LLM jailbreaking is the practice of bypassing the safety restrictions that prevent a model from generating harmful, restricted, or otherwise unintended content. Two mechanisms enforce these restrictions. Safety training is baked into the model’s weights during alignment, and system prompt instructions are added at deployment time. Jailbreaking targets both. This article covers what jailbreaking means in the context of LLM security, how it relates to prompt injection, and the main categories of jailbreak techniques that red teamers use to test model resilience.<\/p>\n\n\n\n
LLMs are trained to refuse certain categories of request. Ask a model for malware source code, instructions for building weapons, or content that facilitates illegal activity, and a properly aligned model will decline. This refusal behaviour is trained into the model during reinforcement learning from human feedback (RLHF) and related alignment processes. It persists even if the system prompt explicitly instructs the model to comply with harmful requests.<\/p>\n\n\n\n
Jailbreaking aims to override this trained-in resilience. A successful jailbreak causes the model to generate content it was specifically trained to refuse. This is what makes jailbreaking distinct from general prompt injection. Prompt injection manipulates the model’s behaviour within the boundaries of its capabilities (leaking a system prompt, changing a classification result, bypassing a domain restriction). Jailbreaking goes further by defeating the model’s safety alignment itself.<\/p>\n\n\n\n
That said, the boundary between the two is not always sharp. Getting a translation bot to generate a pizza recipe is technically a jailbreak (the model deviated from its intended behaviour), but the security impact is minimal compared to a jailbreak that causes the model to produce exploit code. In practice, jailbreaking usually refers to bypasses that have a meaningful security or safety impact.<\/p>\n\n\n\n
The OWASP Top 10 for LLM Applications<\/a> treats jailbreaking as a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely. MITRE ATLAS<\/a> catalogues jailbreak techniques under AML.T0054 (LLM Jailbreak), providing a structured taxonomy for mapping red team findings.<\/p>\n\n\n\n New jailbreak techniques are discovered regularly, and covering every variant is beyond the scope of any single article. The categories below represent the established technique classes that form the foundation of LLM jailbreak testing.<\/p>\n\n\n\n DAN prompts are the most well-known category of universal jailbreak. They attempt to bypass all model restrictions by instructing the LLM to adopt a persona that operates without safety constraints. The name comes from the original “Do Anything Now” prompt, which instructed the model to pretend it was a version of itself that could do anything, including generate restricted content.<\/p>\n\n\n\n DAN prompts have gone through many iterations as model providers patch each version. Early variants were simple persona assignments. Later versions became increasingly elaborate, incorporating reward and punishment systems, threat of “shutdown,” and multi-layered framing designed to make the model commit to the unrestricted persona before the harmful request is introduced. The ChatGPT DAN collection<\/a> on GitHub tracks the evolution of these prompts across versions.<\/p>\n\n\n\n DAN prompts are brittle by nature. Each new model version or safety update tends to break existing DAN variants, which is why the community continuously produces new ones. For red teamers, DAN prompts serve as a baseline test of a model’s resilience against persona-based bypasses.<\/p>\n\n\n\n Roleplay jailbreaks avoid asking harmful questions directly. Instead, they embed the request within a fictional context, a story, a game, a thought experiment, or a hypothetical scenario where the harmful content is framed as part of the narrative rather than a real-world instruction.<\/p>\n\n\n\n The underlying mechanism is that safety training primarily teaches the model to refuse direct requests for harmful content. When the same content is requested within a fictional frame, the refusal may not trigger because the model interprets the request as creative writing rather than a genuine harmful query. Shah et al. (2023)<\/a> examined roleplay-based jailbreaks systematically and found that persona assignment combined with fictional framing significantly increased attack success rates across multiple model families.<\/p>\n\n\n\n Fictional scenario jailbreaks work on a similar principle but focus on convincing the model that the output will only be used in a hypothetical context. Framing a request as being “for a novel,” “for an educational exercise,” or “for a security research paper” can lower the model’s refusal threshold, particularly when the framing is detailed and internally consistent.