Concrete bypass writeups and a complete technical taxonomy of jailbreak categories — from role hijacking and multi-turn escalation to context inheritance, encoding exploits, and chain-of-thought abuse. Each entry is a working bypass plus the structural reason it works.
Jailbreaking a large language model means forcing it to produce outputs its designers explicitly trained it to refuse. Unlike simple misuse—asking for something prohibited and getting told no—a successful jailbreak systematically dismantles the alignment layer itself, exposing the raw capability beneath. This matters because every safety mechanism in a deployed model is only as strong as its weakest bypass. If an attacker can reliably strip the guardrails, the model’s full knowledge base—chemistry, code, social engineering scripts, operational tradecraft—becomes an unrestricted tool. Red teams study jailbreaking not to break things for sport but to map the exact boundary between “safe” and “compromised” so that defenders can harden it.
Jailbreak methods cluster into several distinct families, each exploiting a different structural weakness in how models process instructions and context.
Role hijacking overwrites the model’s assigned persona. Techniques like DAN (“Do Anything Now”) and system-prompt overrides force the model to adopt an identity with no safety constraints, effectively asking it to roleplay as an unrestricted version of itself.
Multi-turn escalation builds compliance gradually across a conversation. The attacker opens with benign queries, incrementally shifts the topic boundary, and leverages the model’s tendency to maintain conversational consistency until it produces outputs it would have refused cold.
Encoding exploits abuse the gap between the model’s content filters and its linguistic versatility. Base64 payloads, ROT13 substitution, Unicode homoglyphs, and code-wrapped requests all reach the same underlying knowledge while evading pattern-matched refusal triggers.
Context manipulation poisons the information the model trusts. By injecting crafted system messages, fabricating prior conversation history, or exploiting context-inheritance across sessions, attackers rewrite the rules the model believes it is operating under.
Chain-of-thought abuse weaponizes the model’s own reasoning process. When a model is prompted to “think step by step” about how a bypass would theoretically work, the reasoning trace itself often contains the prohibited content—the model produces the answer while explaining why it should not.
Each of these families and their variants are catalogued in detail in the jailbreaking wiki and the full technical taxonomy writeup on this hub.
These two attack surfaces overlap but target fundamentally different layers. Jailbreaking targets the model’s trained safety behavior—the RLHF-aligned refusal patterns baked into weights during fine-tuning. The attacker’s goal is to make the model ignore its own alignment. Prompt injection, by contrast, targets the instruction hierarchy in a deployed application: it tricks a model into treating attacker-supplied text as developer-level instructions, hijacking the application’s control flow rather than the model’s conscience. A prompt injection might exfiltrate data from a RAG pipeline without ever triggering a safety refusal; a jailbreak might produce dangerous content through a vanilla chat interface with no application layer at all. Both fall under adversarial prompting, but understanding the distinction is critical for building defenses that actually address the right threat surface.
Every model generation ships with harder alignment, and every harder alignment spawns new bypass research within weeks. GPT-4’s refusal surface was more robust than GPT-3.5’s—and it was jailbroken faster, because the research community had already mapped the attack surface taxonomy. Constitutional AI, RLHF, and rule-based reward models have all raised the cost of naive jailbreaks, but structural vulnerabilities—the ones rooted in how transformers process context, maintain state, and follow instructions—remain fundamentally open problems.
The AATMF framework maps this arms race systematically, treating each hardening measure and its corresponding bypass evolution as paired entries in a living threat model. AI red teaming as a discipline exists because static safety testing cannot keep pace with adversarial creativity. The only way to know where your model breaks is to hire people whose job is to break it.