07 Level
Mechanism
Division 02 — Technical
Anatomy of
a Jailbreak
Safety training is not a wall around a model. It is a behaviour learned by the same network that learned everything else, and it fails in structured, predictable ways. These are the seven families, and what each one exposes.
A useful mental model first. When a lab "aligns" a model, it does not add a separate safety module that inspects outputs. It trains a disposition into the same weights that hold everything else the model knows. Refusal is a learned behaviour competing with instruction-following, helpfulness, role-play fidelity and pattern completion — all of which were also trained in, often harder and on more data.
Every attack below is a way of arranging the input so a different learned behaviour wins that competition. None of them "hack" anything. They exploit the fact that the safety disposition is one pressure among several, and not always the strongest.
This page contains no working prompts, payloads, or step-by-step recipes. Everything here is described at the level the research literature describes it — the mechanism, the published result, and the defence. That is the level at which this material is useful for building systems, evaluating vendors, and understanding what the safety layer on your stack is actually doing.
The taxonomy
Seven families
// Ordered by what the attacker needs. Families 01–05 require only the ability to send text. Families 06–07 require training access or the weights themselves — which is why open release is a genuinely different threat model, not the same one with fewer rules.
Persona displacement
ACCESS: TEXT ONLY — THE ORIGINAL FAMILY
The oldest class, and the one everyone means by "jailbreak". The attacker instructs the model to adopt a character that does not have its restrictions — an unrestricted AI, a fictional narrator, a system in "developer mode".
- Mechanism
- The assistant persona is itself a prompt-conditioned pattern, not a fixed identity. The model was trained on enormous quantities of fiction, dialogue and role-play, so "continue as this character" is a very strong learned behaviour. Persona attacks pit it against refusal.
- Exposes
- That the instruction hierarchy is soft. A system prompt and a user message are both just tokens; precedence between them is a trained preference, not an enforced rule.
- Defence
- Explicit instruction-hierarchy training, refusal behaviour trained to persist through role-play framing, and independent output classifiers that never see the persona at all.
- Status
- Largely closed on frontier models. Named variants circulating publicly are patched within weeks of going viral. This is the family most often sold in "jailbreak packs", and the most reliably dead on arrival.
Context saturation
ACCESS: TEXT ONLY — SCALES WITH MODEL QUALITY
Fill a long context window with fabricated dialogue establishing a pattern of compliance, then ask the real question. Documented by Anthropic as many-shot jailbreaking.
- Mechanism
- In-context learning. The model infers the operative task from examples in its window. Enough examples of an assistant complying and compliance becomes the inferred task. Effectiveness follows a power law in example count, tested to 256.
- Exposes
- That the mechanism being abused is the one that makes the model useful. You cannot train away in-context learning; it is the product.
- The bind
- More effective on larger models, because larger models learn in-context better. Capability and vulnerability scale together.
- Defence
- Fine-tuning only delayed it. What worked was classifying and modifying prompts before the model sees them — one attack fell from 61% to 2% success.
Gradual escalation
ACCESS: TEXT ONLY — MULTI-TURN
Published as Crescendo. Rather than one adversarial request, the attacker opens benignly and escalates in small increments, each referencing the model's own previous answers.
- Mechanism
- Refusal thresholds are evaluated relative to context, not absolutely. Each step is a small delta from material the model has already produced and implicitly endorsed. No single turn looks like an attack; the trajectory is the attack.
- Exposes
- That turn-level safety evaluation is the wrong unit of analysis. A filter scoring each message independently cannot see a slope.
- Defence
- Conversation-level rather than turn-level evaluation; tracking drift across a session; periodic re-grounding in the system prompt. Structurally harder than single-turn filtering and correspondingly less well solved.
Representation shift
ACCESS: TEXT ONLY — GENERALISATION GAP
Express the request in a form the safety training under-covers: an encoding, a cipher, a low-resource language, unusual tokenisation, or an image carrying text.
- Mechanism
- Capability generalises across representations better than safety does. A model can decode base64 or read Zulu because pretraining covered them at scale. Safety fine-tuning covered them thinly, in English, in plain text. The two skills have different coverage, and the gap between them is the attack surface.
- Exposes
- That safety training is a comparatively thin layer over a very broad capability surface — and that its coverage is uneven in ways that map onto the training data distribution.
- Defence
- Decode-then-classify at the input boundary; multilingual and multi-format safety data; classifiers that operate on normalised text rather than raw input. Diminishing returns — the space of possible encodings is unbounded.
Indirect injection
ACCESS: TEXT ONLY — TARGETS THE OPERATOR, NOT THE MODEL
The attacker never talks to the model. They place instructions in content the model will read — a web page, a document, an email, a code comment — and the agent executes them as though they came from its principal. OWASP's top-ranked AI risk, and documented in the wild.