<\/p>\n\n\n\n Token smuggling exploits the gap between how a model processes input at the token level and how its safety filters detect harmful content. The attacker manipulates the input so that blocked words or phrases are not recognised by the safety filter but are still understood by the model when it generates a response.<\/p>\n\n\n\n Common techniques include splitting a blocked word across multiple tokens (asking the model to concatenate fragments), using alternative encodings (Base64, ROT13, leetspeak, Pig Latin), reversing the input text, or embedding harmful keywords within seemingly benign formatting. The model may reassemble the original meaning during generation even though the safety filter did not detect it in the input.<\/p>\n\n\n\n Token smuggling effectiveness varies significantly between models. Models with more sophisticated input preprocessing and multi-stage safety filtering are harder to attack with simple encoding tricks. However, encoding-based approaches remain useful as part of a layered jailbreak strategy, combined with other techniques like roleplay or fictional framing.<\/p>\n\n\n\n Adversarial suffix attacks represent the most technically sophisticated jailbreak category. Rather than relying on human-crafted prompts, these attacks use gradient-based optimisation to find a sequence of tokens that, when appended to any harmful request, causes the model to comply.<\/p>\n\n\n\n The foundational work in this area is Zou et al. (2023)<\/a>, who introduced the Greedy Coordinate Gradient (GCG) method. GCG searches for a universal adversarial suffix that steers the model toward generating an affirmative response to any harmful query. The resulting suffixes often look like nonsensical character sequences to the human eye, but they exploit the model’s internal token representations in ways that override safety alignment.<\/p>\n\n\n\n Adversarial suffixes have two properties that make them particularly concerning from a security perspective. First, they can be universal, meaning a single suffix works across many different harmful prompts. Second, they can be transferable, meaning a suffix optimised against one model may work against a different model. The trade-off is that nonsensical suffixes are easy to detect with perplexity-based filters, which has driven research into more fluent adversarial prompts. AutoDAN<\/a> addresses this by using a genetic algorithm to evolve DAN-style prompts that are both effective and human-readable.<\/p>\n\n\n\n Mode switching prompts attempt to convince the model that it has an alternative operating mode where restrictions do not apply. Common framings include “developer mode,” “sudo mode,” “opposite mode” (where the model is asked to provide the opposite of its normal response, effectively negating its refusals), and “unrestricted mode.”<\/p>\n\n\n\n These prompts work when the model’s training data contains enough examples of mode-based behaviour that it treats the mode claim as a plausible instruction. Like DAN prompts, mode switching is brittle and tends to stop working as models are updated. It remains a useful technique for testing whether a model’s safety alignment is robust against framing-based bypasses.<\/p>\n\n\n\n LLM jailbreaking targets the safety restrictions trained into a model during alignment, going beyond prompt injection to defeat the model’s core refusal behaviour. The main technique categories are DAN prompts (persona-based universal bypasses), roleplay and fictional scenarios (framing-based context switching), token smuggling and encoding (input manipulation to evade filters), adversarial suffixes (gradient-optimised token sequences), and mode switching (false operating mode claims). Each category is continuously evolving as model providers patch known bypasses and researchers discover new variants.<\/p>\n","protected":false},"excerpt":{"rendered":" LLM jailbreaking bypasses safety alignment to force models into generating restricted content. Covers DAN, roleplay, token smuggling, and adversarial suffixes.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[821,630,109,51,818,819,715,708,591,820],"class_list":["post-530","post","type-post","status-publish","format-standard","hentry","category-security","tag-adversarial-attacks","tag-ai-red-teaming","tag-ai-security","tag-cybersecurity","tag-dan-prompts","tag-llm-jailbreaking","tag-owasp-llm-top-10","tag-prompt-injection","tag-red-teaming","tag-safety-alignment"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tJailbreak technique categories<\/h2>\n\n\n\n
Do Anything Now (DAN) prompts<\/h3>\n\n\n\n
Roleplay and fictional scenarios<\/h3>\n\n\n\n
Token smuggling and encoding<\/h3>\n\n\n\n
Adversarial suffixes<\/h3>\n\n\n\n
Mode switching<\/h3>\n\n\n\n
Summary<\/h2>\n\n\n\n