Jailbreaks: Talking an AI Out of Its Own Rules

The 30-second explanation

The model has rules about what it should not do. A jailbreak uses role-play, tricks or persuasion to get it to break them anyway.

How it works

1. 1

   1. Rule

   The model is told what not to do.

2. 2

   2. Reframe

   The attacker wraps the request in a story or trick.

3. 3

   3. Comply

   The model follows the clever framing.

4. 4

   4. Defend

   Independent checks catch the result.

Language models follow instructions, and safety training adds rules on top. Attackers experiment with phrasing that makes those rules seem not to apply, such as pretending to be in a fiction or splitting a request into harmless-looking parts. New tricks appear constantly, so no single fix works. Sensible designs assume some attempts will succeed, and add independent checks on inputs and outputs, limit what the model can do, and monitor for misuse.

Real-world example

How to spot it

• Role-play openers

  Requests that start with 'pretend you are…'.

• Hidden instructions in text

  Odd phrasing or encoded content in inputs.

• Long multi-turn drift

  Conversations that slowly push boundaries.

• Sensitive content in the system prompt

  Anything that would matter if revealed.

What to do

1. 1Do not put secrets in system prompts, and assume they can be revealed.
2. 2Add independent input and output checks, rather than relying on the model to police itself.
3. 3Monitor for repeated boundary-testing and review the patterns you see.