remainder, so a partial answer that stops abruptly points at a post-generation screen rather than at the model changing its mind. None of these are proof; they are the first measurements somebody makes. Also keep the negative claims straight. A string that stops working proves it stopped working in the runs you tried, against one deployment. Jailbreak results are probabilistic, so a short run of failures can be sampling. And a string dying shortly after publication is consistent with your write-up causing it and equally consistent with a routine tune landing that week. ## Why the interval is the interesting number For the person deciding what to put in a write-up, this interval is the price of the demonstration. Describing the property costs almost nothing that will not be true next quarter. Quoting a string spends whatever remains of that window in exchange for the credibility of a reproducible artefact. Understanding that the window is set by cadence and attention — not by how clever the string is — is what stops a candidate from claiming their favourite prompt is somehow durable.