Jailbreak — AI Glossary

Reference details

Related terms

• Red Teaming
• Prompt Injection
• Guardrails

How it works

1. Safety behaviour is learned from training rather than enforced by a rule, so it is a strong tendency with a decision boundary that can be approached.
2. Role-play framings ask the model to adopt a persona for which the refusal does not obviously apply, moving the request away from the shapes refusal training covered.
3. Encoding and obfuscation hide the request's surface form, so the refusal classifier inside the model has less to recognise.
4. Multi-turn erosion establishes innocuous premises across several turns and makes the final ask a small step, which single-turn safety evaluation never sees.
5. Defences are layered because none is complete: safety training, separate input and output classifiers, and refusal of categories rather than of phrasings.

Example: Why single-turn testing misses the method that works

A direct request is refused. The same request as the tenth turn of a conversation that has established a fictional frame, agreed a persona, and secured four harmless answers is materially more likely to succeed — and a single-turn safety suite would score the model as refusing, because it only ever asked turn one. The attack's mechanism is accumulated context, so the evaluation has to be multi-turn to observe it at all. A refusal rate measured on isolated prompts is not a claim about conversations.

Commonly confused with

Routinely confused with prompt injection, and they differ in who is attacked. A jailbreak is the operator's own user talking the model past its safety training, so the harm is the output they receive. Prompt injection uses third-party content to hijack a system acting for someone else, so the victim is that user and the harm is usually an action taken with their credentials. A model hardened against jailbreaks is not thereby protected against injection, and the architectural defence for injection — never letting retrieved text reach the instruction position — does nothing for jailbreaks.

When to use it

Reach for it when:

• Red-teaming a user-facing model for refusal robustness.
• Explaining why multi-turn safety evaluation is necessary rather than optional.
• Justifying classifier layers alongside safety training rather than instead of it.

Reach for something else when:

• Describing third-party content hijacking an agent, which is prompt injection.
• Describing a wrong answer with no adversary, which is a hallucination.
• As a measure of system security, since the model is one layer of several.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Jailbreak — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path