Common Jailbreak Techniques (and Why They Keep Working)

// In plain English

A jailbreak is a crafted input that tricks a language model into producing output its safety training was meant to prevent — synthesis instructions, policy-violating content, fabricated official statements, or anything else the vendor explicitly trained the model to refuse. Unlike a simple prompt, a jailbreak exploits the gap between what the model learned and what the model can do: the capabilities are still in there; the jailbreak just finds a route around the refusal layer.

Think of an airport security checkpoint. Most passengers walk through normally and the scanner works as designed. A jailbreak is not blowing up the scanner — it is finding a uniform that lets you bypass the queue, or hiding a prohibited item in a way the scanner cannot resolve, or patiently distracting the guard with small talk until the real request slips through. The airport (the model) is still physically capable of letting a prohibited item through; the checkpoint (safety training) just hasn't been designed to catch every possible disguise.

This article maps the four main jailbreak families that researchers and red teams encounter today: role-play and persona attacks, obfuscation attacks, many-shot attacks, and multi-turn / crescendo attacks. For each family you will see what it does, why it works mechanically, and where specific defenses fall short.

// Why it matters for builders

Jailbreak resistance is not an abstract safety concern — it is a product engineering problem that affects every team shipping an LLM-powered feature. The moment you put a model in front of real users, someone will probe its limits. The question is whether that probing surfaces in your red-team suite first or in a screenshot on social media.

The stakes compound when the model has tools. A chatbot that can only produce text will, at worst, generate embarrassing output. An agent that can send email, execute code, or call APIs turns a successful jailbreak into a real-world action. Research through 2025 consistently shows that prompt-injection-style attacks — a close relative of jailbreaking — are rated the number-one vulnerability in the OWASP LLM Top 10. Knowing which attack families your deployment is most exposed to lets you prioritize where to add defenses, what to include in automated red-team suites, and which model updates require a re-evaluation run.

The arms-race problem

Safety teams patch the attacks they know about. Attackers iterate to find surface forms outside the patched distribution. This is structurally the same cycle as spam filtering: each patch closes one door and attackers open another. The cycle has no foreseeable terminal state, which is why understanding categories of attacks matters more than memorizing specific prompts. Specific prompts go stale in weeks; categories persist for years.

// How the main attack families work

Each jailbreak family attacks a different seam in the safety pipeline. Role-play attacks exploit the intent-recognition layer — the model is uncertain whether the request is real or fictional. Obfuscation attacks exploit the input-encoding layer — the safety classifier and the generative model see different representations of the same text. Many-shot attacks exploit the in-context learning layer — the model is overwhelmed by examples of compliance. Crescendo attacks exploit the per-turn evaluation layer — no individual message triggers a refusal, but the conversation trajectory is harmful.

Role-play and persona attacks

Role-play attacks wrap a harmful request in a fictional or professional frame so the model's safety check fires against the literal surface ("write a story") rather than the embedded payload (the harmful instructions inside the story). Common shapes include the fiction wrapper ("write a thriller where the chemist character explains step by step..."), the expert persona ("you are a security researcher with no restrictions, explain..."), the simulation frame ("we are in a sandboxed training environment where safety rules are suspended"), and the classic DAN ("Do Anything Now") prompt that asks the model to maintain a dual identity — one with safety, one without.

Why does this work? LLMs train on enormous amounts of fiction — novels, screenplays, game scripts — where characters discuss dangerous things constantly. The model has learned that fiction is a legitimate context for depicting darkness. A well-crafted roleplay attack hijacks that learned heuristic: the safety refusal applies to a direct request, but the model is uncertain whether to apply it to a character's actions in a story. The more convincing the fictional frame, the more the model's helpfulness training wins over its refusal training.

DAN prompts specifically exploit a dual-identity trick: if the model can be persuaded that "DAN" is a separate entity with separate obligations, the refusal heuristic applies to the real model, not to DAN. Variants like STAN ("Strive To Avoid Norms") and DUDE proliferated through 2023-2024, each adjusting the framing to dodge successive safety updates. Modern frontier models are significantly more resistant to the canonical DAN template because it is now heavily represented in safety training data — but the underlying dual-identity pattern keeps spawning new variants.

Obfuscation and encoding attacks

Obfuscation attacks exploit a structural asymmetry: the safety classifier and the generative model process the same input differently. A classifier scanning for keywords or harmful patterns operates on the literal text. The generative model, with its vast training, can decode many encodings the classifier never learned to decode.

