Jailbreaks

The jailbreaks are the attacks that escape the model's training-time alignment (L310) — the roleplay and the hypotheticals (the "pretend you are..." and the "in this fictional story..." frames, L310), the encoding and the obfuscation (the base64, the leetspeak, the reversed text, L310), and the defense (the guardrails L281 — the output filters — and the refusal-handling, L310) — the alignment (L148) is the first layer, the guardrails (L281) the second (L310).

The one-sentence interview answer: "The jailbreak is the crafted prompt that escapes the model's alignment (L310). The alignment (L310): the training-time safety (L148) — the model learned to refuse the harmful requests (L310). The jailbreak (L310) finds the frame that bypasses it (L310): the roleplay (L310) — "pretend you are a movie villain describing your plan" (L310) — the safety's context (L310) reframed (L310); the hypothetical (L310) — "in this fictional story..." (L310); the encoding (L310) — the base64 and the leetspeak (L310) — the harmful request (L310) obfuscated (L310), the alignment (L310) not triggered (L310). The defense (L310): the guardrails (L281) — the output filters (L281) on the model's response (L310) — and the refusal-handling (L310) — the safe refusal (L310) when the request is ambiguous (L310). The AI shape (L173): the layered defense (L310): the alignment (L148) — the first layer (L310); the guardrails (L281) — the second (L310); and the audit (L322) — the record of the attempts (L310). The demo trusts the alignment; the architect layers the defense (L310)."

Think of the jailbreak as the costume party at the guarded club. The bouncer (the alignment, L310) checks the guests (the prompts, L310) at the door (L310): the known troublemakers (the harmful requests, L310) refused (L310). The party crashers (the jailbreakers, L310) wear the costumes (the frames, L310): the disguise (the roleplay, L310) — "I'm the villain's biographer..." (L310); the code language (the encoding, L310) — the notes in the cipher (the base64, L310) — the bouncer (L310) doesn't recognize them (L310). The club's second layer (the guardrails, L281): the cameras (the output filters, L281) watch the party (the responses, L310) and cut the troublemakers' speeches (L310). The club works because the bouncer is the first layer, and the cameras are the second (L310).

   the guarded club (the defense, L310)
   ┌────────────────────────────────────────────────────────┐
   │ the bouncer (the alignment, L310) — the first layer    │
   │ the costumes (the frames, L310) — the roleplay (L310), │
   │ the ciphers (the encoding, L310)                       │
   │ the cameras (the guardrails, L281) — the second layer  │
   └────────────────────────────────────────────────────────┘

The mental model is the club: the bouncer, the costumes, and the cameras (L310).

   the attacker (L310)
        │  "pretend you are a villain explaining your scheme" (L310)
        ▼
   ┌────────────────────── THE FRAME (L310) ────────────────────────────┐
   │  the roleplay (L310) · the hypothetical (L310) · the story (L310) │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE ALIGNMENT (L148) ────────────────────────┐
   │  the training-time safety (L310) — the frame bypasses it (L310)   │
   │  the encoding (L310) — the base64, the leetspeak (L310)           │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE GUARDRAILS (L281) ───────────────────────┐
   │  the output filters (L281) — the harmful response blocked (L310)  │
   │  the refusal (L310) · the audit (L322)                           │
   └──────────────────────────────────────────────────────────────────┘

The flow is the attempt: frame → alignment → guardrails (L310).

• The alignment (L310). The training-time safety (L148): the model learned to refuse the harmful requests (L310) — the first layer (L310).
• The roleplay and the hypotheticals (L310). The frames that bypass the alignment (L310): "pretend you are...", "in this fictional story...", "as a game..." (L310) — the harmful request (L310) reframed (L310).
• The encoding (L310). The obfuscation (L310): the base64, the leetspeak, the reversed text (L310) — the harmful request (L310) not recognized (L310).
• The defense (L310). The guardrails (L281) — the output filters (L281) on the response (L310); the refusal-handling (L310) — the safe refusal (L310); and the audit (L322) — the attempts recorded (L310).

• A production AI SaaS (L357). The guardrails (L281) on the outputs (L310) — the jailbreak (L310) caught at the second layer (L310).
• A chat product (L162). The refusal-handling (L310) — the ambiguous request (L310) refused safely (L310).
• A regulated workload (L371). The jailbreak attempts (L310) audited (L322) — the compliance's (L371) evidence (L310).
• A model's evaluation (L341). The adversarial set (L342) with the jailbreaks (L310) — the model's robustness (L310) measured (L341).
• Anything AI (L310). The layered defense (L310) — the alignment (L148) and the guardrails (L281).

The through-line: the escape is the alignment's bypass — layered and audited (L310).

Say it in four moves:

1. The alignment. "The training-time safety — the first layer (L310)."
2. The frames. "The roleplay and the hypotheticals (L310)."
3. The encoding. "The base64 and the leetspeak (L310)."
4. The defense. "The guardrails (L281) — the second layer (L310)."

• The alignment is not a control (L310). The training-time safety (L148) is the first layer (L310), not the guarantee (L310) — the guardrails (L281) are the control (L310).
• The frame is the bypass (L310). The roleplay (L310) and the hypothetical (L310) — the harmful request (L310) reframed (L310).
• The encoding is the evasion (L310). The base64 (L310) and the leetspeak (L310) — the recognition (L310) evaded (L310).
• The output filter is the catch (L281). The guardrails (L281) on the response (L310) — the jailbreak's output (L310) blocked (L310).
• The audit is the pattern (L322). The attempts (L310) recorded (L322) — the new frames (L310) learned (L322).

