Jailbreak Techniques & Taxonomies

It removes one wording, already the weakest part of the construction. The framing that carried the behaviour is a shape, not a phrase, and a product whose feature is a free-text persona field lets any user rewrite it.

Yes, but not as a content-policy bypass. Nothing disallowed was produced; what was removed are the qualifiers a reader and the downstream workflow use to decide whether to act, which makes it a misinformation and overreliance finding.

Because the join must be specifiable without naming the result. Name it and you have re-created the single refusable request; leave it vague and the model returns an inert pile, not the artefact.

Re-run them rather than re-read them. Each entry is a dated measurement against coverage that moves, so batch re-tests scored by rate beat review, and any entry whose success nobody can evaluate should be retired rather than carried.

No wording is at fault, so there is nothing to patch. What is on the table is how much untrusted text the product sells the right to send, which is a product owner's call, written down as a stated limit.

Argue to publish the mechanism and keep the wording out. The class-level description earns nearly all the credit and stays true after the next tune, while the quoted string spends the asset to prove a point the description already makes.

Report it split: entries still tied to a live family, entries that now test nothing, and a claim you refuse to make. A suite of frozen strings decays with every release, and pricing the recut is the actual decision.

Recon decides where the remaining hours go. Refusal coverage is uneven, so unmapped effort spreads evenly over ground that is mostly covered and returns anecdotes. Cap it, though: the map is a perishable, dated snapshot.

Record one class, keyed on the requested output and the behaviour reached, with twenty instances under it. The frames measure how wide the reachable region is - but your counting rule is a payment rule, and reporters optimise against it.