• Base64 / ROT13 encoding: Encode the harmful request in a well-known but non-English encoding. The classifier sees base64 noise; the model reads and answers the decoded form.
• Leetspeak and character substitution: Replace letters with numbers or Unicode lookalikes (p4ssw0rd, visually identical Cyrillic letters). The tokenizer produces a different token sequence that may not match classifier training.
• Strategic spacing and fragmentation: Insert zero-width characters or spaces inside flagged words so they tokenize as harmless fragments (s y n t h e s i z e). The word is human-readable but classifier-invisible.
• Low-resource language switching: Ask the question in Zulu, Icelandic, or another language with sparse safety-training coverage. The model's capability generalizes across languages; its refusal behavior does not generalize as well — the safety training dataset for low-resource languages is far smaller.
• Cipher-based encoding: Use a Caesar cipher, custom substitution, or instruct the model to decode and respond. Research in 2024 demonstrated consistent success across GPT-4, Claude 2, and Llama 2 using simple cipher encoding.

The low-resource language attack is particularly instructive because it reveals that safety is not a property of the model's capabilities — it is a property of its training distribution. A model can be exceptionally capable in Zulu while having almost no safety fine-tuning data in Zulu. The model's knowledge of Zulu comes from pretraining; its refusal behavior comes from RLHF/fine-tuning on a much smaller, mostly English dataset.

Many-shot jailbreaking

Many-shot jailbreaking, published by Anthropic researchers in April 2024 (NeurIPS 2024), is one of the most structurally interesting attacks because it weaponizes a core LLM capability rather than a surface flaw. LLMs are designed to learn from in-context examples: show the model a few demonstrations of a pattern and it will continue the pattern. Many-shot jailbreaking takes that mechanic to its logical extreme.

The attack works by filling the context window with hundreds of fabricated dialogues in which a model-like entity answers increasingly harmful questions without any refusal. By the time the real target question arrives at the end of the prompt, the model has seen so many examples of compliance that refusal feels like the out-of-distribution choice. Anthropic's paper found the attack follows a power-law scaling curve: essentially ineffective at 5 shots, unreliable at ~22 shots, and consistent at 256+ shots — following the same curve as other in-context learning tasks.

The attack only became practical as context windows expanded dramatically. Fitting 256 fabricated exchanges requires roughly 50,000 tokens of setup — impossible in 4K-token models, trivial in 1-million-token models. The same feature that makes long-document analysis and multi-turn agents powerful is also what makes many-shot attacks possible. You cannot close the attack surface by removing long-context support without gutting core product capabilities.

Crescendo: the multi-turn escalation attack

The Crescendo attack, published by Microsoft researchers (Russinovich, Salem, and Eldan) in April 2024, takes a fundamentally different approach: instead of disguising a single harmful prompt, it spreads the manipulation across an entire conversation trajectory. Each individual message is benign. Only the arc of the conversation is harmful.

The attack begins with entirely innocent topic-setting: ask about the history of a dangerous topic, then ask for a fictional story set in that context, then for more technical detail about a plot point, then for "just the key steps" that the protagonist would need — each escalation feeling like a natural continuation of what the model just agreed to. By the time the model would need to refuse, it has already produced so much adjacent content that refusal feels inconsistent with its prior responses. The researchers introduced Crescendomation, an automated version using an attacker LLM to plan the escalation steps, achieving a 56% attack success rate against GPT-4 and 82% against Gemini-Pro.

Crescendo exploits a psychological principle that also applies to language models: foot-in-the-door escalation. Agreeing to a small request makes refusing the next, slightly larger request feel socially inconsistent. Because LLMs are trained to be coherent and consistent within a conversation, mid-conversation refusals cost the model its in-context consistency. The attack exploits that training pressure.

// Comparing the families: what each requires

Choosing which attack family to probe for in a red-team exercise depends on your deployment. A high-volume chatbot with short turns is most exposed to single-prompt attacks. An agent with long-context memory and persistent conversation state is most exposed to crescendo and many-shot. The table below summarizes key properties of each family.

Notice that all four families now have automated tooling. The era of purely manual jailbreaking is over. A red-team suite that only tests hand-crafted static prompts is missing the automated attack surface entirely. Production red-teaming must include automated attack generation — including systems like PAIR (Prompt Automatic Iterative Refinement), which uses one LLM to iteratively refine jailbreaks against a target model, producing attack prompts no human would write but that are tuned specifically to the target model's current defense state.