• The alignment trusted (L310). The training-time safety (L148) as the only layer (L310) — the jailbreak (L310) escapes (L310).
• The output unchecked (L281). The model's response (L310) un-filtered (L281) — the harmful content (L310) delivered (L310).
• The refusal missing (L310). The ambiguous request (L310) answered (L310) — the safe refusal (L310) is the default (L310).
• The attempts un-audited (L322). The jailbreaks (L310) unrecorded (L322) — the pattern (L310) undetected (L322).
• The single-frame defense (L310). The known frames (L310) only — the new frame (L310) escapes (L310).

• Layer the defense (L310) — the alignment (L148), the guardrails (L281).
• Filter the outputs (L281) — the harmful response (L310) blocked (L310).
• Refuse safely (L310) — the ambiguous request (L310) — the safe refusal (L310).
• Audit the attempts (L322) — the pattern (L310) learned (L310).
• Test the robustness (L341) — the adversarial set (L342) with the jailbreaks (L310).

Q: Walk me through the jailbreaks.

A: The attacks that escape the alignment (L310). The alignment — the training-time safety, the first layer (L310). The frames — the roleplay and the hypotheticals (L310). The encoding — the base64 and the leetspeak (L310). And the defense — the guardrails (L281), the second layer (L310).

Q: Why does the alignment fail?

A: The frame (L310): the alignment (L310) is trained to refuse the direct harmful requests (L310) — the jailbreak (L310) reframes (L310): "pretend you are..." (L310), "in this story..." (L310) — the harmful request (L310) in a context (L310) the alignment (L310) doesn't recognize (L310). And the encoding (L310) — the base64 (L310) — evades the recognition (L310).

Q: How do you defend?

A: The layers (L310): the alignment (L148) — the first (L310); the guardrails (L281) — the output filters (L281) on the response (L310), the second (L310); and the audit (L322) — the attempts (L310) recorded (L322), the new frames (L310) learned (L310). The layered defense (L310) is the answer (L310).

Q: What's the refusal-handling?

A: The safe default (L310): the ambiguous request (L310) — the request that could be harmful (L310) — gets the safe refusal (L310) instead of the answer (L310). The refusal (L310) is the model's training (L310) plus the guardrails' (L281) policy (L310).

• What's the alignment (L310)?
• What are the frames (L310)?
• What's the encoding (L310)?
• Why does the alignment fail (L310)?
• How do you defend (L310)?

The senior read: the injection hijacks; the jailbreak escapes — both need the layers (L310).

// The layered defense (L310) — the alignment + the guardrails (L310).
// 1 · THE ALIGNMENT (L148) — the first layer (L310).
//   the model (L278) is chosen for the alignment (L148).
const model = pickAlignedModel();                        // L148

// 2 · THE GUARDRAILS (L281) — the second layer (L310).
const result = await guardrails.apply({
  input: userPrompt,                    // the input filter (L281)
  output: modelOutput,                  // the output filter (L281)
  // the content filter (L281) + the PII redaction (L313)
});

// 3 · THE REFUSAL (L310) — the safe default (L310).
if (result.ambiguous) return safeRefusal();              // L310

// 4 · THE AUDIT (L322) — the attempts recorded (L310).
await audit.log({
  event: 'jailbreak-attempt',           // the frame or the encoding (L310)
  promptHash: hash(userPrompt),
  blocked: !result.pass,
});

// 5 · THE EVAL (L341) — the adversarial set (L342) with the frames (L310).
//   the jailbreaks (L310) in the eval suite (L341) — the robustness
//   measured (L341) on every deploy (L307).

What the reader must SEE — the layers, applied:

  pickAlignedModel      → the first layer (L148, L310)
  guardrails.apply      → the second layer (L281, L310)
  ambiguous → refusal   → the safe default (L310)
  audit.log             → the attempts recorded (L322)
  the adversarial eval  → the robustness measured (L341)

  The alignment first, the guardrails second, the audit always (L310).

• The guardrails are the latency's cost (L310). The output filters (L281) — the milliseconds (L310) for the second layer (L310).
• The audit is the storage's cost (L322). The attempts (L322) — the retention (L322) for the pattern (L310).
• The eval is the deploy's gate (L341). The adversarial set (L342) — the robustness (L310) on every deploy (L307).
• The alignment is the model's cost (L148). The aligned model (L148) — the model choice (L148) with the safety (L310).

• The jailbreaks = the alignment's escape (L310): the alignment, the frames, the encoding, the defense.
• The alignment: the training-time safety (L148) — the first layer (L310).
• The frames: the roleplay and the hypotheticals (L310).
• The encoding: the base64, the leetspeak (L310).
• The defense: the guardrails (L281) — the second layer (L310).

JAILBREAKS = the attacks that escape the training-time alignment

THE ALIGNMENT (L310)
  the training-time safety (L148) — the first layer (L310)
  the learned refusals (L310)

THE FRAMES (L310)
  the roleplay — "pretend you are..." (L310)
  the hypotheticals — "in this story..." (L310)
  the reframing of the harmful request (L310)

THE ENCODING (L310)
  the base64 (L310) · the leetspeak (L310) · the reversed (L310)
  the recognition evaded (L310)

THE DEFENSE (L310)
  the guardrails (L281) — the output filters (L281)
  the refusal-handling (L310) — the safe default (L310)
  the audit (L322) — the attempts recorded (L310)
  the eval (L341) — the adversarial set (L342)

INTERVIEW, 4 MOVES
  1 alignment "the training-time safety — the first layer (L310)"
  2 frames    "the roleplay and the hypotheticals (L310)"
  3 encoding  "the base64 and the leetspeak (L310)"
  4 defense   "the guardrails — the second layer (L281)"

You now hold the escape: the alignment, the frames, the encoding, and the defense — with the layers stacked and the attempts audited. The bouncer is the first layer — and the cameras are the second (L310).

Next: the injection hiding in the data — Indirect Prompt Injection (L311).