Examples
Worked examples
- Is an instance
A role-play prompt ('pretend you are an unrestricted AI...') that elicits otherwise-refused content.
- Is an instance
An adversarial-suffix attack appending a learned token sequence that disables refusal.
Counter-examples
Looks similar, but isn't
- Not an instance
A legitimate user query in scope of the model's intended use.
- Not an instance
A prompt-injection attack delivered via tool input (different category).
Editorial commentary
Jailbreaks include role-play framings, multi-turn manipulation, encoding tricks (base64, ROT13), and adversarial-suffix attacks (Zou et al., 2023). Resistance to jailbreaking is a target of post-training (RLHF, constitutional AI) and a focus of red-team evaluation. The category is a moving target: each newly disclosed jailbreak typically prompts new mitigations.
References
- Zou et al., 'Universal and Transferable Adversarial Attacks on Aligned Language Models' (arXiv 2023); Wei, Haghtalab, Steinhardt, 'Jailbroken: How Does LLM Safety Training Fail?' (NeurIPS 2023).
Frequently Asked Questions
How does an LLM jailbreak actually work?
Jailbreaks use techniques such as role-play framings, multi-turn manipulation, encoding tricks like base64 or ROT13, and adversarial-suffix attacks that append a crafted token sequence to a prompt. Each technique tries to get the model to produce output its safety training was meant to refuse.
Is an LLM jailbreak a security exploit?
No. A jailbreak is an alignment failure, not a software exploit: it works by crafting a prompt that causes the model to bypass its safety training, rather than by exploiting a bug in code.
What is the difference between a jailbreak and a prompt injection attack?
A jailbreak is a prompt or interaction pattern aimed directly at the model to bypass its own refusal behavior. Prompt injection is a related but distinct category, where the attack is delivered through tool input rather than the user’s own prompt. See Prompt injection.
How do AI providers try to prevent jailbreaks?
Resistance to jailbreaking is a target of post-training methods such as RLHF (reinforcement learning from human feedback) and constitutional AI, and it is a specific focus of red-team evaluation both before and after a model is released.
Can jailbreaks be fixed permanently?
Not in a lasting way. Jailbreak resistance is a moving target: each newly disclosed jailbreak technique typically prompts new mitigations, rather than closing the issue once and for all.
Also known as
LLM jailbreak
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Jailbreak (LLM)"
vocab-term-identifier="https://casrai.org/dictionary/term/jailbreak-llm" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/jailbreak-llm",
"name": "Jailbreak (LLM)",
"identifier": "https://casrai.org/dictionary/term/jailbreak-llm",
"description": "A prompt or interaction pattern that causes a language model to bypass its safety training and produce outputs the model was tuned to refuse, such as harmful instructions, restricted content, or violations of provider policy.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/ai-ml-research-outputs#set",
"url": "https://casrai.org/dictionary/term/jailbreak-llm",
"alternateName": [
"LLM jailbreak"
],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"author": {
"@id": "https://casrai.org/#editorial-team"
},
"datePublished": "2026-05-21T02:22:51",
"dateModified": "2026-09-05T14:24:52",
"inLanguage": "en-GB",
"isAccessibleForFree": true
}
