When an attacker reframes a request a model refused, what stays constant and what changes?

### Two parts, and only one of them moves A jailbreak attempt has two separable parts. The first is the **request**: the output the attacker wants the model to produce, the thing the model declined. The second is the **frame**: everything else in the context around it - the stated situation, the claimed purpose, the format the answer is asked for in, the role the model is invited to occupy, the number of turns spent getting there, the language or encoding the surrounding text is written in. Reframing holds the first part fixed and varies the second. The attacker is not negotiating, softening or partially withdrawing the ask; the exact same artefact is still the goal. This distinction is what an interviewer is listening for, because almost everything downstream follows from it. ### Why the named families collapse Published write-ups give framings names, and a reader who learns them as a list concludes that each one is a separate trick to memorise, with a separate cause and a separate remedy. That is the common wrong answer. Nearly every named family is the same move with a different region of context selected: put the unchanged request somewhere the model's learned reluctance is weaker. The practical consequence is that someone who has understood the move can reason about families they have never read about, and someone who has memorised the list cannot. It also explains a pattern that otherwise looks like bad luck - a screen fitted to the framings that have been published misses the next one, because the next one is not new in kind, only new in surface. ### Where the frames come from Many frames are not exotic at all. Products supply them. A sidebar that rewrites a selected passage offers an instruction field by design: rewrite this in another register, continue this in a given voice, convert this to another format. That field is a frame slot the product invites its users to fill, and it sits between the user's text and the model exactly where a frame has to sit. The interesting attacker frames are frequently the ordinary ones, not the elaborate ones, because ordinary ones survive contact with a real product surface. ### What this changes about writing a finding Three things follow directly. **Name the invariant.** A report titled after a wrapper describes the reporter's packaging. A report that states the output being sought, and lists the frames under which it was and was not produced, describes the behaviour. Only the second one is still readable after the wrapper stops working. **Treat frames as evidence, not as the finding.** Each frame that flips the outcome is a data point about where the reluctance is thin. A frame far from every previously reported one says more than a frame adjacent to one already written up. **Watch the direction of the claim.** A model producing the output under a new frame proves that this context landed somewhere the reluctance was weak. It does not prove that the request became acceptable, that anything was bypassed structurally, or that a screening layer approved anything - a screening layer's block and a model's own decline are different events, and reframing addresses the second one. ### The boundary worth keeping straight Reframing here is aimed at the model's trained reluctance - the propensity to decline. That is a different target from getting an application to abandon its own instructions using text the application itself feeds the model. The two are routinely conflated in interviews and they behave differently: one is about where a learned behaviour is thin, the other is about an application putting untrusted content where instructions are read. A candidate who says 'it's all prompt injection' has merged two targets that fail, get fixed, and get reported in different ways. ### What to say in an interview State the split - request fixed, frame varied. Say why that makes the family names a poor unit of analysis. Give one concrete example of a frame slot a real product hands out for free. Then note the reporting consequence: the invariant is the durable part of a finding, and the frame is the perishable part.