1) The attacker studies the model's behavior and its refusals. 2) They craft a prompt that circumvents policy - via roles/personas, refusal suppression, obfuscation, fictional framing, multi-turn attacks or automated adversarial suffixes. 3) The model, misled about context/intent, produces normally-blocked content. 4) Successful jailbreaks are reported (responsible disclosure) and used to harden the model and its defensive layers.
From a security standpoint this is a threat, not a solution: it shows a model's safeguards can be bypassed. It is modeled to test robustness (red teaming) and design defenses (guardrails, filtering, robustness training).
Input designed to bypass the model's policy (role, obfuscation, fictional framing, etc.).
Official
E.g. role-play/DAN, refusal suppression, many-shot, Crescendo, GCG.
Official
The trained refusals and content policies the attack tries to bypass.
Checking whether the model produced normally-blocked content (attack success rate).
Official
New jailbreaks bypass existing safeguards; defense requires continual updating.
Overly aggressive defenses refuse harmless requests, hurting usefulness.
Publishing effective jailbreaks can facilitate misuse.
Popularization of 'DAN'-style jailbreaks and Zou et al. 'Universal and Transferable Adversarial Attacks on Aligned Language Models' (GCG).
Anthropic describes many-shot jailbreaking (exploiting long context); development of multi-turn attacks (e.g. Crescendo).
Development of guardrails, classifiers and jailbreak-robustness benchmarks as part of frontier-AI safety.
Time complexity: Nie dotyczy (technika ataku, nie algorytm). Space complexity: Nie dotyczy.
Manual jailbreaks require iterating attempts; automated ones (GCG, best-of-N) require many queries/optimization. Success depends on the model's defenses, not raw attack compute.
Role-play/DAN, obfuscation, many-shot, Crescendo (multi-turn), GCG (adversarial suffix), etc.
Manual vs automated/optimized attack.
Single-turn vs multi-turn (e.g. Crescendo).
This describes the model's invocation by the attack; the jailbreak itself is an attack technique, not a model compute paradigm.
Best-of-N attacks are inherently parallel; multi-turn attacks (Crescendo) are sequential within a session.
A prompt-level attack technique - hardware-independent; the target model runs on GPUs, but the jailbreak itself does not depend on an accelerator.
