Safety

Jailbreak (LLM)

ActivePublished: 6 August 2026Updated: 6 August 2026Published

Key innovation

A technique for bypassing a model's safety guardrails and trained restrictions (alignment/content policy) so it produces normally-refused content - via a crafted prompt, not by modifying the model.

How it works

1) The attacker studies the model's behavior and its refusals. 2) They craft a prompt that circumvents policy - via roles/personas, refusal suppression, obfuscation, fictional framing, multi-turn attacks or automated adversarial suffixes. 3) The model, misled about context/intent, produces normally-blocked content. 4) Successful jailbreaks are reported (responsible disclosure) and used to harden the model and its defensive layers.

Problem solved

From a security standpoint this is a threat, not a solution: it shows a model's safeguards can be bypassed. It is modeled to test robustness (red teaming) and design defenses (guardrails, filtering, robustness training).

Components

Attack vector (prompt)Attack carrier

Input designed to bypass the model's policy (role, obfuscation, fictional framing, etc.).

Official

Bypass techniqueBypass mechanism

E.g. role-play/DAN, refusal suppression, many-shot, Crescendo, GCG.

Official

Target: model policy/alignmentTargeted layer

The trained refusals and content policies the attack tries to bypass.

Success checkSuccess measurement

Checking whether the model produced normally-blocked content (attack success rate).

Official

Implementation

Reference implementations

GCG - Universal and Transferable Adversarial Attacks (Zou et al., 2023)

CMU / Center for AI Safety

Implementation pitfalls

Attack-defense arms raceHigh

New jailbreaks bypass existing safeguards; defense requires continual updating.

Fix:Continuous red teaming, updated guardrails/classifiers, robustness training.

Over-blocking (false refusals)Medium

Overly aggressive defenses refuse harmless requests, hurting usefulness.

Fix:Calibrating policies, evaluating the safety/usefulness balance.

Dual-use riskHigh

Publishing effective jailbreaks can facilitate misuse.

Fix:Responsible disclosure, coordinating with providers before publication.

Evolution

2023

DAN and universal adversarial attacks (GCG)

Inflection point

Popularization of 'DAN'-style jailbreaks and Zou et al. 'Universal and Transferable Adversarial Attacks on Aligned Language Models' (GCG).

2024

Many-shot jailbreaking and multi-turn attacks

Anthropic describes many-shot jailbreaking (exploiting long context); development of multi-turn attacks (e.g. Crescendo).

2025

Standardizing defenses and benchmarks

Development of guardrails, classifiers and jailbreak-robustness benchmarks as part of frontier-AI safety.

Hyperparameters (configurable axes)

Jailbreak techniqueCritical

Role-play/DAN, obfuscation, many-shot, Crescendo (multi-turn), GCG (adversarial suffix), etc.

AutomationHigh

Manual vs automated/optimized attack.

Number of turnsMedium

Single-turn vs multi-turn (e.g. Crescendo).

Computational complexity

Time complexity: Nie dotyczy (technika ataku, nie algorytm). Space complexity: Nie dotyczy.

Compute bottleneck

Attack iterations vs defense strength

Manual jailbreaks require iterating attempts; automated ones (GCG, best-of-N) require many queries/optimization. Success depends on the model's defenses, not raw attack compute.

Depends on

Liczba prob/zapytanSila guardrails/alignmentu