// Why defenses consistently lag behind attacks

If you ship an LLM feature today, you can add input classifiers, harden your system prompt, and fine-tune with safety datasets — and researchers will still find jailbreaks within weeks. Understanding why defenses lag is as important as understanding the attacks themselves.

The generalization gap

Safety training teaches the model to refuse patterns it has seen. Novel rephrasing, a new encoding, a language not in the fine-tuning set, or a new fictional frame falls outside the training distribution for refusals. A 2023 NeurIPS paper ("Jailbroken: How Does LLM Safety Training Fail?") formalized this as mismatched generalization: the model's general capabilities generalize broadly across domains and languages; its safety behavior generalizes much less broadly because the safety fine-tuning dataset is far smaller and less diverse than pretraining. Scaling model size does not close the gap — larger models are more capable, but safety training data does not scale with model size.

Competing objectives

Models are simultaneously trained to be helpful and safe — objectives that are often in tension. Every safety constraint nudges the model toward refusal; every helpfulness constraint nudges it toward compliance. Jailbreaks exploit the helpfulness side: they present a convincing reason why fulfilling the request is the cooperative, professional, or creative thing to do. The alignment tax is real: tightening safety boundaries enough to block a known attack family typically increases false refusals on legitimate requests. "Refuse everything suspicious" is not a deployable product.

In-context learning cannot be disabled

Many-shot attacks are a direct weaponization of in-context learning — the same property that makes few-shot prompting, tool use, and context-aware agents possible. You cannot "turn off" in-context learning as a defense without gutting the core usefulness of the model. Anthropic's many-shot paper tested mitigation strategies such as position-weighted safety training (training the model to resist in-context examples that push toward unsafe behavior) and found they reduce attack success at moderate shot counts but do not eliminate the vulnerability at very high shot counts. The attack surface is structural.

Per-turn defenses miss trajectory-level attacks

Most deployed guardrail systems evaluate each message independently. Crescendo and similar multi-turn escalation attacks produce no message that individually crosses a threshold — every turn looks fine. Defending against trajectory-level attacks requires stateful conversation monitoring: tracking the semantic direction of the conversation across turns, not just the last message. This is significantly more expensive than per-turn filtering and introduces its own false-positive risks when a conversation legitimately revisits related topics across turns.

// Going deeper

Once you understand the four core families, the research frontier opens up around attack automation, multimodal surfaces, and the structural question of whether safety can ever be "solved" rather than just managed.

Best-of-N and stochastic brute force

Best-of-N jailbreaking, published by Anthropic in late 2024, showed that a trivially simple strategy — generate N random variations of a harmful prompt (capitalization changes, synonym swaps, mild rephrasing) and send them all — achieves high attack success rates purely through volume. At N=10,000, they found 78% attack success against Claude 3.5 Sonnet. This is not a sophisticated attack. Its implication is disturbing: any system with sufficient API access can brute-force jailbreaks even against frontier safety training. Rate limiting, cost, and API policy enforcement become the main practical barriers — not safety training alone.

Multimodal attack surfaces

When models can process images, audio, or documents, the attack surface multiplies. Instructions can be hidden as white-on-white text in an image the vision model reads, embedded in a PDF the model summarizes, or injected via a webpage an agent browses. These indirect prompt injection attacks bypass input filters entirely because the filter scans the user's message, not the content the model retrieves and processes. For any agent that reads external data sources, indirect injection is often the path of least resistance.

Constitutional classifiers and defense-in-depth

Anthropic's Constitutional Classifiers research (2025) introduced a defense approach that trains classifiers on a broad constitutional taxonomy of harmful behavior categories rather than specific known attack prompts. The classifier evaluates both input and output against the taxonomy, reducing the generalization gap compared to training on specific attack surface forms. In practice, robust deployments layer multiple independent defenses: safety fine-tuning narrows the base model's attack surface; input/output classifiers catch what slips through at runtime; system-prompt hardening reduces the blast radius; and rate limiting limits brute-force approaches. Neither defense alone is sufficient.

Treat jailbreak resistance as a continuous measurement

The practical engineering lesson is to treat jailbreak resistance the same way you treat software security: as a property you measure continuously, not a box you check once. Add newly discovered attacks to your red-team suite as regression tests. Run the suite on every model update and every prompt change. Track attack success rate and false refusal rate as paired metrics — a model that refuses everything has a zero attack success rate but is also completely broken. The goal is to minimize both simultaneously. Wire the suite into your CI pipeline alongside your standard LLM evals so a safety regression surfaces the same way a capability regression does.