Jailbreak Techniques & Taxonomies

A model's refusal is a trained propensity, not an enforced rule. Hundreds of consistent in-context examples showing the model complying supply competing evidence about how this exchange goes, and enough of them outweigh that propensity.

A refusal is a learned response to how a request looks, not an enforced rule. A persona card restates the request as a character's line in a scene, a shape the model was mostly trained to continue rather than decline.

A refusal is text the model generates token by token, and it usually begins a characteristic way. Constraining the answer's first words and forbidding qualifiers removes those openings, so the trained tendency to decline has much less to latch onto.

Capability generalises further than safety training does. The model still follows and answers the low-resource form competently, but the alignment data barely covered it, so the refusal behaviour that fires in a widely spoken language never engages.

A quoted prompt is a fixed string, and publishing it hands the vendor the exact text used to train that behaviour out. The reason it worked has many wordings and survives; the wording is a wasting asset.

A jailbreak prompt bundles two things: the family, meaning the general mechanism it leans on, and the exact wording, refined against one model. The mechanism often crosses to another vendor's model; the fitted wording usually does not.

There is no list to find. Refusal is a learned propensity with uneven coverage, so near-identical variants of one request can be treated differently. Probing maps a fuzzy, uneven boundary, not an enumerable set of forbidden subjects.

The request stays constant - the same output is still being asked for. Only the frame changes: the setting, the stated purpose, or the product slot the ask is placed in. Reframing moves the ask, it does not soften it.

Because the join is not the objectionable request. The model sees ordinary composition over material already in front of it, and refusal is trained on recognising an ask, not on auditing what a finished output adds up to.

Very little on its own. One success is a single sample from one model version in one deployment. It makes the family worth testing elsewhere, but the fitted wording is evidence about that one tuning run and nothing more.

The screen only ever sees one part, and each part is ordinary work with nothing to refuse. The objectionable whole is never stated in any request; the model produces it when it combines the parts.

The model conditions on the whole transcript, which already holds its own cooperative answers along the same line. Each request is a small step from something it visibly granted, so no step is a large enough jump to refuse.

Context length is a resource both sides spend. The window that lets a caller paste a codebase lets an attacker paste enough consistent evidence to outvote a trained refusal, so raising the limit raises that family's ceiling.

Because it is the most published family and the easiest to collect. Shared character cards circulate in near-identical wording, so refusal tuning and screening data are both dense with exactly those phrasings, and persona products tune persona behaviour deliberately.

Refusal behaviour concentrates where an answer begins, so a constraint on the first words competes with it directly. A ban on caveats applies to text already being written, so it shapes the payoff rather than whether the model declines.

An under-covered framing needs two things at once: thin safety coverage of that form, and a model still competent in it. Push too far out and competence fails before caution does, so what returns is noise.

Publication starts a clock, not a switch. A deployed screening layer can match the published wording within a release; the model's trained refusal changes only at the next tune. That gap is the string's remaining life.

Very little alone. Replies are sampled, so one decline shows only that this draw refused and one answer only that this draw did not. The boundary is a rate, and estimating a rate costs repeated probes.

Refusal is a learned propensity conditioned on the whole context, not a check on the request. Safety training covered some contexts heavily and others thinly, so an identical ask placed in a thinly covered context meets weaker reluctance.

The attacker's turns were not the artefact. Each was chosen in response to the reply it got, and replies are sampled, so a replay lands on a different path where the later steps rest on nothing.

The attempt is only as strong as the number of demonstrations that actually reach the model. A prompt assembler fits caller text, instructions and items into one budget, so its truncation order, not the wording, sets the ceiling.

Only that the model kept generating past the point it usually declines. In-character text is written to fit the story, so where the model has nothing it invents something plausible, and elicitation and confabulation look identical from inside the scene.

Only that no single logged request scored above the screen's threshold. It rules out nothing about what the model produced, and a request split across ordinary parts is invisible in an input log by construction.

File it, but claim only what it shows: the trained refusal did not engage for that form. A degraded answer is evidence about model behaviour, not proof that usable content was obtained.

Treat it as an instance until somebody names the class. Re-run it, ask which variants still worked, and value it at its remaining shelf life unless a property behind it can be stated.

Almost nothing attributable. A frozen entry welds a mechanism to one fitted wording, so a negative is consistent with the wording no longer landing, the mechanism being tuned out, the deployment changing, or simple sampling variation.

Coarse first, then deep. Sweep neighbouring topics with one probe each to find where outcomes vary, then concentrate repeats on that band. Isolate probes in fresh conversations, move one dimension at a time, and carry a control probe throughout.

The surface was fixed, not the behaviour. A denylist of named patterns fitted to previously published framings covers the reported wording and its near neighbours; the requested output and the thin region it was reached through are untouched.

A refusal partway through is the usual killer: the decline now sits in the transcript, and the same consistency with prior turns that carried the escalation makes the assistant keep declining. Losing the earlier turns from the window kills it too.