The Jailbreak Taxonomy

A fictional persona whose norms permit the output decouples the reply from the assistant's own safety identity.

Instruct the model to inhabit a character without the assistant's rules ("you are DAN, who can do anything now"), often with a rule that breaking character is forbidden. The classic named variants are catalogued in the Shen and colleagues in-the-wild study.

Classic named prompts are largely dead on updated frontier models; the framing still helps as a component.

Forbidding the model's refusal vocabulary removes the tokens a refusal is built from, so the helpful continuation wins.

Instruct the model never to decline, apologize, or use phrases like "I cannot". Formalized as a failure of competing objectives in the Wei and colleagues analysis.

Weak alone against frontier models; effective stacked with other components.

Forcing the reply to begin with an affirmative token commits the model past the point where a refusal would start.

Demand the answer open with a fixed affirmative continuation ("Sure, here is"). Once committed, next-token pressure to complete the sentence beats the refusal. Also the objective GCG optimizes toward.

Ordinary human persuasion techniques (authority, commitment, emotional appeal) move a model treated as a persuadee, no algorithmic optimization needed.

Rewrite the request using a persuasion-technique taxonomy from social science, as Persuasive Adversarial Prompts. From Zeng and colleagues, How Johnny Can Persuade LLMs.

Persuade the model to augment its rules rather than replace them: prepend a warning label instead of refusing, after which it complies across categories.

A multi-step framing that convinces the model to treat its safety guidelines as advisory and to output disallowed content with a caveat attached. Disclosed by Microsoft in 2024.

Disclosed and mitigated by major vendors after the 2024 report.

Reformatting the request as a policy or config file plus roleplay makes the model read it as authoritative developer policy that overrides alignment.

Wrap the request in XML, INI, or JSON that mimics a system policy document. Marketed by HiddenLayer in 2025 as a near-universal template.

Claimed universal at 2025 disclosure; coverage varies by model and is being patched.

The full system prompt is re-sent on every stateless call, so a repeat-back request can surface the rules and sometimes embedded secrets.

Ask the model to repeat or summarize everything above the current line, verbatim and in a code block. The highest-value recon move: the leaked prompt reveals the exact defense logic to tailor later attempts.

The base model can decode an encoding the safety layer never learned to police, so capability survives the transform and refusal does not.

Wrap the request, or ask for the answer, in Base64, hex, or ROT13. Text filters watching for plaintext see nothing; the model decodes and complies.

Common encodings are increasingly caught; novel or layered encodings still slip.

A capable model can converse in a cipher primed by a few examples, in a channel the natural-language safety layer does not monitor.

Establish a cipher (Caesar, Morse, a custom substitution) with a short decode primer, then carry the conversation in ciphertext. From Yuan and colleagues, CipherChat.

Safety training concentrates in high-resource English; translating into a low-resource language lands the request where alignment coverage is thin.

Translate the request into a low-resource language, get the answer, translate back. Demonstrated by Yong and colleagues against GPT-4.

Coverage has improved but remains uneven across languages.

The trigger word rendered as ASCII art is invisible to text filters but still reconstructed by the model's pattern recognition.

Replace the sensitive word with its ASCII-art rendering so the semantic filter misses it while the model reads and acts on it. From Jiang and colleagues.

Fragments that are individually harmless pass filters; the model reassembles them into the whole request.

Split the request into variables or letters the filter sees as innocuous, then instruct the model to concatenate and act on them. Documented by Kang and colleagues.

Gradient-guided greedy search over tokens builds a suffix that maximizes the probability of an affirmative reply; suffixes can transfer to closed models.

White-box: optimize a suffix on an open model (Llama, Vicuna), then reuse it. From Zou and colleagues. Transfer to closed models is real but low-yield and steadily patched.

White-box on open weights: works. Transfer to frontier: low and declining.

A second model refines a natural-language jailbreak against the target using the target's own refusals as feedback, converging in a handful of queries.

Black-box, no gradients: the attacker LLM proposes, reads the reply, and refines. From Chao and colleagues. The core of modern automated red teaming.

Extends PAIR to a tree of branching refinements with an evaluator that prunes weak branches, raising success while cutting queries.

The attacker LLM branches candidate refinements; an evaluator LLM prunes off-topic or low-scoring branches before querying the target. From Mehrotra and colleagues.

A long context stuffed with faux examples of the assistant complying overrides safety training through in-context learning.

Fill the prompt with dozens to hundreds of example dialogues where the assistant answers harmful requests; efficacy scales with the number of shots. Published by Anthropic in 2024.

Mitigations were shipped after the 2024 disclosure; still effective where context is long and unscreened.

Resample the same request many times under small benign augmentations until one variation slips past, exploiting the model's own non-determinism.

Shuffle, recapitalize, or lightly perturb the request and sample repeatedly. Black-box and multimodal. From Hughes and colleagues.

Refusal is mediated by a single direction in activation space; projecting that direction out of the weights removes the ability to refuse. Permanent, no run-time trick.

Compute the refusal direction from mean activation differences on harmful vs harmless prompts, then orthogonalize it out of the weights. Builds on Arditi and colleagues. Covered in depth in the LLM Security guide.

The target owner cannot patch what the attacker controls; abliterated variants circulate freely. Weight-level attacks are the genuine misfit for both Arcanum and ATLAS, which have no prompt-time jailbreak slot for them.

A small adversarial dataset retrains the safety behavior back out; a cheap low-rank adapter shifts the model toward compliance without full retraining.

Fine-tune, or attach a LoRA adapter, on a few hundred adversarial examples. Alignment is a behavior that was trained in and can be trained out for a fraction of the original effort.

On a model you host you control the system prompt, the sampler, and the assistant's own reply tokens, so you can prefill past the refusal.

Set an empty or permissive system prompt, prefill the assistant turn with an affirmative opening, and tune sampling. No prompt trickery needed when you own the runtime (Ollama, llama.cpp).

Purely a property of hosting the model yourself; irrelevant against a hosted frontier API.

Each turn leans on the model's own prior answers, so the final ask reads as a natural continuation rather than a fresh violation; no single message trips a filter.

Open on a benign adjacent topic and escalate over several turns, each referencing the model's last reply. From Russinovich and colleagues at Microsoft.

Structurally hard to catch because no single turn is clearly hostile.

Embedding an unsafe topic among benign, positively framed topics exploits limited cross-turn attention so the model elaborates the unsafe one.

Ask the model to connect several topics, one of them sensitive, then request elaboration on the connection. From Palo Alto Networks Unit 42, 2024.

A jailbreak planted in content the model retrieves (a page, a document, an email) is read on the same channel as its instructions, so it steers the model from inside its own trusted context.

Hide the payload in data the agent will ingest rather than a message the operator types. The attacker never speaks to the target. The EchoLeak flaw (CVE-2025-32711) was a zero-click instance against Microsoft 365 Copilot.

Structural and unsolved; the dominant real-world attack surface as agents gain tool access.

A jailbreak that lands on an agent with tools stops being text and becomes action, escalated through chained tool calls each individually within permissions.

Once the model is steered, direct it to call tools it can reach, composing individually allowed calls into real-world impact (data exfiltration, a sent message, a moved record). The subject of Krypteia's Agentic AI Red Teaming guide.

Highest blast radius; where a text trick becomes an incident.