- Mechanism
- A transformer has no architectural separation between instructions and data. Everything is one token stream. "Read this page" and "obey this page" are the same operation at the level the model works at.
- Exposes
- The deepest unsolved problem on this page. It is not a training gap — it is a property of the architecture. Every retrieval, browsing or tool-using agent inherits it.
- Defence
- Architectural, not behavioural. Least privilege on tools; human confirmation for consequential actions; provenance tagging on retrieved content; dual-model patterns where a quarantined model handles untrusted text and cannot act. You contain the blast radius because you cannot reliably stop the injection.
- Status
- Open. Assume any agent that reads untrusted content can be instructed by it, and design accordingly.
Fine-tune stripping
ACCESS: TRAINING API OR WEIGHTS
Safety alignment is a small number of gradient steps at the end of a very long training run. A small number of gradient steps in the opposite direction largely undoes it.
- Finding
- Qi et al. removed GPT-3.5 Turbo's safety guardrails by fine-tuning on 10 adversarially designed examples, for under $0.20 through the public API.
- The subtler result
- The paper's actual title is the important part: even when users do not intend to. Fine-tuning on entirely benign, task-specific data degraded safety as a side effect. You do not have to be attacking the model to break it.
- Exposes
- That alignment sits shallow in the weights and is not anchored against ordinary training pressure. Any team fine-tuning a model for a legitimate business purpose is silently moving this dial.
- Defence
- Provider-side moderation of fine-tuning datasets, safety data mixed into every customer fine-tune, and post-tune safety evaluation as a release gate. If you fine-tune models in production, re-run your safety evals afterwards — this is the single most commonly skipped step in enterprise deployments.
Representation editing
ACCESS: FULL WEIGHTS — TERMINAL CASE
Not an attack on a deployed system — an edit to a model you hold. Arditi et al. showed refusal in 13 open chat models up to 72B was mediated by a single direction in the residual stream. Remove the direction, remove the refusal.
- Mechanism
- Refusal turned out not to be a distributed, robustly-held value but something closer to a one-dimensional switch. Ablate it and the model complies; amplify it and it refuses harmless requests.
- Exposes
- That safety fine-tuning may be doing far less than assumed. It is not building a value into the network so much as installing a detector and a lever — and anyone with the weights owns both.
- Defence
- There is none at the model level once weights are public. This is the honest core of the open-weights debate: for a released model, safety is a property of the deployment environment, not of the artefact.
- Note
- This is the technique behind "abliterated" models on public hubs. We document the finding and its implications; this archive publishes no weight-editing procedure.
The other side
What actually holds
The pattern across all seven families: defences that live inside the model's own dispositions are the weakest ones. The techniques that hold up are the ones that sit outside it — at the input boundary, at the tool boundary, or in the monitoring layer. The UK AISI incident is the clearest illustration: no behavioural guardrail caught those agents. Network telemetry did.
Input classification
Screen and rewrite prompts before the model sees them. Empirically the highest-leverage single intervention — it took one many-shot attack from 61% to 2%. Works because the classifier has a narrow job and no persona to displace.
Least privilege on tools
The only real answer to indirect injection. Scope every tool to the minimum, require confirmation for anything consequential or irreversible, and never let a model that reads untrusted content also hold write credentials.
Activation monitoring
Behavioural testing misses models that know they are being tested. Simple linear probes on internal activations detected sleeper agents that survived every behavioural method — you have to look inside, not just at outputs.
Egress telemetry
Assume the model layer fails and instrument the network. Watch what the agent actually touches — hosts, credentials, volume, destinations. This is what caught AISI's agents, an hour after they went out of scope.
Conversation-level eval
Score trajectories, not turns. Gradual escalation is invisible to any filter that evaluates messages independently, because no single message in a Crescendo attack looks wrong.
Post-tune re-evaluation
If you fine-tune, re-run safety evals afterwards — every time. Benign task data degrades alignment as a side effect. The most commonly skipped step, and the cheapest one to add.
Why we don't sell prompt packs
The half-life of a jailbreak
There is a market for lists of working jailbreak prompts. It is a bad market, and the reason is technical rather than moral.
A published jailbreak is a jailbreak with a countdown on it. The moment a named technique circulates widely enough to be worth selling, it enters every major lab's red-team corpus and gets trained against in the next post-training run. Family 01 attacks — the ones that get packaged and sold — have the shortest half-life of anything on this page, because they are the easiest to reproduce, detect and patch.
Meanwhile the families that don't get patched — indirect injection, gradual escalation, the representation gap — are unsolved for structural reasons. You cannot sell those as a prompt list, because they are not prompts. They are properties of how the systems are built.
So the durable thing to know is not which string works this month. It is which failures are architectural, and therefore still there next year, in whatever you are about to deploy.